[6] GPU process dangling reference via MarkSurfacesVolatile during prepareBufferForDisplay

Severity: High | Component: GPU Process RemoteRenderingBackend | 325e4cb

Rated High because the observable effect is a dangling reference to a destroyed graphics context in the GPU process — which runs outside the WebContent sandbox — triggered by a reproducible IPC message sequence from a compromised WebProcess, with the attack scenario confirmed by the regression test.

The WebProcess can send MarkSurfacesVolatile while prepareBufferForDisplay is still active on the GPU Process. This calls releaseGraphicsContext() on each image buffer, destroying the graphics context that prepareBufferForDisplay is actively using through m_context.

Source/WebKit/GPUProcess/graphics/RemoteImageBufferSet.h

Source/WebKit/GPUProcess/graphics/RemoteRenderingBackend.cpp

LayoutTests/ipc/mark-surfaces-volatile-during-prepare-for-display.html

Patch Details

The fix adds a MESSAGE_CHECK guard in RemoteRenderingBackend::markSurfacesVolatile that rejects the IPC message when the target RemoteImageBufferSet is currently preparing for display. The check uses a new isPreparingForDisplay() accessor which returns whether m_context is non-null. MESSAGE_CHECK terminates the offending WebContent process on failure.

Missing IPC message ordering validation allows a resource lifetime to be terminated while an operation consuming that resource is still in flight.

Background

WebKit's GPU process architecture separates rendering operations into a dedicated GPU process. The WebProcess communicates with the GPU process over IPC stream connections. RemoteImageBufferSet manages a set of image buffers (front/back) used for compositing. prepareBufferForDisplay initializes the front buffer's contents using a graphics context stored in m_context. makeBuffersVolatile marks buffers as reclaimable by the OS and calls releaseGraphicsContext() to destroy the associated context. MESSAGE_CHECK is WebKit's IPC validation macro — when a check fails, the GPU process terminates the offending WebContent process, enforcing IPC contracts between processes.

Analysis

Before the fix, RemoteRenderingBackend::markSurfacesVolatile did not check whether the target RemoteImageBufferSet was actively being used by prepareBufferForDisplay. When the WebProcess sends MarkSurfacesVolatile while prepareBufferForDisplay is still active, makeBuffersVolatile() calls releaseGraphicsContext(), destroying the graphics context held in m_context (as the commit message confirms: "MarkSurfacesVolatile calls makeBuffersVolatile, which calls releaseGraphicsContext() on each image buffer — destroying the graphics context that prepareBufferForDisplay is actively using through m_context"). The prepareBufferForDisplay code path continues to use m_context after this destruction, producing a dangling reference.

Audit directions