From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5A2633C10B6 for ; Sun, 2 Aug 2026 15:51:54 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785685914; cv=none; b=ggOy8ILxhU6YvpVmE0kCPfsRv2nc5d21bH9s3hX2B46MHvw5l/CbjkDoBcfyqXEaTApyAc1MAJMADRK9f0OgXagGYWb7fMS2juGP5qlJiZuCJT9Lo3D6JNFrhveH8WXIvBBHE/asigNlt62L0cZF1VP23Dwty+gdjLACP4cV6lc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785685914; c=relaxed/simple; bh=0/POHxMnwRqE3ITFA8w+z2Q7B0vIwOI/AChWEwTMH/w=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=kAUHlqCpxYa3gAQ33yselMiRCm5VpnZE1o+SvNW8xjPbznF7Swkhi7P5F9CXxrkPHkWCobpopyfwvmiP0KR8N3oMa6mrikG9c0QXCFYZsnHkpqCz3W2+Iw32lo3ezY9fT0D7mgl7LiGCwZMBged3sYDKMgx6U1DfZ9dwA5skhpQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=JmAZZbrD; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="JmAZZbrD" Received: by smtp.kernel.org (Postfix) with ESMTPS id 1831DC32781; Sun, 2 Aug 2026 15:51:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1785685914; bh=0/POHxMnwRqE3ITFA8w+z2Q7B0vIwOI/AChWEwTMH/w=; h=From:Date:Subject:References:In-Reply-To:To:Cc:Reply-To:From; b=JmAZZbrDzPqllK5jsnd1bZx7CNxz2eVk+40V671JTD+jeUiJyrXhrlFs16+P/9Zu9 1NGHnGCNXkzVu5C6H0/OtlXEsTsfZpOpzDtitpU7NIbgKW2olOG/zZ8ALe3wwP9+FK 5k/YGWSjNAd6t2zpCjgpFI+scso/dHW6e0DEppIXYzI3xxQRoudgBQTgCo1RBQjRhm mkZ0KnYazqRt0taCQ+wr6YtMwnGlN1p8y5gOtIbslDdhD7WLAr/a7AbEwzNimG7g10 9FLJ26QdsdYzH5k1dCCVV0hWcqS6tXHlDedYRphpPkgmHLBcM1yLG6n5lePlzEUhig 4NCdLSaa5LC3A== Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 01453C55162; Sun, 2 Aug 2026 15:51:54 +0000 (UTC) From: Junrui Luo via B4 Relay Date: Sun, 02 Aug 2026 23:51:44 +0800 Subject: [PATCH 6/6] powerpc/spufs: don't hold state_mutex during user access Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-Id: <20260802-fixes-v1-6-7368423440f4@outlook.com> References: <20260802-fixes-v1-0-7368423440f4@outlook.com> In-Reply-To: <20260802-fixes-v1-0-7368423440f4@outlook.com> To: Madhavan Srinivasan , Michael Ellerman , Nicholas Piggin , "Christophe Leroy (CS GROUP)" , Paul Mackerras , Arnd Bergmann , Al Viro Cc: linuxppc-dev@lists.ozlabs.org, linux-kernel@vger.kernel.org, Junrui Luo , Yuhao Jiang X-Mailer: b4 0.14.3 X-Developer-Signature: v=1; a=openpgp-sha256; l=4070; i=moonafterrain@outlook.com; h=from:subject:message-id; bh=NzneP8KvCjHXivWs94zRxQBae+0khgOio5T2NiN1ITc=; b=owJ4nJvAy8zAJVb4wiKgu++DA+NptSSGrPz0GVPY35VtNGF5GLi7mJXjXtr053r18pZCaac/T AqX95VZ8aujlIVBjItBVkyR5XjBpW8Wvlt0t/hsSYaZw8oEMoSBi1MAJmJ/nJHhVtznD0tjUoRM 7BfG7bgsvTrR/0rEgo7AhCnbt3w13GSpzcjQPmVuqmqexcbzslnXIhUdl+pfXfjKU3txDWOSztI FLB7MANWBR3s= X-Developer-Key: i=moonafterrain@outlook.com; a=openpgp; fpr=C770D2F6384DB42DB44CB46371E838508B8EF040 X-Endpoint-Received: by B4 Relay for moonafterrain@outlook.com/default with auth_id=909 X-Original-From: Junrui Luo Reply-To: moonafterrain@outlook.com From: Junrui Luo spufs_mbox_read(), spufs_ibox_read() and spufs_wbox_write() take the context state_mutex with spu_acquire() and only drop it once their transfer loop has finished, so every put_user()/get_user() in those loops runs with the mutex held. The faulting address comes from userspace, so the fault can be made to take arbitrarily long via userfaultfd region or a FUSE-backed mapping. Drop the mutex around the user accesses: acquire it per mailbox element, just long enough for the ctx->ops mailbox operation, and release it before touching the user buffer. spufs_switch_log_read() has the same problem but its loop needs the lock for more than just the copy. Fixes: cdcc89bb1c6e ("[POWERPC] spufs: make mailbox functions handle multiple elements") Reported-by: Yuhao Jiang Signed-off-by: Junrui Luo --- arch/powerpc/platforms/cell/spufs/file.c | 52 ++++++++++++++++++-------------- 1 file changed, 29 insertions(+), 23 deletions(-) diff --git a/arch/powerpc/platforms/cell/spufs/file.c b/arch/powerpc/platforms/cell/spufs/file.c index de7494748fec..c8c3b6e8affb 100644 --- a/arch/powerpc/platforms/cell/spufs/file.c +++ b/arch/powerpc/platforms/cell/spufs/file.c @@ -602,13 +602,17 @@ static ssize_t spufs_mbox_read(struct file *file, char __user *buf, if (len < 4) return -EINVAL; - count = spu_acquire(ctx); - if (count) - return count; - for (count = 0; (count + 4) <= len; count += 4, udata++) { int ret; + + ret = spu_acquire(ctx); + if (ret) { + if (!count) + count = ret; + break; + } ret = ctx->ops->mbox_read(ctx, &mbox_data); + spu_release(ctx); if (ret == 0) break; @@ -624,7 +628,6 @@ static ssize_t spufs_mbox_read(struct file *file, char __user *buf, break; } } - spu_release(ctx); if (!count) count = -EAGAIN; @@ -705,29 +708,34 @@ static ssize_t spufs_ibox_read(struct file *file, char __user *buf, count = spu_acquire(ctx); if (count) - goto out; + return count; /* wait only for the first element */ - count = 0; if (file->f_flags & O_NONBLOCK) { if (!spu_ibox_read(ctx, &ibox_data)) { - count = -EAGAIN; - goto out_unlock; + spu_release(ctx); + return -EAGAIN; } } else { count = spufs_wait(ctx->ibox_wq, spu_ibox_read(ctx, &ibox_data)); if (count) - goto out; + return count; } + spu_release(ctx); /* if we can't write at all, return -EFAULT */ count = put_user(ibox_data, udata); if (count) - goto out_unlock; + return count; for (count = 4, udata++; (count + 4) <= len; count += 4, udata++) { int ret; + + ret = spu_acquire(ctx); + if (ret) + break; ret = ctx->ops->ibox_read(ctx, &ibox_data); + spu_release(ctx); if (ret == 0) break; /* @@ -740,9 +748,6 @@ static ssize_t spufs_ibox_read(struct file *file, char __user *buf, break; } -out_unlock: - spu_release(ctx); -out: return count; } @@ -839,40 +844,41 @@ static ssize_t spufs_wbox_write(struct file *file, const char __user *buf, count = spu_acquire(ctx); if (count) - goto out; + return count; /* * make sure we can at least write one element, by waiting * in case of !O_NONBLOCK */ - count = 0; if (file->f_flags & O_NONBLOCK) { if (!spu_wbox_write(ctx, wbox_data)) { - count = -EAGAIN; - goto out_unlock; + spu_release(ctx); + return -EAGAIN; } } else { count = spufs_wait(ctx->wbox_wq, spu_wbox_write(ctx, wbox_data)); if (count) - goto out; + return count; } - + spu_release(ctx); /* write as much as possible */ for (count = 4, udata++; (count + 4) <= len; count += 4, udata++) { int ret; + ret = get_user(wbox_data, udata); if (ret) break; + ret = spu_acquire(ctx); + if (ret) + break; ret = spu_wbox_write(ctx, wbox_data); + spu_release(ctx); if (ret == 0) break; } -out_unlock: - spu_release(ctx); -out: return count; } -- 2.51.2