From 66cea9d23b50f8954d9f7f42b120047270e303f3 Mon Sep 17 00:00:00 2001 From: Debian X Strike Force Date: Fri, 19 Jun 2026 21:20:06 +0200 Subject: [PATCH] CVE-2026-40393 part 1 - out-of-bounds memory access in WebGPU Origin: https://gitlab.freedesktop.org/mesa/mesa/-/commit/978fd42b4b7d1e9c0435ffa7e1a4d339cba9b76e From 978fd42b4b7d1e9c0435ffa7e1a4d339cba9b76e Mon Sep 17 00:00:00 2001 From: Ian Romanick Date: Fri, 23 Jan 2026 09:58:26 -0800 Subject: [PATCH] spirv: Use STACK_ARRAY instead of NIR_VLA The number of fields comes from the shader, so it could be a value large enough that using alloca would be problematic. Fixes: 2a023f30a64 ("nir/spirv: Add basic support for types") Reviewed-by: Caio Oliveira Reviewed-by: Ryan Neph Reviewed-by: Lionel Landwerlin (cherry picked from commit 3da828d2dd12e20ba2afc152db8d7236c7a48c13) Part-of: Gbp-Pq: Name CVE-2026-40393-part1.patch --- src/compiler/spirv/spirv_to_nir.c | 27 +++++++++++++++++---------- 1 file changed, 17 insertions(+), 10 deletions(-) diff --git a/src/compiler/spirv/spirv_to_nir.c b/src/compiler/spirv/spirv_to_nir.c index f91658b53..46053dd4f 100644 --- a/src/compiler/spirv/spirv_to_nir.c +++ b/src/compiler/spirv/spirv_to_nir.c @@ -27,7 +27,6 @@ #include "glsl_types.h" #include "vtn_private.h" -#include "nir/nir_vla.h" #include "nir/nir_control_flow.h" #include "nir/nir_constant_expressions.h" #include "nir/nir_deref.h" @@ -38,6 +37,7 @@ #include "util/u_string.h" #include "util/u_debug.h" #include "util/mesa-blake3.h" +#include "util/stack_array.h" #include @@ -1228,7 +1228,7 @@ vtn_type_get_nir_type(struct vtn_builder *b, struct vtn_type *type, case vtn_base_type_struct: { bool need_new_struct = false; const uint32_t num_fields = type->length; - NIR_VLA(struct glsl_struct_field, fields, num_fields); + STACK_ARRAY(struct glsl_struct_field, fields, num_fields); for (unsigned i = 0; i < num_fields; i++) { fields[i] = *glsl_get_struct_field_data(type->type, i); const struct glsl_type *field_nir_type = @@ -1238,20 +1238,25 @@ vtn_type_get_nir_type(struct vtn_builder *b, struct vtn_type *type, need_new_struct = true; } } + + const struct glsl_type *result; if (need_new_struct) { if (glsl_type_is_interface(type->type)) { - return glsl_interface_type(fields, num_fields, - /* packing */ 0, false, - glsl_get_type_name(type->type)); + result = glsl_interface_type(fields, num_fields, + /* packing */ 0, false, + glsl_get_type_name(type->type)); } else { - return glsl_struct_type(fields, num_fields, - glsl_get_type_name(type->type), - glsl_struct_type_is_packed(type->type)); + result = glsl_struct_type(fields, num_fields, + glsl_get_type_name(type->type), + glsl_struct_type_is_packed(type->type)); } } else { /* No changes, just pass it on */ - return type->type; + result = type->type; } + + STACK_ARRAY_FINISH(fields); + return result; } case vtn_base_type_image: @@ -1868,7 +1873,7 @@ vtn_handle_type(struct vtn_builder *b, SpvOp opcode, val->type->offsets = vtn_alloc_array(b, unsigned, num_fields); val->type->packed = false; - NIR_VLA(struct glsl_struct_field, fields, count); + STACK_ARRAY(struct glsl_struct_field, fields, count); for (unsigned i = 0; i < num_fields; i++) { val->type->members[i] = vtn_get_type(b, w[i + 2]); const char *name = NULL; @@ -1924,6 +1929,8 @@ vtn_handle_type(struct vtn_builder *b, SpvOp opcode, name ? name : "struct", val->type->packed); } + + STACK_ARRAY_FINISH(fields); break; } -- 2.30.2