Chrome · Dawn
CVE-2026-76036
OOB in Dawn
Overview
Critical
Severity
—
CVSS
No
Exploited ITW
Fixed
Fix Status
Changed Functions
| Function | Change | Notes |
|---|---|---|
TEST_Psrc/dawn/tests/end2end/QueueTests.cpp |
modified |
Files Changed
src/dawn/native/Texture.cppsrc/dawn/native/Toggles.cppsrc/dawn/native/Toggles.hsrc/dawn/native/vulkan/PhysicalDeviceVk.cppsrc/dawn/tests/end2end/QueueTests.cppwebgpu-cts/expectations.txt
Patch
From 178fb7048ad322e4ff797210358ed05254289e0c Mon Sep 17 00:00:00 2001
From: Kai Ninomiya <kainino@chromium.org>
Date: Thu, 30 Jul 2026 16:20:14 -0700
Subject: [PATCH] [dawn][vulkan] Disallow NPOT mipmapped depth/stencil textures on ImgTec
Can't think of a way to work around this, so just disable it.
Fixes: 540087398
Cq-Include-Trybots: luci.chromium.try:android-dawn-arm64-p10-rel
Change-Id: I22ce9c18564d338c9ee15e18cfe4598bc34cda95
Reviewed-on: https://dawn-review.googlesource.com/c/dawn/+/328455
Reviewed-by: Brandon Jones <bajones@chromium.org>
Commit-Queue: Kai Ninomiya <kainino@chromium.org>
---
diff --git a/src/dawn/native/Texture.cpp b/src/dawn/native/Texture.cpp
index eb3b0ee..23c6752 100644
--- a/src/dawn/native/Texture.cpp
+++ b/src/dawn/native/Texture.cpp
@@ -875,6 +875,15 @@
(format->aspects & (Aspect::Depth | Aspect::Stencil)),
"The dimension (%s) of a texture with a depth/stencil format (%s) is not 2D.",
descriptor->dimension, format->format);
+ if (device->IsToggleEnabled(Toggle::VulkanDisallowNPOTDepthStencilMipmaps)) {
+ DAWN_INVALID_IF(
+ (format->aspects & (Aspect::Depth | Aspect::Stencil)) &&
+ descriptor->mipLevelCount > 1 &&
+ (!IsPowerOfTwo(descriptor->size.width) || !IsPowerOfTwo(descriptor->size.height)),
+ "Non-power-of-two depth/stencil texture (%s) with mipLevelCount (%u) > 1 is "
+ "disallowed on this device due to a driver bug.",
+ descriptor->size, descriptor->mipLevelCount);
+ }
DAWN_TRY(ValidateTextureSize(device, *descriptor, format));
return {};
diff --git a/src/dawn/native/Toggles.cpp b/src/dawn/native/Toggles.cpp
index b553e64..9dc2218 100644
--- a/src/dawn/native/Toggles.cpp
+++ b/src/dawn/native/Toggles.cpp
@@ -819,6 +819,11 @@
{"vulkan_replace_workgroup_atomic_store_with_exchange",
"Workaround for a driver bug that implements atomic store incorrectly.",
"https://crbug.com/487773864", ToggleStage::Device}},
+ {Toggle::VulkanDisallowNPOTDepthStencilMipmaps,
+ {"vulkan_disallow_npot_depth_stencil_mipmaps",
+ "Reject NPOT depth/stencil textures with mipLevelCount > 1. Workaround for mip level "
+ "miscomputation in PowerVR proprietary driver.",
+ "https://crbug.com/540087398", ToggleStage::Device}},
{Toggle::WaitIsThreadSafe,
{"wait_is_thread_safe",
"WaitFor* functions are thread-safe and can be called without the device-lock if implicit "
diff --git a/src/dawn/native/Toggles.h b/src/dawn/native/Toggles.h
index 52115d1..dea360c 100644
--- a/src/dawn/native/Toggles.h
+++ b/src/dawn/native/Toggles.h
@@ -195,6 +195,7 @@
VulkanSleepAfterLostDeviceWait,
UseSpirvReconvergenceMode,
VulkanReplaceWorkgroupAtomicStoreWithExchange,
+ VulkanDisallowNPOTDepthStencilMipmaps,
// Once all backends have been updated to be thread safe for waiting, we can remove this toggle.
WaitIsThreadSafe,
diff --git a/src/dawn/native/vulkan/PhysicalDeviceVk.cpp b/src/dawn/native/vulkan/PhysicalDeviceVk.cpp
index caf6fbf..a91b535 100644
--- a/src/dawn/native/vulkan/PhysicalDeviceVk.cpp
+++ b/src/dawn/native/vulkan/PhysicalDeviceVk.cpp
@@ -1073,8 +1073,12 @@
}
if (MayBeImaginationProprietary()) {
- // crbug.com/443906252: Polyfill for case switch with large ranges.
+ // crbug.com/443906252 - Polyfill for case switch with large ranges.
deviceToggles->Default(Toggle::VulkanPolyfillSwitchWithIf, true);
+
+ // crbug.com/540087398 - Driver bug miscomputes mip sizes for NPOT depth/stencil textures.
+ // TODO(https://crbug.com/540087398): Limit this to old drivers once there's a driver fix.
+ deviceToggles->Default(Toggle::VulkanDisallowNPOTDepthStencilMipmaps, true);
}
// AMD Mesa front end optimizer bug for unary negation and abs.
diff --git a/src/dawn/tests/end2end/QueueTests.cpp b/src/dawn/tests/end2end/QueueTests.cpp
index e09c8f8..5c5476a 100644
--- a/src/dawn/tests/end2end/QueueTests.cpp
+++ b/src/dawn/tests/end2end/QueueTests.cpp
@@ -546,6 +546,9 @@
// Test writing to varying mips
TEST_P(QueueWriteTextureTests, TextureWriteToMip) {
+ // TODO(crbug.com/540087398): NPOT mipmapped depth/stencil textures disallowed due to driver bug
+ DAWN_SUPPRESS_TEST_IF(IsImgTec());
+
constexpr uint32_t kWidth = 259;
constexpr uint32_t kHeight = 127;
diff --git a/webgpu-cts/expectations.txt b/webgpu-cts/expectations.txt
index 11b29ed..36a28cd 100644
--- a/webgpu-cts/expectations.txt
+++ b/webgpu-cts/expectations.txt
@@ -1879,6 +1879,11 @@
crbug.com/538691038 [ intel mac ] webgpu:shader,validation,functions,alias_analysis:two_pointers_to_struct_members_indirect:address_space="private";member="a";aliased=false [ Failure ]
crbug.com/538691038 [ intel mac ] webgpu:shader,validation,functions,alias_analysis:two_pointers_to_struct_members_indirect:address_space="private";member="a";aliased=true [ Failure ]
+crbug.com/540087398 [ android-pixel-10 ] webgpu:api,validation,createTexture:mipLevelCount,format:dimension="*";format="depth*" [ Failure ]
+crbug.com/540087398 [ android-pixel-10 ] webgpu:api,validation,createTexture:mipLevelCount,format:dimension="*";format="stencil*" [ Failure ]
+crbug.com/540087398 [ android-pixel-10 ] webgpu:shader,execution,expression,call,builtin,texture_utils:createTextureWithRandomDataAndGetTexels_with_generator:format="depth*";viewDimension="*" [ Failure ]
+crbug.com/540087398 [ android-pixel-10 ] webgpu:shader,execution,expression,call,builtin,texture_utils:createTextureWithRandomDataAndGetTexels_with_generator:format="stencil*";viewDimension="*" [ Failure ]
+
################################################################################
# Autogenerated Failure expectations. Please triage.
# ##ROLLER_AUTOGENERATED_FAILURES##
Loading diff…
Regression Test / PoC
shipped with the fix
diff --git a/src/dawn/tests/end2end/QueueTests.cpp b/src/dawn/tests/end2end/QueueTests.cpp
index e09c8f8..5c5476a 100644
--- a/src/dawn/tests/end2end/QueueTests.cpp
+++ b/src/dawn/tests/end2end/QueueTests.cpp
@@ -546,6 +546,9 @@
// Test writing to varying mips
TEST_P(QueueWriteTextureTests, TextureWriteToMip) {
+ // TODO(crbug.com/540087398): NPOT mipmapped depth/stencil textures disallowed due to driver bug
+ DAWN_SUPPRESS_TEST_IF(IsImgTec());
+
constexpr uint32_t kWidth = 259;
constexpr uint32_t kHeight = 127;
Loading diff…
Original Bug Report
reported by xi...@google.com
IMG: Heap OOB write in depth/stencil image layout computation
- Attack surface: WebGPU, reachable from an untrusted web page in the default Chrome for Android configuration.
- Impact: GPU-memory corruption in the unsandboxed Chrome GPU process.
Android internal bug: b/528131119
References
On This Page