[PR #493] fix(hardware): own DRM descriptors by value #495

New issue

Open

opened 2026-10-15 13:01:00 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 13:01:00 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/games-on-whales/wolf/pull/493
Author: @elibosley
Created: 8/29/2026
Status: 🔄 Open

Base: beta ← Head: fix/drm-device-descriptor-ownership

📝 Commits (1)

b565cff fix(hardware): own DRM descriptors by value

📊 Changes

4 files changed (+123 additions, -2 deletions)

View changed files

📝 .github/workflows/linux-build-test.yml (+7 -1)
📝 src/moonlight-server/platforms/hw_linux.cpp (+5 -1)
📝 tests/CMakeLists.txt (+13 -0)
➕ tests/testDrmDevice.cpp (+98 -0)

📄 Description

Summary

Wolf can close an unrelated file descriptor because a DRM device deleter captures a stack variable by reference; this owns the descriptor by value and tests its full lifetime under AddressSanitizer.

Why This Exists

drm_open_device returns a shared owner whose deleter can outlive the function call. Capturing the local descriptor variable by reference leaves that deleter with dangling stack storage. A later cleanup can therefore close whichever descriptor value happens to occupy that memory. Failed open and drmGetDevice2 paths also need deterministic descriptor cleanup.

Resolution

Capture the acquired descriptor by value, reject failed opens before calling libdrm, and close the descriptor when device lookup fails. A Linux-only test executable replaces only the libdrm boundary while exercising real POSIX descriptors and the production owner.

Reviewer Considerations

The test is separate from wolftests so fake libdrm symbols do not enter the hardware-capable test process.
AddressSanitizer's stack-use-after-return mode protects the original dangling-reference failure mode.
The test covers shared ownership, failed lookup, failed open, descriptor zero, and an unrelated descriptor.

Behavior Changes

DRM discovery now fails immediately when a render node cannot be opened and always releases descriptors on lookup failure or final owner destruction.

Implementation Summary

Validate open before calling drmGetDevice2.
Capture the render-node descriptor by value in the shared deleter.
Add the focused Linux/ASAN regression target to the existing CI matrix.

Verification

The production owner test passed under AddressSanitizer in the Linux/amd64 Wolf image build.
The complete Wolf image regression suite passed with this change applied.
Changed C++ sources pass clang-format --dry-run --Werror with clang-format 21.1.8.
GitHub's fork workflows are awaiting maintainer approval; they have not reported a test failure.

Risk

Low; the runtime change is confined to descriptor ownership and error cleanup, with the former behavior covered directly by the new test.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/games-on-whales/wolf/pull/493 **Author:** [@elibosley](https://github.com/elibosley) **Created:** 8/29/2026 **Status:** 🔄 Open **Base:** `beta` ← **Head:** `fix/drm-device-descriptor-ownership` --- ### 📝 Commits (1) - [`b565cff`](https://github.com/games-on-whales/wolf/commit/b565cff831c96a7797845f5e73c5c92d74c51544) fix(hardware): own DRM descriptors by value ### 📊 Changes **4 files changed** (+123 additions, -2 deletions) <details> <summary>View changed files</summary> 📝 `.github/workflows/linux-build-test.yml` (+7 -1) 📝 `src/moonlight-server/platforms/hw_linux.cpp` (+5 -1) 📝 `tests/CMakeLists.txt` (+13 -0) ➕ `tests/testDrmDevice.cpp` (+98 -0) </details> ### 📄 Description ## Summary Wolf can close an unrelated file descriptor because a DRM device deleter captures a stack variable by reference; this owns the descriptor by value and tests its full lifetime under AddressSanitizer. ## Why This Exists `drm_open_device` returns a shared owner whose deleter can outlive the function call. Capturing the local descriptor variable by reference leaves that deleter with dangling stack storage. A later cleanup can therefore close whichever descriptor value happens to occupy that memory. Failed `open` and `drmGetDevice2` paths also need deterministic descriptor cleanup. ## Resolution Capture the acquired descriptor by value, reject failed opens before calling libdrm, and close the descriptor when device lookup fails. A Linux-only test executable replaces only the libdrm boundary while exercising real POSIX descriptors and the production owner. ## Reviewer Considerations - The test is separate from `wolftests` so fake libdrm symbols do not enter the hardware-capable test process. - AddressSanitizer's stack-use-after-return mode protects the original dangling-reference failure mode. - The test covers shared ownership, failed lookup, failed open, descriptor zero, and an unrelated descriptor. ## Behavior Changes DRM discovery now fails immediately when a render node cannot be opened and always releases descriptors on lookup failure or final owner destruction. ## Implementation Summary - Validate `open` before calling `drmGetDevice2`. - Capture the render-node descriptor by value in the shared deleter. - Add the focused Linux/ASAN regression target to the existing CI matrix. ## Verification - The production owner test passed under AddressSanitizer in the Linux/amd64 Wolf image build. - The complete Wolf image regression suite passed with this change applied. - Changed C++ sources pass `clang-format --dry-run --Werror` with clang-format 21.1.8. - GitHub's fork workflows are awaiting maintainer approval; they have not reported a test failure. ## Risk Low; the runtime change is confined to descriptor ownership and error cleanup, with the former behavior covered directly by the new test. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi added the

pull-request

label

2026-10-15 13:01:00 +00:00

bsakaguchi referenced this issue

2026-10-15 13:01:00 +00:00

[PR #495] feat(gstreamer): patch nvh265enc to add intra-refresh support. Also updates gstreamer to 1.28.6 from August 5. #496