Skip to content

Data race on g_framesInFlight in BestPracticesLayerXrSyncActions #581

@jlegg0

Description

@jlegg0

In BestPracticesLayerXrSyncActions, there is a call to g_framesInFlight.empty() without g_frameMutex being locked. If g_framesInFlight wasn't empty at the time, g_frameMutex is then locked and g_framesInFlight.front() is used. The use of g_framesInFlight before the mutex is locked allows a data race. g_framesInFlight could have been emptied by a call to xrEndFrame on another thread before the mutex is locked by the thread calling xrSyncActions. This can cause address sanitizer to diagnose a container overflow, since front requires an element and there may no longer be one.

If my understanding of the OpenXR spec is correct, external synchronization is required for the session parameter of xrEndFrame only with respect to other calls to xrEndFrame, xrBeginFrame or xrDestroySession, and it appears permissible to call other functions such as xrWaitFrame or xrSyncActions on another thread at the same time as xrEndFrame despite passing the same XrSession.

Metadata

Metadata

Assignees

No one assigned

    Labels

    synced to gitlabSynchronized to OpenXR internal GitLab

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions