search

Frogging-Family / wine-tkg-git

The wine-tkg build systems, to create custom Wine and Proton builds
893 stars 163 forks source link

Use after free in vulkan child window patchset #1032

Closed kkartaltepe closed 1 year ago

kkartaltepe commented 1 year ago

I'm not sure where this patchset is sourced but I found the recent updated of it here in #1023 so hopefully you can help point me towards where the patchset is maintained.

Its possible for the vkSurface to be freed by destroy_vk_surface prior to the client destroying the surface (such as switching between offscreen/onscreen via wine_vk_surface_set_offscreen.) Then when the client correctly destroys their surfaces during teardown and enters X11DRV_vkDestroySurfaceKHR they pass in the free'ed and possibly reused memory back into the vulkan driver.

This results in a crash in Warcraft 3 1.27 (pre-reforged), where the memory really is reused so the vulkan driver ends up using some random spot in memory as a surface struct and proceeds to implode.

TheComputerGuy96 commented 1 year ago

@kkartaltepe The PR is just a very minimal change to the staging patch to fix a conflict caused by a small wine-staging difference

The current child window patch is based from Remi's WIP child window branch (with some Proton 7.0 picks), so that's why it probably isn't very stable

kkartaltepe commented 1 year ago

The current child window patch is based from Remi's WIP child window branch (with some Proton 7.0 picks), so that's why it probably isn't very stable

Right im just hoping to find a place to send fixes to, or at worst just get this bug known to whoever is maintaining it.

TheComputerGuy96 commented 1 year ago

Right im just hoping to find a place to send fixes to, or at worst just get this bug known to whoever is maintaining it.

@kkartaltepe Remi Bernon is the one who did most of the work on the child window patch, so they're probably the best person to contact (they're in #winehackers channel on Libera Chat as rbernon)

kkartaltepe commented 1 year ago

Thanks a bunch ill follow up in #winehackers. And thanks for updating the patchset here as well making it easy to find :D