2000441 - SEGV in Mesa Driver on unknown address with incorrect RendererBundle BindGroup

Status: RESOLVED FIXED

(Core :: Graphics: WebGPU, defect, P1)

Description

[Atte Kettunen]

Attachment: minimal-crash-final.html

Tested on:
-OS: Ubuntu 24.04
-Mesa: mesa-24.0.5-1ubuntu1 - This is version of mesa has debug symbols available. Also tested to reproduce on current newest for Ubuntu 24.04, Mesa 25.0.7.
-Firefox: fuzzfetch -a --fuzzing

  Version: 147.0a1
  BuildID=20251114094637
  SourceStamp=4e885473cb08ec97b42aa99ea83cc2485a463d31

Reproducing file as an attachment.

Looks like Firefox is failing to validate bing group validity in RendererBundle.

Shader code only defined @group(0), but the RendererBundle is setting the bind group to 2.

On Chrome we get warning:

minimal-crash-final.html:1 No bind group set at group index 0.
 - While encoding [RenderBundleEncoder (unlabeled)].DrawIndexed(6, 1, 0, 0, 0).
 - While calling [RenderBundleEncoder (unlabeled)].Finish([RenderBundleDescriptor]).

minimal-crash-final.html:1 [Invalid RenderBundle] is invalid.
 - While encoding [RenderPassEncoder (unlabeled)].ExecuteBundles(1, ...).
 - While finishing [CommandEncoder (unlabeled)].

Asan-trace from mesa with debug symbols:

==161924==ERROR: AddressSanitizer: SEGV on unknown address (pc 0x7bff2708ce30 bp 0x7bfeb33fcaf0 sp 0x7bfeb33fc560 T145)
==161924==The signal is caused by a READ memory access.
==161924==Hint: this fault was caused by a dereference of a high value address (see register values below).  Disassemble the provided pc to learn which register was used.
    #0 0x7bff2708ce30  (<unknown module>)
    #1 0x7bfeafa87ba1 in shade_quads /usr/src/mesa-24.0.5-1ubuntu1/build/../src/gallium/drivers/llvmpipe/lp_rast_linear_fallback.c:111:4
    #2 0x7bfeafa87d5f in ?? /usr/src/mesa-24.0.5-1ubuntu1/build/../src/gallium/drivers/llvmpipe/lp_rast_linear_fallback.c:140:4
    #3 0x7bfeafa87d5f in lp_rast_linear_rect_fallback /usr/src/mesa-24.0.5-1ubuntu1/build/../src/gallium/drivers/llvmpipe/lp_rast_linear_fallback.c:202:7
    #4 0x7bfeafa87738 in lp_rast_linear_tile /usr/src/mesa-24.0.5-1ubuntu1/build/../src/gallium/drivers/llvmpipe/lp_rast_linear.c:118:7
    #5 0x7bfeafa87ab4 in lp_linear_rasterize_bin /usr/src/mesa-24.0.5-1ubuntu1/build/../src/gallium/drivers/llvmpipe/lp_rast_linear.c:251:10
    #6 0x7bfeafa86b9f in rasterize_bin /usr/src/mesa-24.0.5-1ubuntu1/build/../src/gallium/drivers/llvmpipe/lp_rast.c:1001:7
    #7 0x7bfeafa86b9f in rasterize_scene /usr/src/mesa-24.0.5-1ubuntu1/build/../src/gallium/drivers/llvmpipe/lp_rast.c:1067:13
    #8 0x7bfeafa86c96 in thread_function /usr/src/mesa-24.0.5-1ubuntu1/build/../src/gallium/drivers/llvmpipe/lp_rast.c:1202:7
    #9 0x7bfeaf94350b in ?? /usr/src/mesa-24.0.5-1ubuntu1/build/../src/c11/impl/threads_posix.c:67:29
    #10 0x5555556bfc56 in asan_thread_start(void*) _asan_rtl_:28

==161924==Register values:
rax = 0xffb561d8ffb561c8  rbx = 0x0000000000000000  rcx = 0x00000000000000ff  rdx = 0x00007bfeaff5ac40
rdi = 0x00007bff2708b164  rsi = 0x00007bfeaff2afd0  rbp = 0x00007bfeb33fcaf0  rsp = 0x00007bfeb33fc560
 r8 = 0x0000000000000001   r9 = 0x00007bff2708b154  r10 = 0x00007d2ff6cd5580  r11 = 0x00007bff2708b198
r12 = 0x0000000000000000  r13 = 0x00007f0ff6eb0930  r14 = 0x0000000000000000  r15 = 0x00007bff2708b194
AddressSanitizer can not provide additional info.
SUMMARY: AddressSanitizer: SEGV (<unknown module>)
Thread T145 created by T82 here:
    #0 0x5555556a7f01 in ___interceptor_pthread_create _asan_rtl_:3
    #1 0x7bfeaf943734 in ?? /usr/src/mesa-24.0.5-1ubuntu1/build/../src/c11/impl/threads_posix.c:278:9
    #2 0x7bfeaf91502a in ?? /usr/src/mesa-24.0.5-1ubuntu1/build/../src/util/u_thread.c:66:10
    #3 0x7bfeafa87426 in create_rast_threads /usr/src/mesa-24.0.5-1ubuntu1/build/../src/gallium/drivers/llvmpipe/lp_rast.c:1238:27
    #4 0x7bfeafa87426 in lp_rast_create /usr/src/mesa-24.0.5-1ubuntu1/build/../src/gallium/drivers/llvmpipe/lp_rast.c:1280:4
...
    #9 0x7bff1dd1b6fd in ?? ??:0
    #10 0x7bff1dd18600 in ?? ??:0
    #11 0x7bff1dd13af4 in ?? ??:0
    #12 0x7bff1dd240f2 in vkCreateDevice ??:0:0
    #13 0x7bffe3f78d40 in ash::instance::Instance::create_device::h459f9d1f4e71d6ca /builds/worker/checkouts/gecko/third_party/rust/ash/src/instance.rs:369:22

WebGPU info:

{
  "navigator.gpu.requestAdapter({\"forceFallbackAdapter\":true})": {
    "info": {
      "architecture": "",
      "description": "",
      "device": "",
      "isFallbackAdapter": true,
      "subgroupMaxSize": 128,
      "subgroupMinSize": 4,
      "vendor": "",
      "wgpuBackend": "Vulkan",
      "wgpuDevice": 0,
      "wgpuDeviceType": "Cpu",
      "wgpuDriver": "llvmpipe",
      "wgpuDriverInfo": "Mesa 24.0.5-1ubuntu1 (LLVM 17.0.6)",
      "wgpuName": "llvmpipe (LLVM 17.0.6, 256 bits)",
      "wgpuVendor": 65541
    },
    "features": [
      "bgra8unorm-storage",
      "core-features-and-limits",
      "depth-clip-control",
      "depth32float-stencil8",
      "float32-filterable",
      "indirect-first-instance",
      "rg11b10ufloat-renderable",
      "shader-f16",
      "texture-compression-bc",
      "texture-compression-bc-sliced-3d",
      "timestamp-query"
    ],
    "limits": {
      "maxBindGroups": 8,
      "maxBindGroupsPlusVertexBuffers": 24,
      "maxBindingsPerBindGroup": 1000,
      "maxBufferSize": 1073741824,
      "maxColorAttachmentBytesPerSample": 32,
      "maxColorAttachments": 8,
      "maxComputeInvocationsPerWorkgroup": 1024,
      "maxComputeWorkgroupSizeX": 1024,
      "maxComputeWorkgroupSizeY": 1024,
      "maxComputeWorkgroupSizeZ": 1024,
      "maxComputeWorkgroupStorageSize": 32768,
      "maxComputeWorkgroupsPerDimension": 65535,
      "maxDynamicStorageBuffersPerPipelineLayout": 1000000,
      "maxDynamicUniformBuffersPerPipelineLayout": 1000000,
      "maxInterStageShaderVariables": 16,
      "maxSampledTexturesPerShaderStage": 64,
      "maxSamplersPerShaderStage": 64,
      "maxStorageBufferBindingSize": 134217728,
      "maxStorageBuffersPerShaderStage": 64,
      "maxStorageTexturesPerShaderStage": 64,
      "maxTextureArrayLayers": 2048,
      "maxTextureDimension1D": 16384,
      "maxTextureDimension2D": 16384,
      "maxTextureDimension3D": 4096,
      "maxUniformBufferBindingSize": 65536,
      "maxUniformBuffersPerShaderStage": 64,
      "maxVertexAttributes": 32,
      "maxVertexBufferArrayStride": 2048,
      "maxVertexBuffers": 16,
      "minStorageBufferOffsetAlignment": 32,
      "minUniformBufferOffsetAlignment": 32
    }
  }
}

Comment 1

[Erich Gubler [:ErichDonGubler] (he/him)]

Triage: NI'ing :jimb and :aleiserson. Jim has dealt with most of our Linux crashes recently, and Andy has been onboarding onto the WebGPU spec.'s validation for bind groups quite a bit recently.

I'm not sure what severity to give this yet, myself. I'm leaning towards S2. The WebGPU team will be performing a weekly triage meeting today, so we should be able to get a consensus on an initial classification shortly.

Comment 2

[Daniel Veditz [:dveditz]]

Is it time to simply ban all Mesa drivers? Sorry, no WebGPU for you!

Comment 3

[Daniel Veditz [:dveditz]]

Is this wild read just stuff that's going to go into the display (less severe) or is the shader code confused and likely to execute bad code?

Comment 4

[Teodor Tanasoaia [:teoxoy]]

Needs https://github.com/gfx-rs/wgpu/pull/8720 & wgpu revendor.

Comment 5

[Jim Blandy :jimb]

I've updated bug 2005294 to bring in the 28.0.0 release, which includes wgpu#8720 as commit 61f08ed2d. So I've changed this bug to block 2005294 instead of webgpu-update-wgpu.

Comment 6

[Jim Blandy :jimb]

Atte, could you verify that this is fixed in Nightly?

Comment 7

[Atte Kettunen]

Doesn't reproduce anymore on:

fuzzfetch -a -n firefox
Identified task: https://firefox-ci-tc.services.mozilla.com/api/index/v1/task/gecko.v2.mozilla-central.latest.firefox.linux64-asan-opt
> Task ID: Tpa7suhsRaKFiofOjbxzPw
> Rank: 1767518779
> Changeset: 39305265f6c10fc31953222dad4d9319ac35bb28
> Build ID: 20260104092619
> Downloading: https://firefox-ci-tc.services.mozilla.com/api/queue/v1/task/Tpa7suhsRaKFiofOjbxzPw/artifacts/public/build/target.tar.xz (364.52MiB total)

Only got this log message:

JavaScript warning: , line 0: Uncaptured WebGPU error: In a draw command, kind: Draw, caused by: The current set RenderPipeline with '' label expects a BindGroup to be set at index 0
JavaScript warning: , line 0: Uncaptured WebGPU error: In a execute_bundle command, caused by: RenderBundle with '' label is invalid

Comment 8

[Daniel Veditz [:dveditz]]

Adding bounty flag requested by the reporter

Comment 9

[Daniel Veditz [:dveditz]]

(In reply to Daniel Veditz [:dveditz] from comment #3)

Is this wild read just stuff that's going to go into the display (less severe) or is the shader code confused and likely to execute bad code?

re-upping this question because we have to evaluate the bug bounty claim

Comment 10

[Teodor Tanasoaia [:teoxoy]]

It's likely that bad code will be executed.