Skip to content

sharedgpures: fix dispatch_close decrementing ref_count for handles that never opened a resource#313

Open
avafloww wants to merge 2542 commits intoValveSoftware:bleeding-edgefrom
avafloww:fix/sharedgpures-dispatch-close
Open

sharedgpures: fix dispatch_close decrementing ref_count for handles that never opened a resource#313
avafloww wants to merge 2542 commits intoValveSoftware:bleeding-edgefrom
avafloww:fix/sharedgpures-dispatch-close

Conversation

@avafloww
Copy link
Copy Markdown

@avafloww avafloww commented Feb 20, 2026

When a process opens the \Device\SharedGpuResource device but the subsequent IOCTL_SHARED_GPU_RESOURCE_OPEN fails (e.g. invalid KMT handle), FsContext is never updated from its default value of 0. dispatch_close unconditionally computes &resource_pool[FsContext] and decrements ref_count, which erroneously frees whatever resource happens to be at index 0.

This is particularly damaging when DXVK retries failed OPEN ioctls thousands of times via the D3DKMT DDI path (when
NtGdiDdDDIQueryResourceInfo is stubbed), as each open/close cycle decrements resource_pool[0].ref_count.

Fix by initializing FsContext to (UINT_PTR)-1 as a sentinel in dispatch_create, and skipping cleanup in dispatch_close when the sentinel is still set.


This is one of two PRs needed to make Wine/Proton & Spout2PW work with VNyan under Linux. The other PR is #312.

bylaws and others added 30 commits November 19, 2025 16:04
This was done for all other architectures but missed for arm64ec

(cherry picked from commit 9aa3003)
No WOA devices ship with SVE, so implementing this correctly by
preserving the SVE state in xstate isn't really viable for now so just
hardcode the FEX values.
Since these are unix pointers passed via the PE side.
I confirmed that ARM64EC BT thread creation callbacks aren't called through
some logging in FEX.
The native arch kernel32.dll isn't loaded in WOW64 mode, but threads can still
be created if the SKIP_LOADER_INIT flag is set, provide a default implementation
to support this.
Suspension in JITs cannot easily be handled on the unix side, so allow BT
modules to provide their own suspend helper.

Link: https://gitlab.winehq.org/wine/wine/-/merge_requests/6841
Works around broken variadic exit thunks.
If old_prot points to memory that is write-protected by the JIT, then writes to
it need to be performed on the PE-side to avoid a syscall fault that can't be
handled. Fixes Peggle Deluxe.
rbernon and others added 28 commits January 30, 2026 10:35
Otherwise build_import_name will access OOB when reading the dll name.

CW-Bug-Id: #24534
Fixes matching timezones Asia/Dili, Asia/Jayapura, Etc/GMT-9, Pacific/Palau.

CW-Bug-Id: #26597
Fixes Australia/Lord_Howe timezone match.

CW-Bug-Id: #26597
Prevents crashing in test_h264_decoder_concat_streams() when too many
samples are emitted.

(cherry picked from commit 5ae5529)
(cherry picked from commit 3a15667)
(cherry picked from commit a075e16)
(cherry picked from commit b81fd64)
(cherry picked from commit 9d3b180)
Performance issues can occur when a video output sample has a 2D buffer,
because winegstreamer currently outputs only to a linear buffer, which
must then be copied into the 2D buffer. Worse, a linear lock of the 2D
buffer requires the current contents to be copied to a linear buffer,
even when we intend to overwrite it, because MF linear buffers do not
support write-only locking.

(cherry picked from commit b55b239)

CW-Bug-Id: #25609 #25788 #25560
Support has been added from upstream for writing 2D buffers.

CW-Bug-Id: #25609 #25788 #25560
(cherry picked from commit 964cd76)

CW-Bug-Id: #26633
Followup of 964cd76.

(cherry picked from commit 0093652)

CW-Bug-Id: #26633
…hat never opened a resource

When a process opens the \Device\SharedGpuResource device but the
subsequent IOCTL_SHARED_GPU_RESOURCE_OPEN fails (e.g. invalid KMT
handle), FsContext is never updated from its default value of 0.
dispatch_close unconditionally computes &resource_pool[FsContext] and
decrements ref_count, which erroneously frees whatever resource happens
to be at index 0.

This is particularly damaging when DXVK retries failed OPEN ioctls
thousands of times via the D3DKMT DDI path (when
NtGdiDdDDIQueryResourceInfo is stubbed), as each open/close cycle
decrements resource_pool[0].ref_count.

Fix by initializing FsContext to (UINT_PTR)-1 as a sentinel in
dispatch_create, and skipping cleanup in dispatch_close when the
sentinel is still set.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.