From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from fhigh-a7-smtp.messagingengine.com (fhigh-a7-smtp.messagingengine.com [103.168.172.158]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EA1693DD532 for ; Mon, 3 Aug 2026 09:27:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=103.168.172.158 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785749249; cv=none; b=UlH3weYCeIH8GPSkzmjvZFR5eNynCkFPSdmf9es+jOR5OYE9+tmBEL4ruFpKJSouwBIRDshuPRPJU7Isw3ABnujXos3kaWsT/V4+vvt9myq6MzK3KnT6oKw1Mk87Pb7RU8rS95x0PXdNY9jIR/rppyGQ3ZgmcSnwIwUuy9wRKXA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785749249; c=relaxed/simple; bh=+m5wEjS4PRGWLBnskgMT5XPaC5Xo2Trb3SAeh/HPFRQ=; h=MIME-Version:Date:From:To:Cc:Message-Id:In-Reply-To:References: Subject:Content-Type; b=CpvT+uxvc3IOpMVnXgbMxWtP91ApWIpFHaA4KvBa671Hea+RP+BmBca5ncnCmDQ0kYV+1yA7IhDfgIl6oG9L5BkEYMAjaK8G4LsmHVe3at3q2jcnOtkPPdB5hkB6tiSyckdySNIaSfqCqyC50/SE9CIb+0QX2VmTQj+agQj7wWg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=arndb.de; spf=pass smtp.mailfrom=arndb.de; dkim=pass (2048-bit key) header.d=arndb.de header.i=@arndb.de header.b=ipG/IxZG; dkim=pass (2048-bit key) header.d=messagingengine.com header.i=@messagingengine.com header.b=Tj39+J+T; arc=none smtp.client-ip=103.168.172.158 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=arndb.de Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=arndb.de Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=arndb.de header.i=@arndb.de header.b="ipG/IxZG"; dkim=pass (2048-bit key) header.d=messagingengine.com header.i=@messagingengine.com header.b="Tj39+J+T" Received: from ams-compute-02.internal (ams-compute-02.internal [10.64.2.62]) by mailfhigh.phl.internal (Postfix) with ESMTP id 2522814000F2; Mon, 3 Aug 2026 05:27:26 -0400 (EDT) Received: from ams-imap-03 ([10.64.2.23]) by ams-compute-02.internal (MEProxy); Mon, 03 Aug 2026 05:27:26 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=arndb.de; h=cc :cc:content-transfer-encoding:content-type:content-type:date :date:from:from:in-reply-to:in-reply-to:message-id:mime-version :references:reply-to:subject:subject:to:to; s=fm2; t=1785749245; x=1785835645; bh=xyGS6eaC7kXBJ7eBvZz3JFj30b3KwO7szLpnoko6X1E=; b= ipG/IxZGzA1K6cYOwfroq8HOVT5peksJCzMw89J0KRBCfagfQJw/e4F23teBsZar f+jX8ZAGd6xR7qzkxWTwt2nQ048yDlJapa2sd2x1lm0oePvuS1fKeLHee5gt7GWY mPY2umwbeg4/jp1g9MfBt3swRGdDPwniTj5PlyyLUpDiLuQ/KVF5XQ5l4P1orDKF 8jOhDIzDn0tgI/hxvDbmCojDs0ds41Kqg1L88WWVdZSXmGayv9zrhYmrfXrv3dcX gY9H6TmBg1/kACssLY8zhmFk1yPUFbvlTd3+c5Xi6FfD320JU04LMWbQeu5W/2Nu StPlCby4hStS4bwZpl69sQ== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=cc:cc:content-transfer-encoding :content-type:content-type:date:date:feedback-id:feedback-id :from:from:in-reply-to:in-reply-to:message-id:mime-version :references:reply-to:subject:subject:to:to:x-me-proxy :x-me-sender:x-me-sender:x-sasl-enc; s=fm3; t=1785749245; x= 1785835645; bh=xyGS6eaC7kXBJ7eBvZz3JFj30b3KwO7szLpnoko6X1E=; b=T j39+J+TTYRLQ4dfM6eIVKwC82I5vMarfup3W8RbhzYYxbGyqM2ya/+r5b2WCp5pY DIVflgD8y4xf5TRSIxP09dQdYwMPKu2QLsSQqlYwjq8awKpsJjKzC5OUISXY/cK8 r97i5l6cjXaCNhFz9NmBX8NgdzTmsP3ZmMfpTd8p2bF4WUVKpeSJRVYK4+MAPOs+ FEAqtUmZB4kyLQ3DKvk9nzs/UeEDKydoVmsHTekSc5B/nIEsxUq4DIw5N4TeED06 gSLrkpMX3bN8EMxKOK40uLZR/ecyGvCtk50rt3/J5Ji/ZMwgRJVqXVDaUWzOQhKe WigDo7mBPugRhU4guNR/A== X-ME-Sender: X-ME-Proxy-Cause: dmFkZTFytL8YYWcQgRGRPGCIQOj93z806GWJomaSPT2z/JMy6t7fpxoiG7HlzupzsQbzxG hMF3vYLW5Vh1P7ZhQgABFqv9qa5Y5bcfuEoOKq1oUQZBtlcNjR7zJoK2EipZpYttJPKqUE Fby4ZCTmwEYjBqxiiYHIY+PvfjBdKG+7dhdy+QHxPOsY2c+K340N87bv/ZYRL+d0lyk1NT 1j8M4LZs3VZRZFR62r6X3hOTkauvpo7rTg+Osv3KatRK0t43ltNUAIlFuhCoFCqnBt+yiH wqe6Qc8zMZm8AjCnIrVdEv7kHrG4w8de6vP/UDilGvaxoB1PQ7QeNLHXJav21kTrBGL5BQ fV3tiZAnKckZ2z/rb6jIHfCBC0oPg7pddB5zzXQ+oPXS4QcgncjYW7/8kXzim0JtZF8NIR zBrFq6NMeeaLOZPqPwlRZ20qzmLw5SUAsD5PoJUcEhfTg57Iojc1KrXGZj/4Evdjf3gZ9w +9UEoQemKNhHkqRlvHGSHSbgjDHqoF/xZp/o67d03v4HxyXqdpYaFX5QERhLIXQkl35oGm dNEOa4htrxSqcGkxUCu6b69+vmtjz/VisOpaAJLfmh8TyCcTL2iXvBPxz73EDy97n70yuP oyiVG3PyaNy07jvZSBkDNIOlHbv5H3s6PIwIzbpn92yPA3I3s5cB2ebYzU8w X-ME-Proxy: Feedback-ID: i56a14606:Fastmail Received: by mailuser.ams.internal (Postfix, from userid 501) id 7F88E32A0062; Mon, 3 Aug 2026 05:27:19 -0400 (EDT) X-Mailer: MessagingEngine.com Webmail Interface Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-ThreadId: A6UEPfW3F-JV Date: Mon, 03 Aug 2026 11:26:59 +0200 From: "Arnd Bergmann" To: moonafterrain@outlook.com, "Madhavan Srinivasan" , "Michael Ellerman" , "Nicholas Piggin" , "Christophe Leroy" , "Paul Mackerras" , "Alexander Viro" Cc: linuxppc-dev@lists.ozlabs.org, linux-kernel@vger.kernel.org, "Yuhao Jiang" Message-Id: <47d5a769-b247-4eac-9776-71d68cf33b5c@app.fastmail.com> In-Reply-To: <20260802-fixes-v1-6-7368423440f4@outlook.com> References: <20260802-fixes-v1-0-7368423440f4@outlook.com> <20260802-fixes-v1-6-7368423440f4@outlook.com> Subject: Re: [PATCH 6/6] powerpc/spufs: don't hold state_mutex during user access Content-Type: text/plain Content-Transfer-Encoding: 7bit On Sun, Aug 2, 2026, at 17:51, Junrui Luo via B4 Relay wrote: > From: Junrui Luo > > spufs_mbox_read(), spufs_ibox_read() and spufs_wbox_write() take the > context state_mutex with spu_acquire() and only drop it once their > transfer loop has finished, so every put_user()/get_user() in those > loops runs with the mutex held. The faulting address comes from > userspace, so the fault can be made to take arbitrarily long via > userfaultfd region or a FUSE-backed mapping. > > Drop the mutex around the user accesses: acquire it per mailbox element, > just long enough for the ctx->ops mailbox operation, and release it > before touching the user buffer. > > spufs_switch_log_read() has the same problem but its loop needs the lock > for more than just the copy. > > Fixes: cdcc89bb1c6e ("[POWERPC] spufs: make mailbox functions handle > multiple elements") > Reported-by: Yuhao Jiang > Signed-off-by: Junrui Luo I'm not sure if anything relies on the accesses to be atomic, but it does seem unlikely, given that you typically only have a single CPU thread interacting with an spu context. It clearly fixes a bug, so Reviewed-by: Arnd Bergmann Arnd