Vulkan: create_device reads the device extension list after freeing it (random crash at start)

Open Beginner friendly
  • Is something wrong?
#488 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
1/5
Estimated time
1-3 hours
Newbie friendliness
62/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
c
Domain
backend

Research direction

Start in runtime/nvn/vulkan/device.c at the create_device function and review the free(ep) call against the later has_ext(ep, ne, ...) checks. Move the free to after vkCreateDevice, as the issue describes, then verify startup no longer crashes; the report notes 30 successful starts with this change.

Written by the indexing model from the issue text.

Description

On test 257b1f3, create_device in runtime/nvn/vulkan/device.c frees the device's extension list and then reads it again:

  • device.c:630: free(ep);, just after the present wait check
  • device.c:838: has_ext(ep, ne, VK_EXT_EXTENDED_DYNAMIC_STATE_EXTENSION_NAME), from 33b0869. This runs on every GPU that has the extension.
  • device.c:869, 882, 896: the FSR 4 checks for cooperative matrix, FP8 and compute derivatives. These run on AMD with the FSR DLLs.

Usually the freed block still holds the list, so the check passes. Sometimes the heap has given the pages back, and the start crashes in strcmp (ucrtbase) inside has_ext. The last line in the log is then [vk] attachment feedback loops on, and no crash report follows, because the crash handler is installed only with the first guest thread.

Seen on Windows 11 with an RTX 5060 Ti (driver 617.42): 4 crashes in 53 starts. Caught with the crash handler installed early:

[plat] access violation: read at 0x16f2d826060, allocation 0x16f2d380000+0x11000, state 0x2000, protection 0
*** exception c0000005 accessing 0x16f2d826060
    host pc 7ff88296d8b0 (ucrtbase.dll+ed8b0)

The return address points into ui_window_init, where create_device is inlined. It's the strcmp in the has_ext loop (stride 0x104 = sizeof(VkExtensionProperties)).

Fix: move free(ep); to just after VK_CHECK(vkCreateDevice(...)) (line 935). Nothing after that reads ep, and no entry of ext[] points into it. With that change, 30 of 30 starts were fine. It's commit 09d07f1 in #345 if you want to take it from there, but it's a two-line change.

Dominant language
C
Stars
811
Forks
37
Avg merge
17m
Merged PRs (30d)
13

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from Revivedx/SavageWindRecomp

All issues in Revivedx/SavageWindRecomp

Similar issues

More C issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.