High chrome Input Validation 🔧 Commit mapped

Overview

High
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactImproper input validation in Skia
DescriptionImproper input validation in Skia
ComponentSkia
Sub-componentVulkan
Bug ClassInput Validation
Tracker568936430
Fix commitca5696a110e8 (skia) +24/-8
CISA KEVNot listed
CreditedGoogle
Disclosed2026-10-27

Changed Functions

FunctionChangeNotes
if
src/gpu/ganesh/vk/GrVkGpu.cpp
modified
if
src/gpu/graphite/vk/VulkanSharedContext.cpp
modified
if
src/gpu/vk/VulkanUtilsPriv.cpp
modified
ShaderErrorHandler
src/gpu/vk/VulkanUtilsPriv.h
modified
VulkanExtensions
src/gpu/vk/VulkanUtilsPriv.h
modified

Files Changed

  • src/gpu/ganesh/vk/GrVkGpu.cpp
  • src/gpu/vk/VulkanUtilsPriv.h
  • src/gpu/graphite/vk/VulkanSharedContext.cpp
  • src/gpu/vk/VulkanUtilsPriv.cpp
From ca5696a110e894f3a2cc0838b106cdd09eb9a965 Mon Sep 17 00:00:00 2001
From: Nathan Sanchez <[email protected]>
Date: Thu, 15 Oct 2026 11:24:36 -0400
Subject: [PATCH] [Vulkan] Treat VK_ERROR_UNKNOWN as VK_ERROR_DEVICE_LOST

We normally would not expect VK_ERROR_UNKNOWN as this means there is
either a problem with our calls to Vulkan which wasn't caught with
validation layers, or the driver has an implementation issue. Since it
is not normally expected and is unclear what the issue is we will treat
is as a device lost.

Bug: 568936430
Change-Id: I87a145a418fd41a2e6d513ca1a7525556a55c3db
Reviewed-on: https://skia-review.googlesource.com/c/skia/+/1395157
Commit-Queue: Nathan Sanchez <[email protected]>
Reviewed-by: Michael Ludwig <[email protected]>
---
diff --git a/src/gpu/ganesh/vk/GrVkGpu.cpp b/src/gpu/ganesh/vk/GrVkGpu.cpp
index e41868a..0c7e419 100644
--- a/src/gpu/ganesh/vk/GrVkGpu.cpp
+++ b/src/gpu/ganesh/vk/GrVkGpu.cpp
@@ -2658,6 +2658,7 @@
         case VK_SUCCESS:
             return true;
         case VK_ERROR_DEVICE_LOST:
+        case VK_ERROR_UNKNOWN:
             if (!fDeviceIsLost) {
                 // Callback should only be invoked once, and device should be marked as lost first.
                 fDeviceIsLost = true;
@@ -2665,7 +2666,8 @@
                                                 device(),
                                                 fDeviceLostContext,
                                                 fDeviceLostProc,
-                                                vkCaps().supportsDeviceFaultInfo());
+                                                vkCaps().supportsDeviceFaultInfo(),
+                                                /*isUnknownError=*/result == VK_ERROR_UNKNOWN);
             }
             return false;
         case VK_ERROR_OUT_OF_DEVICE_MEMORY:
diff --git a/src/gpu/graphite/vk/VulkanSharedContext.cpp b/src/gpu/graphite/vk/VulkanSharedContext.cpp
index 238279a..be99465 100644
--- a/src/gpu/graphite/vk/VulkanSharedContext.cpp
+++ b/src/gpu/graphite/vk/VulkanSharedContext.cpp
@@ -270,6 +270,7 @@
     case VK_SUCCESS:
         return true;
     case VK_ERROR_DEVICE_LOST:
+    case VK_ERROR_UNKNOWN:
         {
             SkAutoMutexExclusive lock(fDeviceIsLostMutex);
             if (fDeviceIsLost) {
@@ -284,7 +285,8 @@
                                         device(),
                                         fDeviceLostContext,
                                         fDeviceLostProc,
-                                        vulkanCaps().supportsDeviceFaultInfo());
+                                        vulkanCaps().supportsDeviceFaultInfo(),
+                                        /*isUnknownError=*/result == VK_ERROR_UNKNOWN);
         return false;
     case VK_ERROR_OUT_OF_DEVICE_MEMORY:
     case VK_ERROR_OUT_OF_HOST_MEMORY:
diff --git a/src/gpu/vk/VulkanUtilsPriv.cpp b/src/gpu/vk/VulkanUtilsPriv.cpp
index 0c17025..943f615 100644
--- a/src/gpu/vk/VulkanUtilsPriv.cpp
+++ b/src/gpu/vk/VulkanUtilsPriv.cpp
@@ -232,7 +232,8 @@
                               VkDevice vkDevice,
                               skgpu::VulkanDeviceLostContext deviceLostContext,
                               skgpu::VulkanDeviceLostProc deviceLostProc,
-                              bool supportsDeviceFaultInfoExtension) {
+                              bool supportsDeviceFaultInfoExtension,
+                              bool isUnknownError) {
     if (!deviceLostProc) {
         return;
     }
@@ -241,6 +242,15 @@
     std::vector<VkDeviceFaultVendorInfoEXT> vendorInfos = {};
     std::vector<std::byte> vendorBinaryData = {};
 
+    if (isUnknownError) {
+        deviceLostProc(deviceLostContext,
+                       "No details: A VK_UNKNOWN_ERROR has occured.",
+                       addressInfos,
+                       vendorInfos,
+                       vendorBinaryData);
+        return;
+    }
+
     if (!supportsDeviceFaultInfoExtension) {
         deviceLostProc(deviceLostContext,
                        "No details: VK_EXT_device_fault not available/enabled.",
diff --git a/src/gpu/vk/VulkanUtilsPriv.h b/src/gpu/vk/VulkanUtilsPriv.h
index c9cadcd..9865b0d 100644
--- a/src/gpu/vk/VulkanUtilsPriv.h
+++ b/src/gpu/vk/VulkanUtilsPriv.h
@@ -39,9 +39,9 @@
 namespace skgpu {
 
 class ShaderErrorHandler;
-struct VulkanInterface;
-struct VulkanBackendContext;
 class VulkanExtensions;
+struct VulkanBackendContext;
+struct VulkanInterface;
 
 enum VkVendor {
     kAMD_VkVendor = 0x1002,
@@ -362,15 +362,17 @@
 #endif // SK_BUILD_FOR_ANDROID
 
 /**
- * Calls faultProc with faultContext; passes debug info if VK_EXT_device_fault is supported/enabled.
+ * Calls faultProc with faultContext; passes debug info if VK_EXT_device_fault is supported/enabled
+ * and the error is VK_ERROR_DEVICE_LOST.
  *
- * Note: must only be called *after* receiving VK_ERROR_DEVICE_LOST.
+ * Note: must only be called *after* receiving VK_ERROR_DEVICE_LOST or VK_ERROR_UNKNOWN.
  */
 void InvokeDeviceLostCallback(const skgpu::VulkanInterface* vulkanInterface,
                               VkDevice vkDevice,
                               skgpu::VulkanDeviceLostContext faultContext,
                               skgpu::VulkanDeviceLostProc faultProc,
-                              bool supportsDeviceFaultInfoExtension);
+                              bool supportsDeviceFaultInfoExtension,
+                              bool isUnknownError);
 
 sk_sp<skgpu::VulkanInterface> MakeInterface(const skgpu::VulkanBackendContext&,
                                             const skgpu::VulkanExtensions* extOverride,
Loading diff…

Original Bug Report

The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.