Closed Bug 1850049 Opened 3 years ago Closed 2 years ago

dx12 UAF destroying the device (webgpu related - Nightly only)

Categories

(Core :: Graphics: WebGPU, defect, P2)

Product:
Core
Component:
Graphics: WebGPU
Type:
defect

Tracking

()

Status:
RESOLVED INCOMPLETE
Tracking Flags:
Tracking Status
firefox-esr102 --- unaffected
firefox-esr115 --- disabled
firefox118 --- disabled
firefox119 --- disabled

People

(Reporter: nical, Assigned: ErichDonGubler)

References

Details

(Keywords: csectype-uaf, sec-high)

What are you seeing in the log that looks like a UAF? or was that a guess based on a "wild pointer" type crash?

Flags: needinfo?(nical.bugzilla)
Keywords: csectype-uaf, sec-high

Yes, that's a wild pointer crash deep in the stack trace of various things getting deallocated so my guess without having delved into it yet is that it might be a UAF.

Flags: needinfo?(nical.bugzilla)
Summary: dx12 UAF destroying the device → dx12 UAF destroying the device (webgpu related - Nightly only)

Erich, could you see if you can reproduce this?

Assignee: nobody → egubler
Flags: needinfo?(egubler)

:jimb: I'll take a look at this sometime in the next month or so, yeah.

Flags: needinfo?(egubler)

:nical: Do we have any STR for this? The log that you provided has expired, and is no longer available.

Flags: needinfo?(nical.bugzilla)

No, it's just something we saw a few times in CI at one point.

Flags: needinfo?(nical.bugzilla)

I don't believe that this bug is actionable, then. Closing for now; I expect we'll see this again in CI, and we'll be able to reopen this and/or file a new issue.

Status: NEW → RESOLVED
Closed: 2 years ago
Resolution: --- → INCOMPLETE
Group: gfx-core-security
You need to log in before you can comment on or make changes to this bug.