Overview

Critical
Severity
CVSS
No
Exploited ITW
Fixed
Fix Status
ImpactBuffer overflow in Dawn
DescriptionBuffer overflow in Dawn
ComponentDawn
Bug ClassOOB
Tracker540087398
Fix commit178fb7048ad3 (dawn) +28/-1
CISA KEVNot listed
CreditedGoogle
Disclosed2026-08-18

Changed Functions

FunctionChangeNotes
TEST_P
src/dawn/tests/end2end/QueueTests.cpp
modified

Files Changed

  • src/dawn/native/Texture.cpp
  • src/dawn/native/Toggles.cpp
  • src/dawn/native/Toggles.h
  • src/dawn/native/vulkan/PhysicalDeviceVk.cpp
  • src/dawn/tests/end2end/QueueTests.cpp
  • webgpu-cts/expectations.txt
From 178fb7048ad322e4ff797210358ed05254289e0c Mon Sep 17 00:00:00 2001
From: Kai Ninomiya <[email protected]>
Date: Thu, 30 Jul 2026 16:20:14 -0700
Subject: [PATCH] [dawn][vulkan] Disallow NPOT mipmapped depth/stencil textures on ImgTec

Can't think of a way to work around this, so just disable it.

Fixes: 540087398
Cq-Include-Trybots: luci.chromium.try:android-dawn-arm64-p10-rel
Change-Id: I22ce9c18564d338c9ee15e18cfe4598bc34cda95
Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/328455
Reviewed-by: Brandon Jones <[email protected]>
Commit-Queue: Kai Ninomiya <[email protected]>
---

diff --git a/src/dawn/native/Texture.cpp b/src/dawn/native/Texture.cpp
index eb3b0ee..23c6752 100644
--- a/src/dawn/native/Texture.cpp
+++ b/src/dawn/native/Texture.cpp
@@ -875,6 +875,15 @@
                         (format->aspects & (Aspect::Depth | Aspect::Stencil)),
                     "The dimension (%s) of a texture with a depth/stencil format (%s) is not 2D.",
                     descriptor->dimension, format->format);
+    if (device->IsToggleEnabled(Toggle::VulkanDisallowNPOTDepthStencilMipmaps)) {
+        DAWN_INVALID_IF(
+            (format->aspects & (Aspect::Depth | Aspect::Stencil)) &&
+                descriptor->mipLevelCount > 1 &&
+                (!IsPowerOfTwo(descriptor->size.width) || !IsPowerOfTwo(descriptor->size.height)),
+            "Non-power-of-two depth/stencil texture (%s) with mipLevelCount (%u) > 1 is "
+            "disallowed on this device due to a driver bug.",
+            descriptor->size, descriptor->mipLevelCount);
+    }
 
     DAWN_TRY(ValidateTextureSize(device, *descriptor, format));
     return {};
diff --git a/src/dawn/native/Toggles.cpp b/src/dawn/native/Toggles.cpp
index b553e64..9dc2218 100644
--- a/src/dawn/native/Toggles.cpp
+++ b/src/dawn/native/Toggles.cpp
@@ -819,6 +819,11 @@
      {"vulkan_replace_workgroup_atomic_store_with_exchange",
       "Workaround for a driver bug that implements atomic store incorrectly.",
       "https://crbug.com/487773864", ToggleStage::Device}},
+    {Toggle::VulkanDisallowNPOTDepthStencilMipmaps,
+     {"vulkan_disallow_npot_depth_stencil_mipmaps",
+      "Reject NPOT depth/stencil textures with mipLevelCount > 1. Workaround for mip level "
+      "miscomputation in PowerVR proprietary driver.",
+      "https://crbug.com/540087398", ToggleStage::Device}},
     {Toggle::WaitIsThreadSafe,
      {"wait_is_thread_safe",
       "WaitFor* functions are thread-safe and can be called without the device-lock if implicit "
diff --git a/src/dawn/native/Toggles.h b/src/dawn/native/Toggles.h
index 52115d1..dea360c 100644
--- a/src/dawn/native/Toggles.h
+++ b/src/dawn/native/Toggles.h
@@ -195,6 +195,7 @@
     VulkanSleepAfterLostDeviceWait,
     UseSpirvReconvergenceMode,
     VulkanReplaceWorkgroupAtomicStoreWithExchange,
+    VulkanDisallowNPOTDepthStencilMipmaps,
 
     // Once all backends have been updated to be thread safe for waiting, we can remove this toggle.
     WaitIsThreadSafe,
diff --git a/src/dawn/native/vulkan/PhysicalDeviceVk.cpp b/src/dawn/native/vulkan/PhysicalDeviceVk.cpp
index caf6fbf..a91b535 100644
--- a/src/dawn/native/vulkan/PhysicalDeviceVk.cpp
+++ b/src/dawn/native/vulkan/PhysicalDeviceVk.cpp
@@ -1073,8 +1073,12 @@
     }
 
     if (MayBeImaginationProprietary()) {
-        // crbug.com/443906252: Polyfill for case switch with large ranges.
+        // crbug.com/443906252 - Polyfill for case switch with large ranges.
         deviceToggles->Default(Toggle::VulkanPolyfillSwitchWithIf, true);
+
+        // crbug.com/540087398 - Driver bug miscomputes mip sizes for NPOT depth/stencil textures.
+        // TODO(https://crbug.com/540087398): Limit this to old drivers once there's a driver fix.
+        deviceToggles->Default(Toggle::VulkanDisallowNPOTDepthStencilMipmaps, true);
     }
 
     // AMD Mesa front end optimizer bug for unary negation and abs.
diff --git a/src/dawn/tests/end2end/QueueTests.cpp b/src/dawn/tests/end2end/QueueTests.cpp
index e09c8f8..5c5476a 100644
--- a/src/dawn/tests/end2end/QueueTests.cpp
+++ b/src/dawn/tests/end2end/QueueTests.cpp
@@ -546,6 +546,9 @@
 
 // Test writing to varying mips
 TEST_P(QueueWriteTextureTests, TextureWriteToMip) {
+    // TODO(crbug.com/540087398): NPOT mipmapped depth/stencil textures disallowed due to driver bug
+    DAWN_SUPPRESS_TEST_IF(IsImgTec());
+
     constexpr uint32_t kWidth = 259;
     constexpr uint32_t kHeight = 127;
 
diff --git a/webgpu-cts/expectations.txt b/webgpu-cts/expectations.txt
index 11b29ed..36a28cd 100644
--- a/webgpu-cts/expectations.txt
+++ b/webgpu-cts/expectations.txt
@@ -1879,6 +1879,11 @@
 crbug.com/538691038 [ intel mac ] webgpu:shader,validation,functions,alias_analysis:two_pointers_to_struct_members_indirect:address_space="private";member="a";aliased=false [ Failure ]
 crbug.com/538691038 [ intel mac ] webgpu:shader,validation,functions,alias_analysis:two_pointers_to_struct_members_indirect:address_space="private";member="a";aliased=true [ Failure ]
 
+crbug.com/540087398 [ android-pixel-10 ] webgpu:api,validation,createTexture:mipLevelCount,format:dimension="*";format="depth*" [ Failure ]
+crbug.com/540087398 [ android-pixel-10 ] webgpu:api,validation,createTexture:mipLevelCount,format:dimension="*";format="stencil*" [ Failure ]
+crbug.com/540087398 [ android-pixel-10 ] webgpu:shader,execution,expression,call,builtin,texture_utils:createTextureWithRandomDataAndGetTexels_with_generator:format="depth*";viewDimension="*" [ Failure ]
+crbug.com/540087398 [ android-pixel-10 ] webgpu:shader,execution,expression,call,builtin,texture_utils:createTextureWithRandomDataAndGetTexels_with_generator:format="stencil*";viewDimension="*" [ Failure ]
+
 ################################################################################
 # Autogenerated Failure expectations. Please triage.
 # ##ROLLER_AUTOGENERATED_FAILURES##
Loading diff…

Regression Test / PoC

shipped with the fix
diff --git a/src/dawn/tests/end2end/QueueTests.cpp b/src/dawn/tests/end2end/QueueTests.cpp
index e09c8f8..5c5476a 100644
--- a/src/dawn/tests/end2end/QueueTests.cpp
+++ b/src/dawn/tests/end2end/QueueTests.cpp
@@ -546,6 +546,9 @@
 
 // Test writing to varying mips
 TEST_P(QueueWriteTextureTests, TextureWriteToMip) {
+    // TODO(crbug.com/540087398): NPOT mipmapped depth/stencil textures disallowed due to driver bug
+    DAWN_SUPPRESS_TEST_IF(IsImgTec());
+
     constexpr uint32_t kWidth = 259;
     constexpr uint32_t kHeight = 127;
Loading diff…

Original Bug Report

reported by [email protected]

IMG: Heap OOB write in depth/stencil image layout computation

  • Attack surface: WebGPU, reachable from an untrusted web page in the default Chrome for Android configuration.
  • Impact: GPU-memory corruption in the unsandboxed Chrome GPU process.

Android internal bug: b/528131119

View on issue tracker