alvr-org / alvr-org/ALVR

Bug: Steam/SteamVR crashes on exit due to async IPC buffer corruption (Assert in steamclient.cpp:857) during driver teardown

未关闭
#3,322 6 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
stale
主要语言
Rust
星标
7.9k
派生
708
平均合并
3 天 23 小时
30 天内合并 PR
11

描述

## Description
When exiting SteamVR while using the ALVR driver, the Steam client and `vrserver.exe` consistently crash. After the crash, subsequent SteamVR launches trigger "Safe Mode" due to corrupted state configurations.

Additionally, third-party overlays like **Desktop+** completely fail to initialize their UI within SteamVR while ALVR is active, pointing to broader OpenVR IPC pipeline pollution.

#### Root Cause Analysis (WinDbg Dump Output)
Analysis of the `assert_vrserver.exe` dump file via `!analyze -v` isolates the exact failure point inside Steam's core client serialization logic during the driver unloading sequence:

```text
COMMENT: Assert( bufRet.TellPut() == sizeof(uint8) ):C:\buildworker\steam_rel_client_hotfix_win64\build\src\clientdll\steamclient.cpp:857

EXCEPTION_RECORD: (.exr -1)
ExceptionAddress: 0000000000000000
ExceptionCode: 80000003 (Break instruction exception)

PROCESS_NAME: vrserver.exe
FAILURE_BUCKET_ID: BREAKPOINT_80000003_vrserver.exe!Unknown

STACK_TEXT:
ntdll!NtWaitForSingleObject+0x14
KERNELBASE!WaitForSingleObjectEx+0xae
vrserver+0x26f87a
```

#### What Is Happening Under the Hood:
1. When SteamVR initiates a shutdown, `vrserver.exe` begins tearing down the pipeline and expects a clean, single-byte acknowledgment payload (`sizeof(uint8)`) from the driver IPC channel.
2. Because ALVR runs on multi-threaded Rust (with asynchronous networking/ADB/logging routines), a runaway background thread attempts to poll, write, or log to the IPC pipe *after* or *during* the parent context destruction.
3. This late-writing pollutes the expected return buffer, causing `bufRet.TellPut() == sizeof(uint8)` to evaluate to `false`.
4. SteamVR detects this serialization mismatch as potential memory corruption and intentionally triggers a defensive fail-fast crash via `BREAKPOINT (0x80000003)`, completely killing `vrserver.exe`, which instantly terminates `steam.exe` and `vrdashboard.exe` as a cascading failure.
5. This structural IPC pollution also prevents Desktop+ from attaching to its respective OpenVR overlay pipe, explaining why its UI never renders.
6. Port `26062` remains blocked by a ghost socket after the crash until a full system reboot, confirming unclosed network resources.

#### Suggested Solution
The issue lies in the ALVR driver's `Shutdown()` routine or the `Drop` implementation for the OpenVR driver struct. Before returning control to OpenVR during teardown, the driver must guarantee complete execution silence:
1. Fire a `CancellationToken` or flip an atomic shutdown flag across all active `tokio` tasks and network loops (especially UDP listeners and ADB forwarders).
2. Explicitly wait for background worker threads to finish via `.join()` or ensure the asynchronous runtime executes `.shutdown_background()`.
3. Ensure no logging macros or network hooks attempt to write to shared descriptors before the DLL is unmapped from the Steam process.

## General Troubleshooting
- [x] I carefully followed the instructions in the [README](https://github.com/alvr-org/ALVR/blob/master/README.md) and successfully completed the setup wizard
- [x] I read the [ALVR GitHub Wiki](https://github.com/alvr-org/ALVR/wiki)

## Environment

### Hardware
**Note**: for Linux, an upload to the [`hw-probe`](https://linux-hardware.org/) database is preferred: `hw-probe -all -upload`

**CPU**: Intel(R) Core(TM) i7-10870H CPU @ 2.20GHz

**GPU**: Dell G15 Hybrid Setup (Intel Iris Xe Graphics + Nvidia GeForce RTX 3060 Laptop GPU

**GPU Driver Version**: GeForce Game Ready 610.62

**Audio**: Realtek Audio

### Installation
**ALVR Version**: v20.14.1

**ALVR Settings File**: Defaults (issue persists regardless of codec, bitrate, or HAGS state)

**SteamVR Version**: 1781734990

**Install Type**:
- [x] Packaged (`exe`, `deb`, `rpm`, etc)
- [ ] Portable (`zip`)
- [ ] Source

**OS Name and Version** (`winver` on Windows or `grep PRETTY_NAME /etc/os-release` on most Linux distributions): Windows 11 Pro 26H1 (OS Build 28000.1)

贡献指南

打开贡献指南

评估

这个 Issue 还没有评估数据。

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。