Re: [Question] fuzz: double-fetches in a memory region map session

2021-08-13 Thread Qiuhao Li
On Fri, 2021-08-13 at 06:50 -0400, Alexander Bulekov wrote: > > > > My question is about address_space_map() -- How do we emulate double- > > fetch > > bugs in the same map/unmap session? For example: > > > > Hi Qiuhao, > Right now we don't. One strategy would be to use mprotect. When the > code

Re: [Question] fuzz: double-fetches in a memory region map session

2021-08-13 Thread Alexander Bulekov
On 210813 0349, Li Qiuhao wrote: > Hi Alex, > > Recently I was reading the DMA call-back functions in the fuzzer. It seems > fuzz_dma_read_cb() is inserted into flatview_read_continue() and > address_space_map() to make the host read changed content between different > DMA actions. > > My questio

[Question] fuzz: double-fetches in a memory region map session

2021-08-12 Thread Li Qiuhao
Hi Alex, Recently I was reading the DMA call-back functions in the fuzzer. It seems fuzz_dma_read_cb() is inserted into flatview_read_continue() and address_space_map() to make the host read changed content between different DMA actions. My question is about address_space_map() -- How do we emula