FEX-Emu / FEX-Emu/FEX

Wine leaks non-canonical pointers to x86-64 processes

Open
#5,946 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
C++
Stars
8k
Forks
351
Avg merge
12h 31m
Merged PRs (30d)
102

Description

At the very least GPU pointers get leaked that are non-canonical to x86-64 to the guest application. Noticed this while running `Touhou Koumakyou: New Classic - the Embodiment of Scarlet Devil` but it can theoretically happen with any x86-64 game.

Wine doesn't reserve the upper 128TB of VA space, so it'll just end up leaking pointers. We had to fix this on the Linux side otherwise golang applications would break since they do canonical pointer checks (although they can also break on 57-bit VA systems).

FEX could probably partially resolve this by reserving memory in that space just like on the Linux side, but it would be better if WINE itself solved this. With the unixlib it wouldn't be hard to late reserve the region but they could potentially still leak things if they allocated arenas early?

We should have a debug-only option to do canonical pointer checks on memory accesses. Would be incredibly slow, but would let us find more leaks.

Contributor guide

Open the contributing guide

Research direction

The issue names no files or tests. Start by tracing FEX's Wine/unixlib memory-reservation path and comparing it with the Linux-side reservation described; then identify how debug-only canonical pointer checks could cover memory accesses. Done means preventing non-canonical pointers from reaching x86-64 guests and validating the behavior with the reported game or another reproducer.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp, linux
Domain
operating-systems
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Active
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.