197682 2019-05-07 18:04:08 -0700 [WebGPU] Validate GPUComputePassEncoder.dispatch to prevent DOS on macOS 2019-06-16 20:50:59 -0700 1 1 1 Unclassified WebKit WebGPU WebKit Nightly Build Unspecified Unspecified NEW InRadar P2 Normal --- 1 justin_fan justin_fan dino ews-watchlist graouts jonlee kondapallykalyan mmaxfield webkit-bug-importer oldest_to_newest 1534200 0 justin_fan 2019-05-07 18:04:08 -0700 [WebGPU] Limit threadsPerThreadGroup for GPUComputePassEncoder.dispatch to prevent DOS on macOS 1534470 1 369419 justin_fan 2019-05-08 13:48:03 -0700 Created attachment 369419 Patch 1534473 2 369419 mmaxfield 2019-05-08 13:56:29 -0700 Comment on attachment 369419 Patch View in context: https://bugs.webkit.org/attachment.cgi?id=369419&action=review > Source/WebCore/platform/graphics/gpu/cocoa/GPUComputePassEncoderMetal.mm:97 > + LOG(WebGPU, "GPUComputePassEncoder::dispatch(): Threadgroup dispatch size too large!"); a single thread can make the GPU hang. This check is not sufficient to solve the problem nor necessary to solve the problem. We need to solve DOS attacks at a more fundamental level. Also this constant would have to be hardware-dependent. 1534475 3 369419 mmaxfield 2019-05-08 13:57:47 -0700 Comment on attachment 369419 Patch This is fundamentally the wrong approach to solving this problem. 1536270 4 webkit-bug-importer 2019-05-14 15:08:53 -0700 <rdar://problem/50784837> 369419 2019-05-08 13:48:03 -0700 2019-05-08 13:57:47 -0700 Patch bug-197682-20190508134803.patch text/plain 1984 justin_fan U3VidmVyc2lvbiBSZXZpc2lvbjogMjQ0OTY2CmRpZmYgLS1naXQgYS9Tb3VyY2UvV2ViQ29yZS9D aGFuZ2VMb2cgYi9Tb3VyY2UvV2ViQ29yZS9DaGFuZ2VMb2cKaW5kZXggYzZjMWY3Njc5ZjU0NWQ5 NGE0MDE2NmIyYTRiN2QzNjRmZjg1YjdiMS4uNmU1ZmUzZDM5MThiNTY4NjMyZjBlNjQ3OTUyMTQ1 MzZjMzU1NGMwNCAxMDA2NDQKLS0tIGEvU291cmNlL1dlYkNvcmUvQ2hhbmdlTG9nCisrKyBiL1Nv dXJjZS9XZWJDb3JlL0NoYW5nZUxvZwpAQCAtMSwzICsxLDE4IEBACisyMDE5LTA1LTA3ICBKdXN0 aW4gRmFuICA8anVzdGluX2ZhbkBhcHBsZS5jb20+CisKKyAgICAgICAgW1dlYkdQVV0gTGltaXQg dGhyZWFkc1BlclRocmVhZEdyb3VwIGZvciBHUFVDb21wdXRlUGFzc0VuY29kZXIuZGlzcGF0Y2gg dG8gcHJldmVudCBET1Mgb24gbWFjT1MKKyAgICAgICAgaHR0cHM6Ly9idWdzLndlYmtpdC5vcmcv c2hvd19idWcuY2dpP2lkPTE5NzY4MgorCisgICAgICAgIFJldmlld2VkIGJ5IE5PQk9EWSAoT09Q UyEpLgorCisgICAgICAgIEFkZCB0ZW1wb3JhcnkgdmFsaWRhdGlvbiB0byBwcmV2ZW50IG1hY09T IHN5c3RlbXMgZnJvbSBsb2NrLXVwIHZpYSBleHRyZW1lbHkgbGFyZ2UgR1BVIGNvbXB1dGUgZGlz cGF0Y2hlcy4KKyAgICAgICAgV2lsbCBiZSBhZGp1c3RlZCBhZnRlciBXZWJHUFUgV0cgZGVjaWRl cyBvbiB0aGUgc3BlY2lmaWNhdGlvbiBmb3IgR1BVQ29tcHV0ZVBhc3NFbmNvZGVyLmRpc3BhdGNo LgorCisgICAgICAgIE5vIG5ldyB0ZXN0cyBhcyBlcnJvciBoYW5kbGluZyBpcyBub3QgaG9va2Vk IHVwIHlldC4KKworICAgICAgICAqIHBsYXRmb3JtL2dyYXBoaWNzL2dwdS9jb2NvYS9HUFVDb21w dXRlUGFzc0VuY29kZXJNZXRhbC5tbToKKyAgICAgICAgKFdlYkNvcmU6OkdQVUNvbXB1dGVQYXNz RW5jb2Rlcjo6ZGlzcGF0Y2gpOgorCiAyMDE5LTA1LTA2ICBaYW4gRG9iZXJzZWsgIDx6ZG9iZXJz ZWtAaWdhbGlhLmNvbT4KIAogICAgICAgICBbR0xpYl0gV2ViQ29yZTo6TWFpblRocmVhZFNoYXJl ZFRpbWVyIHNob3VsZCB1c2UgdGhlIGFwcHJvcHJpYXRlIEdTb3VyY2UgcHJpb3JpdHksIG5hbWUK ZGlmZiAtLWdpdCBhL1NvdXJjZS9XZWJDb3JlL3BsYXRmb3JtL2dyYXBoaWNzL2dwdS9jb2NvYS9H UFVDb21wdXRlUGFzc0VuY29kZXJNZXRhbC5tbSBiL1NvdXJjZS9XZWJDb3JlL3BsYXRmb3JtL2dy YXBoaWNzL2dwdS9jb2NvYS9HUFVDb21wdXRlUGFzc0VuY29kZXJNZXRhbC5tbQppbmRleCA3MTNj MWI3OTEwNzVhMDg2YjkwYjMxMzA5OTE0YTQwNWQ2YWZlNjgyLi45ZjkyOTAxYjUzOGE1M2QwNzAz NDQ4NWM2MzUxYzlmOGNiZWQ4NzdhIDEwMDY0NAotLS0gYS9Tb3VyY2UvV2ViQ29yZS9wbGF0Zm9y bS9ncmFwaGljcy9ncHUvY29jb2EvR1BVQ29tcHV0ZVBhc3NFbmNvZGVyTWV0YWwubW0KKysrIGIv U291cmNlL1dlYkNvcmUvcGxhdGZvcm0vZ3JhcGhpY3MvZ3B1L2NvY29hL0dQVUNvbXB1dGVQYXNz RW5jb2Rlck1ldGFsLm1tCkBAIC05Miw2ICs5MiwxMiBAQCB2b2lkIEdQVUNvbXB1dGVQYXNzRW5j b2Rlcjo6ZGlzcGF0Y2godW5zaWduZWQgeCwgdW5zaWduZWQgeSwgdW5zaWduZWQgeikKICAgICAg ICAgcmV0dXJuOwogICAgIH0KIAorICAgIC8vIEZJWE1FOiBSZXN0cmljdCB0aGUgbWF4aW11bSBu dW1iZXIgb2YgdGhyZWFkZ3JvdXBzIHRvIHRoaXMgdm9sdW1lIGZvciBub3csIHRvIHByZXZlbnQg ZXh0ZW5kZWQgRE9TIG9uIG1hY09TLgorICAgIGlmICh4ICogeSAqIHogPiA2NDAwMDAwMCkgewor ICAgICAgICBMT0coV2ViR1BVLCAiR1BVQ29tcHV0ZVBhc3NFbmNvZGVyOjpkaXNwYXRjaCgpOiBU aHJlYWRncm91cCBkaXNwYXRjaCBzaXplIHRvbyBsYXJnZSEiKTsKKyAgICAgICAgcmV0dXJuOwor ICAgIH0KKwogICAgIGF1dG8gcGlwZWxpbmVTdGF0ZSA9IG1fcGlwZWxpbmUtPnBsYXRmb3JtQ29t cHV0ZVBpcGVsaW5lKCk7CiAgICAgQVNTRVJUKHBpcGVsaW5lU3RhdGUpOwogCg==