Chrome · Dawn
CVE-2026-76036
OOB in Dawn
Overview
Critical
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
TEST_Psrc/dawn/tests/end2end/QueueTests.cpp |
modified |
Files Changed
src/dawn/native/Texture.cppsrc/dawn/native/Toggles.cppsrc/dawn/native/Toggles.hsrc/dawn/native/vulkan/PhysicalDeviceVk.cppsrc/dawn/tests/end2end/QueueTests.cppwebgpu-cts/expectations.txt
Patch
From 178fb7048ad322e4ff797210358ed05254289e0c Mon Sep 17 00:00:00 2001 From: Kai Ninomiya <[email protected]> Date: Thu, 30 Jul 2026 16:20:14 -0700 Subject: [PATCH] [dawn][vulkan] Disallow NPOT mipmapped depth/stencil textures on ImgTec Can't think of a way to work around this, so just disable it. Fixes: 540087398 Cq-Include-Trybots: luci.chromium.try:android-dawn-arm64-p10-rel Change-Id: I22ce9c18564d338c9ee15e18cfe4598bc34cda95 Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/328455 Reviewed-by: Brandon Jones <[email protected]> Commit-Queue: Kai Ninomiya <[email protected]> --- diff --git a/src/dawn/native/Texture.cpp b/src/dawn/native/Texture.cpp index eb3b0ee..23c6752 100644 --- a/src/dawn/native/Texture.cpp +++ b/src/dawn/native/Texture.cpp @@ -875,6 +875,15 @@ (format->aspects & (Aspect::Depth | Aspect::Stencil)), "The dimension (%s) of a texture with a depth/stencil format (%s) is not 2D.", descriptor->dimension, format->format); + if (device->IsToggleEnabled(Toggle::VulkanDisallowNPOTDepthStencilMipmaps)) { + DAWN_INVALID_IF( + (format->aspects & (Aspect::Depth | Aspect::Stencil)) && + descriptor->mipLevelCount > 1 && + (!IsPowerOfTwo(descriptor->size.width) || !IsPowerOfTwo(descriptor->size.height)), + "Non-power-of-two depth/stencil texture (%s) with mipLevelCount (%u) > 1 is " + "disallowed on this device due to a driver bug.", + descriptor->size, descriptor->mipLevelCount); + } DAWN_TRY(ValidateTextureSize(device, *descriptor, format)); return {}; diff --git a/src/dawn/native/Toggles.cpp b/src/dawn/native/Toggles.cpp index b553e64..9dc2218 100644 --- a/src/dawn/native/Toggles.cpp +++ b/src/dawn/native/Toggles.cpp @@ -819,6 +819,11 @@ {"vulkan_replace_workgroup_atomic_store_with_exchange", "Workaround for a driver bug that implements atomic store incorrectly.", "https://crbug.com/487773864", ToggleStage::Device}}, + {Toggle::VulkanDisallowNPOTDepthStencilMipmaps, + {"vulkan_disallow_npot_depth_stencil_mipmaps", + "Reject NPOT depth/stencil textures with mipLevelCount > 1. Workaround for mip level " + "miscomputation in PowerVR proprietary driver.", + "https://crbug.com/540087398", ToggleStage::Device}}, {Toggle::WaitIsThreadSafe, {"wait_is_thread_safe", "WaitFor* functions are thread-safe and can be called without the device-lock if implicit " diff --git a/src/dawn/native/Toggles.h b/src/dawn/native/Toggles.h index 52115d1..dea360c 100644 --- a/src/dawn/native/Toggles.h +++ b/src/dawn/native/Toggles.h @@ -195,6 +195,7 @@ VulkanSleepAfterLostDeviceWait, UseSpirvReconvergenceMode, VulkanReplaceWorkgroupAtomicStoreWithExchange, + VulkanDisallowNPOTDepthStencilMipmaps, // Once all backends have been updated to be thread safe for waiting, we can remove this toggle. WaitIsThreadSafe, diff --git a/src/dawn/native/vulkan/PhysicalDeviceVk.cpp b/src/dawn/native/vulkan/PhysicalDeviceVk.cpp index caf6fbf..a91b535 100644 --- a/src/dawn/native/vulkan/PhysicalDeviceVk.cpp +++ b/src/dawn/native/vulkan/PhysicalDeviceVk.cpp @@ -1073,8 +1073,12 @@ } if (MayBeImaginationProprietary()) { - // crbug.com/443906252: Polyfill for case switch with large ranges. + // crbug.com/443906252 - Polyfill for case switch with large ranges. deviceToggles->Default(Toggle::VulkanPolyfillSwitchWithIf, true); + + // crbug.com/540087398 - Driver bug miscomputes mip sizes for NPOT depth/stencil textures. + // TODO(https://crbug.com/540087398): Limit this to old drivers once there's a driver fix. + deviceToggles->Default(Toggle::VulkanDisallowNPOTDepthStencilMipmaps, true); } // AMD Mesa front end optimizer bug for unary negation and abs. diff --git a/src/dawn/tests/end2end/QueueTests.cpp b/src/dawn/tests/end2end/QueueTests.cpp index e09c8f8..5c5476a 100644 --- a/src/dawn/tests/end2end/QueueTests.cpp +++ b/src/dawn/tests/end2end/QueueTests.cpp @@ -546,6 +546,9 @@ // Test writing to varying mips TEST_P(QueueWriteTextureTests, TextureWriteToMip) { + // TODO(crbug.com/540087398): NPOT mipmapped depth/stencil textures disallowed due to driver bug + DAWN_SUPPRESS_TEST_IF(IsImgTec()); + constexpr uint32_t kWidth = 259; constexpr uint32_t kHeight = 127; diff --git a/webgpu-cts/expectations.txt b/webgpu-cts/expectations.txt index 11b29ed..36a28cd 100644 --- a/webgpu-cts/expectations.txt +++ b/webgpu-cts/expectations.txt @@ -1879,6 +1879,11 @@ crbug.com/538691038 [ intel mac ] webgpu:shader,validation,functions,alias_analysis:two_pointers_to_struct_members_indirect:address_space="private";member="a";aliased=false [ Failure ] crbug.com/538691038 [ intel mac ] webgpu:shader,validation,functions,alias_analysis:two_pointers_to_struct_members_indirect:address_space="private";member="a";aliased=true [ Failure ] +crbug.com/540087398 [ android-pixel-10 ] webgpu:api,validation,createTexture:mipLevelCount,format:dimension="*";format="depth*" [ Failure ] +crbug.com/540087398 [ android-pixel-10 ] webgpu:api,validation,createTexture:mipLevelCount,format:dimension="*";format="stencil*" [ Failure ] +crbug.com/540087398 [ android-pixel-10 ] webgpu:shader,execution,expression,call,builtin,texture_utils:createTextureWithRandomDataAndGetTexels_with_generator:format="depth*";viewDimension="*" [ Failure ] +crbug.com/540087398 [ android-pixel-10 ] webgpu:shader,execution,expression,call,builtin,texture_utils:createTextureWithRandomDataAndGetTexels_with_generator:format="stencil*";viewDimension="*" [ Failure ] + ################################################################################ # Autogenerated Failure expectations. Please triage. # ##ROLLER_AUTOGENERATED_FAILURES##
Loading diff…
Regression Test / PoC
shipped with the fix
diff --git a/src/dawn/tests/end2end/QueueTests.cpp b/src/dawn/tests/end2end/QueueTests.cpp
index e09c8f8..5c5476a 100644
--- a/src/dawn/tests/end2end/QueueTests.cpp
+++ b/src/dawn/tests/end2end/QueueTests.cpp
@@ -546,6 +546,9 @@
// Test writing to varying mips
TEST_P(QueueWriteTextureTests, TextureWriteToMip) {
+ // TODO(crbug.com/540087398): NPOT mipmapped depth/stencil textures disallowed due to driver bug
+ DAWN_SUPPRESS_TEST_IF(IsImgTec());
+
constexpr uint32_t kWidth = 259;
constexpr uint32_t kHeight = 127;
Loading diff…
Original Bug Report
reported by [email protected]
IMG: Heap OOB write in depth/stencil image layout computation
- Attack surface: WebGPU, reachable from an untrusted web page in the default Chrome for Android configuration.
- Impact: GPU-memory corruption in the unsandboxed Chrome GPU process.
Android internal bug: b/528131119
References
On This Page