From: Steven Rostedt <rostedt@goodmis.org>
To: sashiko-bot@kernel.org
Cc: sashiko-reviews@lists.linux.dev,
"Vincent Donnefort" <vdonnefort@google.com>,
linux-trace-kernel@vger.kernel.org
Subject: Re: [PATCH v10 1/4] ring-buffer: Allow splice reads on static buffers
Date: Fri, 4 Sep 2026 13:12:05 -0400 [thread overview]
Message-ID: <20260904131149.7f3bdc14@gandalf.local.home> (raw)
In-Reply-To: <20260904170107.812081F00A3D@smtp.kernel.org>
On Fri, 04 Sep 2026 17:01:07 +0000
sashiko-bot@kernel.org wrote:
> If a malicious remote writer (such as an untrusted guest VM) modifies the
> length fields in shared memory between the initial check and the memcpy(),
> can event_size become arbitrarily large?
>
> Could this bypass the bounds check and cause an out-of-bounds read from
> rpage->data and a massive out-of-bounds write to dpage->data?
I don't think Sashiko knows that a remote writer isn't a guest. Well that's
not the normal case. But the trusted hypervisor that we control.
-- Steve
next prev parent reply other threads:[~2026-09-04 17:11 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-04 16:44 [PATCH v10 0/4] ring-buffer: Fixes for subbuf resizing and persistent buffers Vincent Donnefort
2026-09-04 16:44 ` [PATCH v10 1/4] ring-buffer: Allow splice reads on static buffers Vincent Donnefort
2026-09-04 17:01 ` sashiko-bot
2026-09-04 17:12 ` Steven Rostedt [this message]
2026-09-04 16:44 ` [PATCH v10 2/4] tracing: Fix subbuf resize races with trace_pipe_raw readers Vincent Donnefort
2026-09-04 18:35 ` Steven Rostedt
2026-09-04 18:41 ` Steven Rostedt
2026-09-04 16:44 ` [PATCH v10 3/4] ring-buffer: Cap static ring buffer nr_pages Vincent Donnefort
2026-09-04 17:04 ` sashiko-bot
2026-09-04 16:44 ` [PATCH v10 4/4] ring-buffer: Prevent truncation of nr_pages / nr_subbufs Vincent Donnefort
2026-09-04 17:00 ` sashiko-bot
2026-09-04 18:11 ` [PATCH v10 0/4] ring-buffer: Fixes for subbuf resizing and persistent buffers Steven Rostedt
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260904131149.7f3bdc14@gandalf.local.home \
--to=rostedt@goodmis.org \
--cc=linux-trace-kernel@vger.kernel.org \
--cc=sashiko-bot@kernel.org \
--cc=sashiko-reviews@lists.linux.dev \
--cc=vdonnefort@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox