From 92cc9851b3296a2e97961679554a1c2791231321 Mon Sep 17 00:00:00 2001 From: Debian X Strike Force Date: Fri, 19 Jun 2026 21:20:06 +0200 Subject: [PATCH] CVE-2026-40393 part 2 - out-of-bounds memory access in WebGPU Origin: https://gitlab.freedesktop.org/mesa/mesa/-/commit/978fd42b4b7d1e9c0435ffa7e1a4d339cba9b76e From 45ce75f3bcd638dcf7daae09f9bf0b7c015b81c4 Mon Sep 17 00:00:00 2001 From: Ian Romanick Date: Fri, 23 Jan 2026 10:07:27 -0800 Subject: [PATCH] nir: Use STACK_ARRAY instead of NIR_VLA The number of fields comes from the shader, so it could be a value large enough that using alloca would be problematic. Fixes: c11833ab24d ("nir,spirv: Rework function calls") Reviewed-by: Caio Oliveira Reviewed-by: Ryan Neph Reviewed-by: Lionel Landwerlin (cherry picked from commit 9017d37e84771f921a63676dd8b955df9ef20f29) Part-of: Gbp-Pq: Name CVE-2026-40393-part2.patch --- src/compiler/nir/nir_functions.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/compiler/nir/nir_functions.c b/src/compiler/nir/nir_functions.c index 514e83192..5baf183ec 100644 --- a/src/compiler/nir/nir_functions.c +++ b/src/compiler/nir/nir_functions.c @@ -22,9 +22,9 @@ */ #include "nir.h" +#include "util/stack_array.h" #include "nir_builder.h" #include "nir_control_flow.h" -#include "nir_vla.h" /* * TODO: write a proper inliner for GPUs. @@ -228,12 +228,13 @@ static bool inline_functions_pass(nir_builder *b, * to an SSA value first. */ const unsigned num_params = call->num_params; - NIR_VLA(nir_def *, params, num_params); + STACK_ARRAY(nir_def *, params, num_params); for (unsigned i = 0; i < num_params; i++) { params[i] = call->params[i].ssa; } nir_inline_function_impl(b, call->callee->impl, params, NULL); + STACK_ARRAY_FINISH(params); return true; } -- 2.30.2