blob: ece5485a4d31b4c1086a938e05d4dbb4513f4591 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
|
Heap-use-after-free through double-fetch in ehci
Hello,
I don't have a qtest reproducer for this crash because it involves a DMA double-fetch, and I don't think we can reproduce those with qtest.
Instead, I attached the pseudo-qtest trace produced by the fuzzer, along with some trace events.
The lines annotated with [DMA] are write commands that were triggered by a callback from a DMA read by the device. The lines annotated with [DOUBLE-FETCH] are DMA accesses that hit the same address more than once (possible double-fetches).
I am still thinking of nicer ways of presenting this trace and providing a reproducer.
-Alex
|