Skip to content

clamp group physicalDeviceCount to VK_MAX_DEVICE_GROUP_SIZE#1945

Merged
charles-lunarg merged 1 commit into
KhronosGroup:mainfrom
aizu-m:group-phys-dev-count-clamp
Jun 23, 2026
Merged

clamp group physicalDeviceCount to VK_MAX_DEVICE_GROUP_SIZE#1945
charles-lunarg merged 1 commit into
KhronosGroup:mainfrom
aizu-m:group-phys-dev-count-clamp

Conversation

@aizu-m

@aizu-m aizu-m commented Jun 23, 2026

Copy link
Copy Markdown
Contributor

Tracing how driver-reported counts flow into the device-group sort.

out-of-bounds write, linux_sort_physical_device_groups (loader_linux.c:363):
    internal_device_info[gpu] = ...      gpu < group_props.physicalDeviceCount
    internal_device_info is [VK_MAX_DEVICE_GROUP_SIZE]   (32 entries)

VkPhysicalDeviceGroupProperties::physicalDevices is a fixed [VK_MAX_DEVICE_GROUP_SIZE] array, and loader_physical_device_group_term embeds a matching internal_device_info[VK_MAX_DEVICE_GROUP_SIZE]. terminator_EnumeratePhysicalDeviceGroups copies each group straight from the ICD into local_phys_dev_groups[...].group_props and trusts physicalDeviceCount unmodified.

An ICD that reports physicalDeviceCount greater than 32 then drives the consumers off the end of those fixed arrays: the Linux sort writes past internal_device_info, while the Windows sort and setup_loader_tramp_phys_dev_groups read past physicalDevices. The count from the first (group-count) query is already clamped, but the per-group device count never was.

Clamp it to VK_MAX_DEVICE_GROUP_SIZE at the two points where the group is copied in, so every downstream consumer sees a count that fits its array. The plain-device path already sets the count to 1.

@ci-tester-lunarg

Copy link
Copy Markdown

Author aizu-m not on autobuild list. Waiting for curator authorization before starting CI build.

1 similar comment
@ci-tester-lunarg

Copy link
Copy Markdown

Author aizu-m not on autobuild list. Waiting for curator authorization before starting CI build.

@ci-tester-lunarg

Copy link
Copy Markdown

CI Vulkan-Loader build queued with queue ID 15195.

@ci-tester-lunarg

Copy link
Copy Markdown

CI Vulkan-Loader build # 3582 running.

@ci-tester-lunarg

Copy link
Copy Markdown

CI Vulkan-Loader build # 3582 passed.

@charles-lunarg charles-lunarg merged commit 848a2b2 into KhronosGroup:main Jun 23, 2026
51 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants