Chrome · Dawn
CVE-2026-14416
OOB in Dawn
Overview
Low
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
forsrc/dawn/native/vulkan/DeviceVk.cpp |
modified |
Files Changed
src/dawn/native/vulkan/DeviceVk.cppsrc/dawn/native/vulkan/DeviceVk.h
Patch
From 5d6c4aa2251153bf62663039d12d63f0702e5e16 Mon Sep 17 00:00:00 2001
From: Corentin Wallez <cwallez@chromium.org>
Date: Wed, 27 May 2026 02:27:17 -0700
Subject: [PATCH] [dawn][vulkan] Avoid race when VVL errors are generated.
They might not be generated on the same thread that will check for them,
so we need a mutex to protect access to the stored mDebugMessages.
Checked manually that the VVL issues are still reported (and reported
only once contrary to twice like the code was doing earlier).
Fixed: 515428315
Change-Id: I3a5a91967c0693bbac9be869da1ef3eb190d7a3f
Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/310455
Reviewed-by: Brandon Jones <bajones@chromium.org>
Commit-Queue: Corentin Wallez <cwallez@chromium.org>
---
diff --git a/src/dawn/native/vulkan/DeviceVk.cpp b/src/dawn/native/vulkan/DeviceVk.cpp
index 8393dec..e1cf352 100644
--- a/src/dawn/native/vulkan/DeviceVk.cpp
+++ b/src/dawn/native/vulkan/DeviceVk.cpp
@@ -28,6 +28,7 @@
#include "dawn/native/vulkan/DeviceVk.h"
#include <algorithm>
+#include <utility>
#include "dawn/common/Log.h"
#include "dawn/common/Math.h"
@@ -978,19 +979,23 @@
}
void Device::OnDebugMessage(std::string message) {
- mDebugMessages.push_back(std::move(message));
+ mDebugMessages->push_back(std::move(message));
+}
+
+std::vector<std::string> Device::AcquireDebugLayerMessages() {
+ std::vector<std::string> messagesOut;
+ mDebugMessages.Use([&](auto messages) { messagesOut = std::move(*messages); });
+ return messagesOut;
}
MaybeError Device::CheckDebugLayerAndGenerateErrors() {
- if (!GetAdapter()->GetInstance()->IsBackendValidationEnabled() || mDebugMessages.empty()) {
+ if (!GetAdapter()->GetInstance()->IsBackendValidationEnabled() || mDebugMessages->empty()) {
return {};
}
- auto error = DAWN_INTERNAL_ERROR("The Vulkan validation layer reported uncaught errors.");
-
- AppendDebugLayerMessages(error.get());
-
- return std::move(error);
+ // The debug layer messages will be appended later when DeviceBase::HandleError calls
+ // AppendDebugLayerMessages.
+ return DAWN_INTERNAL_ERROR("The Vulkan validation layer reported uncaught errors.");
}
void Device::AppendDebugLayerMessages(ErrorData* error) {
@@ -998,20 +1003,29 @@
return;
}
- while (!mDebugMessages.empty()) {
- error->AppendBackendMessage(std::move(mDebugMessages.back()));
- mDebugMessages.pop_back();
+ std::vector<std::string> messages = AcquireDebugLayerMessages();
+ if (messages.empty()) {
+ return;
+ }
+
+ for (std::string& message : messages) {
+ error->AppendBackendMessage(std::move(message));
}
}
-void Device::CheckDebugMessagesAfterDestruction() const {
- if (!GetAdapter()->GetInstance()->IsBackendValidationEnabled() || mDebugMessages.empty()) {
+void Device::CheckDebugMessagesAfterDestruction() {
+ if (!GetAdapter()->GetInstance()->IsBackendValidationEnabled()) {
+ return;
+ }
+
+ std::vector<std::string> messages = AcquireDebugLayerMessages();
+ if (messages.empty()) {
return;
}
dawn::ErrorLog()
<< "Some VVL messages were not handled before dawn::native::vulkan::Device destruction:";
- for (const auto& message : mDebugMessages) {
+ for (const auto& message : messages) {
dawn::ErrorLog() << " - " << message;
}
diff --git a/src/dawn/native/vulkan/DeviceVk.h b/src/dawn/native/vulkan/DeviceVk.h
index 4feece8..fb94b7b 100644
--- a/src/dawn/native/vulkan/DeviceVk.h
+++ b/src/dawn/native/vulkan/DeviceVk.h
@@ -30,14 +30,11 @@
#include <memory>
#include <mutex>
-#include <queue>
#include <string>
-#include <utility>
#include <vector>
#include "dawn/common/MutexProtected.h"
#include "dawn/common/SerialQueue.h"
-#include "dawn/native/Commands.h"
#include "dawn/native/Device.h"
#include "dawn/native/dawn_platform.h"
#include "dawn/native/vulkan/CommandRecordingContextVk.h"
@@ -207,9 +204,10 @@
ResultOrError<VulkanDeviceKnobs> CreateDevice(VkPhysicalDevice vkPhysicalDevice);
- MaybeError CheckDebugLayerAndGenerateErrors();
void AppendDebugLayerMessages(ErrorData* error) override;
- void CheckDebugMessagesAfterDestruction() const;
+ std::vector<std::string> AcquireDebugLayerMessages();
+ MaybeError CheckDebugLayerAndGenerateErrors();
+ void CheckDebugMessagesAfterDestruction();
void DestroyImpl(DestroyReason reason) override;
MaybeError GetAHardwareBufferPropertiesImpl(void* handle, AHardwareBufferProperties* properties)
@@ -240,7 +238,7 @@
// For capturing messages generated by the Vulkan debug layer.
const std::string mDebugPrefix;
- std::vector<std::string> mDebugMessages;
+ MutexProtected<std::vector<std::string>> mDebugMessages;
std::once_flag mMonolithicPipelineCacheFlag;
Ref<PipelineCache> mMonolithicPipelineCache;
Loading diff…
Original Bug Report
The reporter's bug is still restricted on the tracker. Chrome de-restricts security bugs ~30–90 days after the fix ships; a later run will backfill it here.
References
On This Page