SIGBUS in gameoverlayrenderer.so, shm use-after-free

steamclosed overlay

ValveSoftware/steam-for-linux#10164 · opened 2023-10-26 by flibitijibibo · updated 2023-12-29 · 3 comments · github

Fflibitijibibo 2023-10-26 github

Migrated from #9461

Apologies for reviving a closed thread, but I managed to reproduce this with a non-Source game with a retail Steam Deck running in desktop mode. It occurs with both OpenGL and Vulkan and seems to occur after a fixed number of frames (so you can actually put arbitrary sleeps between the frames and it still crashes at the same point).

This was the best stack I could get, Valgrind didn't like the game very much (CoreCLR woes):

Thread 1 "CobaltCore" received signal SIGBUS, Bus error.
0x00007f09c20f2752 in ?? () from target:/tmp/pressure-vessel-libs-QLLWC2/x86_64/gameoverlayrenderer.so
(gdb) bt
#0  0x00007f09c20f2752 in ?? () from target:/tmp/pressure-vessel-libs-QLLWC2/x86_64/gameoverlayrenderer.so
#1  0x00007f09c20e4dd5 in ?? () from target:/tmp/pressure-vessel-libs-QLLWC2/x86_64/gameoverlayrenderer.so
#2  0x00007f09c20ee994 in ?? () from target:/tmp/pressure-vessel-libs-QLLWC2/x86_64/gameoverlayrenderer.so
#3  0x00007f09c20ef152 in ?? () from target:/tmp/pressure-vessel-libs-QLLWC2/x86_64/gameoverlayrenderer.so
#4  0x00007f09c20f0a6b in ?? () from target:/tmp/pressure-vessel-libs-QLLWC2/x86_64/gameoverlayrenderer.so
#5  0x00007f09c20e1115 in glXSwapBuffers () from target:/tmp/pressure-vessel-libs-QLLWC2/x86_64/gameoverlayrenderer.so
#6  0x00007ec908e3ffc3 in ?? () from target:/lib/x86_64-linux-gnu/libSDL2-2.0.so.0
#7  0x00007ec8fc218ec8 in OPENGL_SwapBuffers () from target:/run/media/mmcblk0p1/steamapps/common/Cobalt Core/netcoredeps/libFNA3D.so.0
#8  0x0000560d8db0d102 in ?? ()

The most common case is it crashing on the first frame where the overlay would have drawn its first popup; one other behavior I haven't reproduced is the overlay pop-up being solid white, and attempting to start the overlay resulted in an exit, Steam didn't have any logs for it AFAICT.

EDIT: Got the white box crash to happen again, basically the same stack:

Thread 1 "CobaltCore.x86_" received signal SIGBUS, Bus error.
0x00007fd152bfe752 in ?? () from /home/flibitijibibo/.local/share/Steam/ubuntu12_64/gameoverlayrenderer.so
(gdb) bt
#0  0x00007fd152bfe752 in ?? () from /home/flibitijibibo/.local/share/Steam/ubuntu12_64/gameoverlayrenderer.so
#1  0x00007fd152bf0dd5 in ?? () from /home/flibitijibibo/.local/share/Steam/ubuntu12_64/gameoverlayrenderer.so
#2  0x00007fd152bfa994 in ?? () from /home/flibitijibibo/.local/share/Steam/ubuntu12_64/gameoverlayrenderer.so
#3  0x00007fd152bfb152 in ?? () from /home/flibitijibibo/.local/share/Steam/ubuntu12_64/gameoverlayrenderer.so
#4  0x00007fd152bfca6b in ?? () from /home/flibitijibibo/.local/share/Steam/ubuntu12_64/gameoverlayrenderer.so
#5  0x00007fd152bed115 in glXSwapBuffers () from /home/flibitijibibo/.local/share/Steam/ubuntu12_64/gameoverlayrenderer.so
#6  0x00007fce9894a5b3 in X11_GL_SwapWindow () from /home/flibitijibibo/Games/Steam/steamapps/common/Cobalt Core/libSDL2-2.0.so.0
#7  0x00007fce98418ec8 in OPENGL_SwapBuffers () from /home/flibitijibibo/Games/Steam/steamapps/common/Cobalt Core/libFNA3D.so.0

EDIT 2: Dug into the mapped objects and the signal seems to be coming from the overlay trying to access /dev/shm/ValveIPCShim_1000, which according to /proc/$PID/map_files/ no longer exists... so it seems like a breakage in shared memory is to blame here?

_Originally posted by @flibitijibibo in https://github.com/ValveSoftware/steam-for-linux/issues/9461#issuecomment-1751906573_

TTTimo 2023-11-17 github

I couldn't reproduce this problem in CobaltCore (plus it's a Proton title which makes things more difficult to debug), but another (native) title was exhibiting this and I've been able to track it down there.

The fix will be in a future Steam client beta update (we have / are shipping a stable client, this fix will go in the next beta cycle).

TTTimo 2023-11-29 github

Latest Steam beta client update should fix this.

Kkisak-valve maintainer 2023-12-29 github

Closing as fixed in the 2023-11-29 Steam client update.

Upstream links

ValveSoftware/steam-for-linux/issues/9461x1 2023-10