Branch: refs/heads/main
Home: https://github.com/WebKit/WebKit
Commit: 866892a3052f6739cffd35175d93b0d238091b29
https://github.com/WebKit/WebKit/commit/866892a3052f6739cffd35175d93b0d238091b29
Author: Eric Carlson <[email protected]>
Date: 2026-07-01 (Wed, 01 Jul 2026)
Changed paths:
A LayoutTests/ipc/usermedia-capture-start-producing-data-race-expected.txt
A LayoutTests/ipc/usermedia-capture-start-producing-data-race.html
M LayoutTests/platform/glib/TestExpectations
M Source/WebKit/GPUProcess/webrtc/UserMediaCaptureManagerProxy.cpp
Log Message:
-----------
[CoreIPC][GPUProcess] UserMediaCaptureManagerProxy::startProducingData races
prepareAudioDescription() against audioSamplesAvailable() lead to various
UAF/write-after-unmap
https://bugs.webkit.org/show_bug.cgi?id=314115
rdar://174411400
Reviewed by Youenn Fablet and Jer Noble.
A compromised WebContent process can send StartProducingData repeatedly
for the same source. After the first call, the source proxy is registered
as an AudioSampleObserver and the capture unit is invoking
audioSamplesAvailable() on a background WorkQueue. On subsequent calls,
prepareAudioDescription() runs on the GPU main thread and reassigns
m_captureSemaphore, m_ringBuffer, m_audioHandle and m_description without
removing the observer or taking any lock, while the capture thread is
concurrently dereferencing them. This leads to heap-use-after-free on the
freed ProducerSharedCARingBuffer / IPC::Semaphore and write-after-unmap
into the old SharedMemory ring buffer.
Make UserMediaCaptureManagerProxySourceProxy::start() a no-op when the
proxy is already observing media. Legitimate stop()/start() sequences are
unaffected since stop() removes the observer.
Test: ipc/usermedia-capture-start-producing-data-race.html
* LayoutTests/ipc/usermedia-capture-start-producing-data-race-expected.txt:
Added.
* LayoutTests/ipc/usermedia-capture-start-producing-data-race.html: Added.
* LayoutTests/platform/glib/TestExpectations:
* Source/WebKit/GPUProcess/webrtc/UserMediaCaptureManagerProxy.cpp:
Originally-landed-as: 305413.863@safari-7624-branch (651097467a79).
rdar://180438398
Canonical link: https://commits.webkit.org/316261@main
To unsubscribe from these emails, change your notification settings at
https://github.com/WebKit/WebKit/settings/notifications
