Validate that resources belong to the right device.

CHANGELOG.md

@@ -111,6 +111,7 @@ By @teoxoy in [#4185](https://github.com/gfx-rs/wgpu/pull/4185)
 - Add stub support for device destroy and device validity. By @bradwerth in [4163](https://github.com/gfx-rs/wgpu/pull/4163)
 - Add trace-level logging for most entry points in wgpu-core By @nical in [4183](https://github.com/gfx-rs/wgpu/pull/4183)
 - Add `Rgb10a2Uint` format. By @teoxoy in [4199](https://github.com/gfx-rs/wgpu/pull/4199)
+- Validate that resources are used on the right device. By @nical in [4207](https://github.com/gfx-rs/wgpu/pull/4207)
 
 #### Vulkan
 

deno_webgpu/error.rs

@@ -104,9 +104,9 @@ impl From<DeviceError> for WebGpuError {
  match err {
  DeviceError::Lost => WebGpuError::Lost,
  DeviceError::OutOfMemory => WebGpuError::OutOfMemory,
- DeviceError::ResourceCreationFailed | DeviceError::Invalid => {
-  WebGpuError::Validation(fmt_err(&err))
- }
+ DeviceError::ResourceCreationFailed
+ | DeviceError::Invalid
+ | DeviceError::WrongDevice => WebGpuError::Validation(fmt_err(&err)),
  }
  }
 }

tests/tests/device.rs

@@ -11,7 +11,6 @@ fn device_initialization() {
 }
 
 #[test]
-#[ignore]
 fn device_mismatch() {
  initialize_test(
  // https://github.com/gfx-rs/wgpu/issues/3927

wgpu-core/src/command/render.rs

@@ -10,15 +10,14 @@ use crate::{
  RenderCommand, RenderCommandError, StateChange,
  },
  device::{
- AttachmentData, Device, MissingDownlevelFlags, MissingFeatures,
+ AttachmentData, Device, DeviceError, MissingDownlevelFlags, MissingFeatures,
  RenderPassCompatibilityCheckType, RenderPassCompatibilityError, RenderPassContext,
  },
  error::{ErrorFormatter, PrettyError},
  global::Global,
  hal_api::HalApi,
  hub::Token,
  id,
- id::DeviceId,
  identity::GlobalIdentityHandlerFactory,
  init_tracker::{MemoryInitKind, TextureInitRange, TextureInitTrackerAction},
  pipeline::{self, PipelineFlags},
@@ -520,12 +519,12 @@ pub enum ColorAttachmentError {
 /// Error encountered when performing a render pass.
 #[derive(Clone, Debug, Error)]
 pub enum RenderPassErrorInner {
+ #[error(transparent)]
+ Device(DeviceError),
  #[error(transparent)]
  ColorAttachment(#[from] ColorAttachmentError),
  #[error(transparent)]
  Encoder(#[from] CommandEncoderError),
- #[error("Device {0:?} is invalid")]
- InvalidDevice(DeviceId),
  #[error("Attachment texture view {0:?} is invalid")]
  InvalidAttachment(id::TextureViewId),
  #[error("The format of the depth-stencil attachment ({0:?}) is not a depth-stencil format")]
@@ -658,6 +657,12 @@ impl From<MissingTextureUsageError> for RenderPassErrorInner {
  }
 }
 
+impl From<DeviceError> for RenderPassErrorInner {
+ fn from(error: DeviceError) -> Self {
+ Self::Device(error)
+ }
+}
+
 /// Error encountered when performing a render pass.
 #[derive(Clone, Debug, Error)]
 #[error("{scope}")]
@@ -1351,12 +1356,11 @@ impl<G: GlobalIdentityHandlerFactory> Global<G> {
  });
  }
 
- let device = &device_guard[cmd_buf.device_id.value];
+ let device_id = cmd_buf.device_id.value;
+
+ let device = &device_guard[device_id];
  if !device.is_valid() {
- return Err(RenderPassErrorInner::InvalidDevice(
- cmd_buf.device_id.value.0,
- ))
- .map_pass_err(init_scope);
+ return Err(DeviceError::Invalid).map_pass_err(init_scope);
  }
  cmd_buf.encoder.open_pass(base.label);
 
@@ -1451,6 +1455,11 @@ impl<G: GlobalIdentityHandlerFactory> Global<G> {
  .add_single(&*bind_group_guard, bind_group_id)
  .ok_or(RenderCommandError::InvalidBindGroup(bind_group_id))
  .map_pass_err(scope)?;
+
+ if bind_group.device_id.value != device_id {
+ return Err(DeviceError::WrongDevice).map_pass_err(scope);
+ }
+
  bind_group
  .validate_dynamic_bindings(index, &temp_offsets, &cmd_buf.limits)
  .map_pass_err(scope)?;
@@ -1518,6 +1527,10 @@ impl<G: GlobalIdentityHandlerFactory> Global<G> {
  .ok_or(RenderCommandError::InvalidPipeline(pipeline_id))
  .map_pass_err(scope)?;
 
+ if pipeline.device_id.value != device_id {
+ return Err(DeviceError::WrongDevice).map_pass_err(scope);
+ }
+
  info.context
  .check_compatible(
  &pipeline.pass_context,
@@ -1635,6 +1648,11 @@ impl<G: GlobalIdentityHandlerFactory> Global<G> {
  .buffers
  .merge_single(&*buffer_guard, buffer_id, hal::BufferUses::INDEX)
  .map_pass_err(scope)?;
+
+ if buffer.device_id.value != device_id {
+ return Err(DeviceError::WrongDevice).map_pass_err(scope);
+ }
+
  check_buffer_usage(buffer.usage, BufferUsages::INDEX)
  .map_pass_err(scope)?;
  let buf_raw = buffer
@@ -1683,6 +1701,11 @@ impl<G: GlobalIdentityHandlerFactory> Global<G> {
  .buffers
  .merge_single(&*buffer_guard, buffer_id, hal::BufferUses::VERTEX)
  .map_pass_err(scope)?;
+
+ if buffer.device_id.value != device_id {
+ return Err(DeviceError::WrongDevice).map_pass_err(scope);
+ }
+
  check_buffer_usage(buffer.usage, BufferUsages::VERTEX)
  .map_pass_err(scope)?;
  let buf_raw = buffer
@@ -2265,6 +2288,10 @@ impl<G: GlobalIdentityHandlerFactory> Global<G> {
  .ok_or(RenderCommandError::InvalidRenderBundle(bundle_id))
  .map_pass_err(scope)?;
 
+ if bundle.device_id.value != device_id {
+ return Err(DeviceError::WrongDevice).map_pass_err(scope);
+ }
+
  info.context
  .check_compatible(
  &bundle.context,

wgpu-core/src/device/global.rs

@@ -1326,6 +1326,10 @@ impl<G: GlobalIdentityHandlerFactory> Global<G> {
  Err(..) => break binding_model::CreateBindGroupError::InvalidLayout,
  };
 
+ if bind_group_layout.device_id.value.0 != device_id {
+ break DeviceError::WrongDevice.into();
+ }
+
  let mut layout_id = id::Valid(desc.layout);
  if let Some(id) = bind_group_layout.as_duplicate() {
  layout_id = id;

wgpu-core/src/device/mod.rs

@@ -300,6 +300,8 @@ pub enum DeviceError {
  OutOfMemory,
  #[error("Creation of a resource failed for a reason other than running out of memory.")]
  ResourceCreationFailed,
+ #[error("Attempt to use a resource with a different device from the one that created it")]
+ WrongDevice,
 }
 
 impl From<hal::DeviceError> for DeviceError {

wgpu-core/src/device/queue.rs

@@ -397,6 +397,7 @@ impl<G: GlobalIdentityHandlerFactory> Global<G> {
  }
 
  let result = self.queue_write_staging_buffer_impl(
+ queue_id,
  device,
  device_token,
  &staging_buffer,
@@ -464,6 +465,7 @@ impl<G: GlobalIdentityHandlerFactory> Global<G> {
  }
 
  let result = self.queue_write_staging_buffer_impl(
+ queue_id,
  device,
  device_token,
  &staging_buffer,
@@ -531,6 +533,7 @@ impl<G: GlobalIdentityHandlerFactory> Global<G> {
 
  fn queue_write_staging_buffer_impl<A: HalApi>(
  &self,
+ device_id: id::DeviceId,
  device: &mut super::Device<A>,
  device_token: &mut Token<super::Device<A>>,
  staging_buffer: &StagingBuffer<A>,
@@ -551,6 +554,10 @@ impl<G: GlobalIdentityHandlerFactory> Global<G> {
  .as_ref()
  .ok_or(TransferError::InvalidBuffer(buffer_id))?;
 
+ if dst.device_id.value.0 != device_id {
+ return Err(DeviceError::WrongDevice.into());
+ }
+
  let src_buffer_size = staging_buffer.size;
  self.queue_validate_write_buffer_impl(dst, buffer_id, buffer_offset, src_buffer_size)?;
 
@@ -627,6 +634,10 @@ impl<G: GlobalIdentityHandlerFactory> Global<G> {
  .get_mut(destination.texture)
  .map_err(|_| TransferError::InvalidTexture(destination.texture))?;
 
+ if dst.device_id.value.0 != queue_id {
+ return Err(DeviceError::WrongDevice.into());
+ }
+
  if !dst.desc.usage.contains(wgt::TextureUsages::COPY_DST) {
  return Err(
  TransferError::MissingCopyDstUsageFlag(None, Some(destination.texture)).into(),
@@ -1105,6 +1116,11 @@ impl<G: GlobalIdentityHandlerFactory> Global<G> {
  Some(cmdbuf) => cmdbuf,
  None => continue,
  };
+
+ if cmdbuf.device_id.value.0 != queue_id {
+ return Err(DeviceError::WrongDevice.into());
+ }
+
  #[cfg(feature = "trace")]
  if let Some(ref trace) = device.trace {
  trace.lock().add(Action::Submit(

wgpu-core/src/device/resource.rs

@@ -1670,6 +1670,7 @@ impl<A: HalApi> Device<A> {
  }
 
  fn create_buffer_binding<'a>(
+ device_id: id::DeviceId,
  bb: &binding_model::BufferBinding,
  binding: u32,
  decl: &wgt::BindGroupLayoutEntry,
@@ -1727,6 +1728,11 @@ impl<A: HalApi> Device<A> {
  .buffers
  .add_single(storage, bb.buffer_id, internal_use)
  .ok_or(Error::InvalidBuffer(bb.buffer_id))?;
+
+ if buffer.device_id.value.0 != device_id {
+ return Err(DeviceError::WrongDevice.into());
+ }
+
  check_buffer_usage(buffer.usage, pub_usage)?;
  let raw_buffer = buffer
  .raw
@@ -1797,6 +1803,7 @@ impl<A: HalApi> Device<A> {
  }
 
  fn create_texture_binding(
+ device_id: id::DeviceId,
  view: &resource::TextureView<A>,
  texture_guard: &Storage<resource::Texture<A>, id::TextureId>,
  internal_use: hal::TextureUses,
@@ -1818,6 +1825,11 @@ impl<A: HalApi> Device<A> {
  .ok_or(binding_model::CreateBindGroupError::InvalidTexture(
  view.parent_id.value.0,
  ))?;
+
+ if texture.device_id.value.0 != device_id {
+ return Err(DeviceError::WrongDevice.into());
+ }
+
  check_texture_usage(texture.desc.usage, pub_usage)?;
 
  used_texture_ranges.push(TextureInitTrackerAction {
@@ -1889,6 +1901,7 @@ impl<A: HalApi> Device<A> {
  let (res_index, count) = match entry.resource {
  Br::Buffer(ref bb) => {
  let bb = Self::create_buffer_binding(
+ self_id,
  bb,
  binding,
  decl,
@@ -1911,6 +1924,7 @@ impl<A: HalApi> Device<A> {
  let res_index = hal_buffers.len();
  for bb in bindings_array.iter() {
  let bb = Self::create_buffer_binding(
+ self_id,
  bb,
  binding,
  decl,
@@ -1933,6 +1947,10 @@ impl<A: HalApi> Device<A> {
  .add_single(&*sampler_guard, id)
  .ok_or(Error::InvalidSampler(id))?;
 
+ if sampler.device_id.value.0 != self_id {
+ return Err(DeviceError::WrongDevice.into());
+ }
+
  // Allowed sampler values for filtering and comparison
  let (allowed_filtering, allowed_comparison) = match ty {
  wgt::SamplerBindingType::Filtering => (None, false),
@@ -1981,6 +1999,11 @@ impl<A: HalApi> Device<A> {
  .samplers
  .add_single(&*sampler_guard, id)
  .ok_or(Error::InvalidSampler(id))?;
+
+ if sampler.device_id.value.0 != self_id {
+ return Err(DeviceError::WrongDevice.into());
+ }
+
  hal_samplers.push(&sampler.raw);
  }
 
@@ -1998,6 +2021,7 @@ impl<A: HalApi> Device<A> {
  "SampledTexture, ReadonlyStorageTexture or WriteonlyStorageTexture",
  )?;
  Self::create_texture_binding(
+ self_id,
  view,
  &texture_guard,
  internal_use,
@@ -2026,6 +2050,7 @@ impl<A: HalApi> Device<A> {
  Self::texture_use_parameters(binding, decl, view,
  "SampledTextureArray, ReadonlyStorageTextureArray or WriteonlyStorageTextureArray")?;
  Self::create_texture_binding(
+ self_id,
  view,
  &texture_guard,
  internal_use,
@@ -2324,6 +2349,11 @@ impl<A: HalApi> Device<A> {
  let Some(bind_group_layout) = try_get_bind_group_layout(bgl_guard, id) else {
  return Err(Error::InvalidBindGroupLayout(id));
  };
+
+ if bind_group_layout.device_id.value.0 != self_id {
+ return Err(DeviceError::WrongDevice.into());
+ }
+
  count_validator.merge(&bind_group_layout.assume_deduplicated().count_validator);
  }
  count_validator
@@ -2457,6 +2487,10 @@ impl<A: HalApi> Device<A> {
  .get(desc.stage.module)
  .map_err(|_| validation::StageError::InvalidModule)?;
 
+ if shader_module.device_id.value.0 != self_id {
+ return Err(DeviceError::WrongDevice.into());
+ }
+
  {
  let flag = wgt::ShaderStages::COMPUTE;
  let provided_layouts = match desc.layout {
@@ -2500,6 +2534,10 @@ impl<A: HalApi> Device<A> {
  .get(pipeline_layout_id)
  .map_err(|_| pipeline::CreateComputePipelineError::InvalidLayout)?;
 
+ if layout.device_id.value.0 != self_id {
+ return Err(DeviceError::WrongDevice.into());
+ }
+
  let late_sized_buffer_groups =
  Device::make_late_sized_buffer_groups(&shader_binding_sizes, layout, &*bgl_guard);
 
@@ -2843,11 +2881,20 @@ impl<A: HalApi> Device<A> {
  }
  })?;
 
+ if shader_module.device_id.value.0 != self_id {
+ return Err(DeviceError::WrongDevice.into());
+ }
+
  let provided_layouts = match desc.layout {
  Some(pipeline_layout_id) => {
  let pipeline_layout = pipeline_layout_guard
  .get(pipeline_layout_id)
  .map_err(|_| pipeline::CreateRenderPipelineError::InvalidLayout)?;
+
+ if pipeline_layout.device_id.value.0 != self_id {
+ return Err(DeviceError::WrongDevice.into());
+ }
+
  Some(Device::get_introspection_bind_group_layouts(
  pipeline_layout,
  &*bgl_guard,