CVE-2026-40393 part 2 - out-of-bounds memory access in WebGPU

Origin: https://gitlab.freedesktop.org/mesa/mesa/-/commit/978fd42b4b7d1e9c0435ffa7e1a4d339cba9b76e

From 45ce75f3bcd638dcf7daae09f9bf0b7c015b81c4 Mon Sep 17 00:00:00 2001
From: Ian Romanick <ian.d.romanick@intel.com>
Date: Fri, 23 Jan 2026 10:07:27 -0800
Subject: [PATCH] nir: Use STACK_ARRAY instead of NIR_VLA

The number of fields comes from the shader, so it could be a value large
enough that using alloca would be problematic.

Fixes: c11833ab24d ("nir,spirv: Rework function calls")
Reviewed-by: Caio Oliveira <caio.oliveira@intel.com>
Reviewed-by: Ryan Neph <ryanneph@google.com>
Reviewed-by: Lionel Landwerlin <lionel.g.landwerlin@intel.com>
(cherry picked from commit 9017d37e84771f921a63676dd8b955df9ef20f29)

Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/40092>

Gbp-Pq: Name CVE-2026-40393-part2.patch

diff --git a/src/compiler/nir/nir_functions.c b/src/compiler/nir/nir_functions.c
index 514e831920c5d14a95760316c2d28b229db9d38a..5baf183ec50ed93313837f61fbd6b6a021d974be 100644 (file)
--- a/src/compiler/nir/nir_functions.c
+++ b/src/compiler/nir/nir_functions.c
@@ -22,9 +22,9 @@
  */
 
 #include "nir.h"
+#include "util/stack_array.h"
 #include "nir_builder.h"
 #include "nir_control_flow.h"
-#include "nir_vla.h"
 
 /*
  * TODO: write a proper inliner for GPUs.
@@ -228,12 +228,13 @@ static bool inline_functions_pass(nir_builder *b,
     * to an SSA value first.
     */
    const unsigned num_params = call->num_params;
-   NIR_VLA(nir_def *, params, num_params);
+   STACK_ARRAY(nir_def *, params, num_params);
    for (unsigned i = 0; i < num_params; i++) {
       params[i] = call->params[i].ssa;
    }
 
    nir_inline_function_impl(b, call->callee->impl, params, NULL);
+   STACK_ARRAY_FINISH(params);
    return true;
 }