Comment 7 for bug 1946359
Revision history for this message
| Rodrigo Figueiredo Zaiden (rodrigo-zaiden) wrote | #7 |
© 2004
Canonical Ltd.
•
Terms of use
•
Data privacy
•
Contact Launchpad Support
•
Blog
•
Careers
•
System status
•
35a32c5
(Get the code!)
I reviewed vulkan 1.1.70+
This shouldn't be considered a full audit but rather a quick gauge of
maintainability.
vulkan is an API to control GPUs with many attributes, mainly: driver loaders,
validation layers and tools. This source package existed up until bionic and
was later split in 3 other packages: vulkan-loader, vulkan-tools and
vulkan-
later releases is part of the vulkan-tools source package.
My main concern is that upstream does not maintain this code[1] anymore, it was
moved to other repos[2][3][4][5] and the code does not match, that is, the
backport is not trivial and more than that, the code has changed too much and
many fixes can't be backported as far as I could dig into.
The most concerning issues would be (the highs from Coverity, excluding
external/):
- An out-of-bounds in loader/
the backport is quite a big change[6], increasing the chance of regressions.
- A memory overlap issue in loader/ that still exists in the newer repos, and
I've reported to upstream to get their opinion:
https:/
- Two use-after-free issues in layers/
the corresponding fix in vulkan-layer new repo[4].
I understand that the loader/ and layers/, the main points of my criticism were
moved to vulkan-loader, that is not in the MIR for newer releases (it is
vulkan-tools), but for bionic I believe we can't skip checking it since we would
be promoting vulkan-utils package. So, I would suggest this MIR to be rejected.
From a security point of view, this code is not maintainable.
Security team NACK for promoting vulkan to main: the code maintainability is
not sustainable.
[1] https:/
[2] https:/
[3] https:/
[4] https:/
[5] https:/
[6] https:/