Skip to content

break cyclic meta-layer recursion in loader_add_meta_layer#1968

Merged
charles-lunarg merged 1 commit into
KhronosGroup:mainfrom
aizu-m:meta-layer-recursion-guard
Jul 13, 2026
Merged

break cyclic meta-layer recursion in loader_add_meta_layer#1968
charles-lunarg merged 1 commit into
KhronosGroup:mainfrom
aizu-m:meta-layer-recursion-guard

Conversation

@aizu-m

@aizu-m aizu-m commented Jul 12, 2026

Copy link
Copy Markdown
Contributor

Found while fuzzing the loader settings file with malformed layer manifests.

==ERROR: AddressSanitizer: stack-overflow
    #3 loader_add_meta_layer     loader.c:1493
    #5 loader_add_meta_layer     loader.c:1493
    #6 loader_add_implicit_layer loader.c:1454
    #7 loader_add_meta_layer     loader.c:1493
    ...

Two meta-layers whose component_layers list each other recurse loader_add_meta_layer -> loader_add_implicit_layer -> loader_add_meta_layer and never stop. The stack runs out inside vkCreateInstance.

verify_all_meta_layers already catches these cycles and drops the offending layers, but it only runs over layers found through normal discovery. Layers named in vk_loader_settings.json arrive through get_settings_layers and never reach that pass, so the cycle is still live once expansion starts. b56f871 took the recursion out of loader_find_layer_name_in_meta_layer for the same reason; this sibling was missed.

The guard is a per-layer is_being_expanded flag, set on entry to loader_add_meta_layer and cleared once its components are walked. Re-entering a layer already on the expansion stack logs a warning and returns rather than recursing. A well-formed meta-layer that pulls in another meta-layer still expands exactly as before.

Added SettingsFile.CyclicMetaLayerComponentDoesNotRecurse, which points two settings meta-layers at each other. It overflows the stack under ASan without the guard and passes with it.

A settings-file meta-layer whose component chain loops back on itself skips the verify_all_meta_layers cycle check and recurses through loader_add_meta_layer until the stack overflows. Guard the expansion with a per-layer flag so a layer already on the stack stops instead of recursing.
@ci-tester-lunarg

Copy link
Copy Markdown

Author aizu-m not on autobuild list. Waiting for curator authorization before starting CI build.

1 similar comment
@ci-tester-lunarg

Copy link
Copy Markdown

Author aizu-m not on autobuild list. Waiting for curator authorization before starting CI build.

@charles-lunarg charles-lunarg left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

OSS-Fuzz found a similar crash that I fixed by simply disabling meta layers from enabling other meta layers.

Since meta-layers aren't necessary any more, I am content with removing the ability for meta layers to enable other meta layers. That feature was never required, only existed as a fallout of 'yeah I guess this could work'. Having variables that live in the layer properties that mutate as the layers are loaded is a counter intuitive design.

In other words, I'm happy to take this PR as it, but would also would be happy with a 'remove this feature' PR. I am happy to make that PR as well, since fixing this bug is already a big help.

@ci-tester-lunarg

Copy link
Copy Markdown

CI Vulkan-Loader build queued with queue ID 38308.

@ci-tester-lunarg

Copy link
Copy Markdown

CI Vulkan-Loader build # 3630 running.

@ci-tester-lunarg

Copy link
Copy Markdown

CI Vulkan-Loader build # 3630 passed.

@charles-lunarg charles-lunarg merged commit 2feb31c into KhronosGroup:main Jul 13, 2026
51 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants