Skip to content

snp: validate launch update return range - #417

Draft
brongan wants to merge 1 commit into
virtee:mainfrom
brongan:fix-launch-update-aliasing
Draft

brongan wants to merge 1 commit into
virtee:mainfrom
brongan:fix-launch-update-aliasing

Conversation

@brongan

@brongan brongan commented Nov 11, 2026 •

Copy link
Copy Markdown

Pass the launch update request to the kernel as a mutable reference. Verify that the returned memory range stays within the input buffer. Reject ranges outside the buffer with an error.

The kernel writes back into the launch update request through a shared reference, which causes undefined behavior. The code then used the range returned by the kernel without a bounds check.

@brongan
brongan force-pushed the fix-launch-update-aliasing branch 2 times, most recently from 87fa3df to 0843195 Compare November 12, 2026 19:30
@brongan brongan changed the title snp: pass launch update data to the kernel as mutable snp: validate launch update buffer range Nov 12, 2026
@brongan
brongan force-pushed the fix-launch-update-aliasing branch from 0843195 to 5dec1db Compare November 12, 2026 19:37
@brongan brongan changed the title snp: validate launch update buffer range snp: validate launch update return range Nov 12, 2026
Pass the launch update request to the kernel as a mutable reference.
Verify that the returned memory range stays within the input buffer.
Reject ranges outside the buffer with an error.

The kernel writes back into the launch update request through a shared
reference, which causes undefined behavior. The code then used the range
returned by the kernel without a bounds check.

Signed-off-by: Brennan Tracy <[email protected]>
@brongan
brongan force-pushed the fix-launch-update-aliasing branch from 5dec1db to 5ed814f Compare November 13, 2026 19:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant