Heap-use-after-free through double-fetch in ehci

Bug #1892761 reported by Alexander Bulekov
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
QEMU
Undecided
Unassigned

Bug Description

Hello,
I don't have a qtest reproducer for this crash because it involves a DMA double-fetch, and I don't think we can reproduce those with qtest.

Instead, I attached the pseudo-qtest trace produced by the fuzzer, along with some trace events.
The lines annotated with [DMA] are write commands that were triggered by a callback from a DMA read by the device. The lines annotated with [DOUBLE-FETCH] are DMA accesses that hit the same address more than once (possible double-fetches).

I am still thinking of nicer ways of presenting this trace and providing a reproducer.
-Alex

Revision history for this message
Alexander Bulekov (a1xndr) wrote :
Revision history for this message
Thomas Huth (th-huth) wrote :

Hi Alexander! Have you ever been able to create a reproducer for this problem?

Changed in qemu:
status: New → Incomplete
Revision history for this message
Alexander Bulekov (a1xndr) wrote :

No. If we figure out some way to consistently reproduce double-fetches in a non-fuzzer build, I'll report the issue again, but this can probably be closed

Revision history for this message
Thomas Huth (th-huth) wrote :

Ok, let's close this one since it was not reproducible. If you find a reproducer, please open a new ticket in the gitlab tracker instead.

Changed in qemu:
status: Incomplete → Won't Fix
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers

Bug attachments