From 08d8dffd96b95843b34634a1de03d544c014b7a3 Mon Sep 17 00:00:00 2001 From: Robert Quill Date: Thu, 6 Feb 2020 11:07:55 +0000 Subject: [PATCH 1/2] Fix use-after-free of IMGDNN network outputs. Destroy imgdnn_memory for network outputs in ANeuralNetworkExecution_notifyWait after they are unlocked, instead of at the end of ANeuralNetworksExecution_startCompute. Fixes "CL: Invalid memory object" errors in test_serialize and test_binary. --- src/backends/imgdnn/execution.cpp | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/backends/imgdnn/execution.cpp b/src/backends/imgdnn/execution.cpp index c9f2688..1ad01a2 100644 --- a/src/backends/imgdnn/execution.cpp +++ b/src/backends/imgdnn/execution.cpp @@ -151,8 +151,6 @@ ResultCode ANeuralNetworksExecution_setOutput( BACKEND_CALL_RET(ret, imgdnnBindingAddOutput, execution->imgdnn_binding_, execution->imgdnn_outputs_[uindex], img_memory); IMGDNN_RETURN_ERR_IF_ERROR(ret); - // Store the memory objects to free them after the execution - execution->imgdnn_memories_.push_back(img_memory); // Store the memory objects to be able to lock them later execution->host_output_memories.emplace_back(data, img_memory); } @@ -405,6 +403,10 @@ ResultCode ANeuralNetworksExecution_notifyWait( ANEURALNETWORKS_BAD_DATA); BACKEND_CALL_RET(ret, imgdnnMemoryUnlock, hom.img_mem); IMGDNN_RETURN_ERR_IF_ERROR(ret); + + // Destroy output memory now it's been read + BACKEND_CALL_RET(ret, imgdnnMemoryDestroy, hom.img_mem); + IMGDNN_RETURN_ERR_IF_ERROR(ret); } execution->host_output_memories.clear(); return ANEURALNETWORKS_NO_ERROR; From 6e63b53a993a4f048d916de2987cb4356efacf8f Mon Sep 17 00:00:00 2001 From: robquill Date: Thu, 6 Feb 2020 14:28:45 +0000 Subject: [PATCH 2/2] Update src/backends/imgdnn/execution.cpp Co-Authored-By: Romain Biessy --- src/backends/imgdnn/execution.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/backends/imgdnn/execution.cpp b/src/backends/imgdnn/execution.cpp index 1ad01a2..9dfbc5c 100644 --- a/src/backends/imgdnn/execution.cpp +++ b/src/backends/imgdnn/execution.cpp @@ -151,7 +151,7 @@ ResultCode ANeuralNetworksExecution_setOutput( BACKEND_CALL_RET(ret, imgdnnBindingAddOutput, execution->imgdnn_binding_, execution->imgdnn_outputs_[uindex], img_memory); IMGDNN_RETURN_ERR_IF_ERROR(ret); - // Store the memory objects to be able to lock them later + // Store the memory objects to be able to lock and free them later execution->host_output_memories.emplace_back(data, img_memory); } return ANEURALNETWORKS_NO_ERROR;