mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
From: Paul Walmsley <pjw@kernel.org>
To: Yunhui Cui <cuiyunhui@bytedance.com>
Cc: pjw@kernel.org, palmer@dabbelt.com, aou@eecs.berkeley.edu,
	alex@ghiti.fr,  zong.li@sifive.com, wangruikang@iscas.ac.cn,
	debug@rivosinc.com,  qirui.001@bytedance.com,
	guoziyi114@gmail.com, samuel.holland@sifive.com,
	 ben.dooks@codethink.co.uk, cyrilbur@tenstorrent.com,
	 linux-riscv@lists.infradead.org, linux-kernel@vger.kernel.org,
	 stable@vger.kernel.org
Subject: Re: [PATCH] riscv: Fix SR_SUM leakage across context switches
Date: Wed, 4 Nov 2026 01:57:47 -0700 (MST)	[thread overview]
Message-ID: <c970ab41-a425-ce36-f801-cb6af00c7cc1@kernel.org> (raw)
In-Reply-To: <20261022083212.84721-1-cuiyunhui@bytedance.com>

On Thu, 22 Oct 2026, Yunhui Cui wrote:

> __switch_to() saves the sstatus value of prev and restores the SR_SUM bit
> of next with csrs. However, csrs only sets bits. If prev has SR_SUM set
> and next has SR_SUM clear in its saved state, the old SR_SUM bit remains
> set in sstatus.
> 
> This lets next run with user memory access enabled even though its saved
> SR_SUM state is clear.
> 
> Use csrrc to save the sstatus value of prev and clear SR_SUM from the
> live CSR before restoring the saved SR_SUM state of next. This keeps
> prev's SR_SUM state intact, while preventing it from leaking to next.
> 
> Fixes: 788aa64c01f1 ("riscv: save the SR_SUM status over switches")
> Cc: stable@vger.kernel.org
> Signed-off-by: Yunhui Cui <cuiyunhui@bytedance.com>

Thanks, queued for v7.4-rc.


- Paul

      parent reply	other threads:[~2026-11-04  8:57 UTC|newest]

Thread overview: 8+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-10-22  8:32 Yunhui Cui
2026-10-22 11:08 ` Jisheng Zhang
2026-10-22 22:19 ` Andy Chiu
2026-10-23  7:59   ` Ben Dooks
2026-10-23 14:50   ` [External] " yunhui cui
2026-10-26 20:26     ` Andy Chiu
2026-11-04  8:05 ` [PATCH] " Yicong Yang
2026-11-04  8:57 ` Paul Walmsley [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=c970ab41-a425-ce36-f801-cb6af00c7cc1@kernel.org \
    --to=pjw@kernel.org \
    --cc=alex@ghiti.fr \
    --cc=aou@eecs.berkeley.edu \
    --cc=ben.dooks@codethink.co.uk \
    --cc=cuiyunhui@bytedance.com \
    --cc=cyrilbur@tenstorrent.com \
    --cc=debug@rivosinc.com \
    --cc=guoziyi114@gmail.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-riscv@lists.infradead.org \
    --cc=palmer@dabbelt.com \
    --cc=qirui.001@bytedance.com \
    --cc=samuel.holland@sifive.com \
    --cc=stable@vger.kernel.org \
    --cc=wangruikang@iscas.ac.cn \
    --cc=zong.li@sifive.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®