Re: [PATCH 6/6] powerpc/spufs: don't hold state_mutex during user access

[Arnd Bergmann]

On Sun, Aug 2, 2026, at 17:51, Junrui Luo via B4 Relay wrote:
> From: Junrui Luo <moonafterrain@xxxxxxxxxxx>
>
> spufs_mbox_read(), spufs_ibox_read() and spufs_wbox_write() take the
> context state_mutex with spu_acquire() and only drop it once their
> transfer loop has finished, so every put_user()/get_user() in those
> loops runs with the mutex held. The faulting address comes from
> userspace, so the fault can be made to take arbitrarily long via
> userfaultfd region or a FUSE-backed mapping.
>
> Drop the mutex around the user accesses: acquire it per mailbox element,
> just long enough for the ctx->ops mailbox operation, and release it
> before touching the user buffer.
>
> spufs_switch_log_read() has the same problem but its loop needs the lock
> for more than just the copy.
>
> Fixes: cdcc89bb1c6e ("[POWERPC] spufs: make mailbox functions handle 
> multiple elements")
> Reported-by: Yuhao Jiang <danisjiang@xxxxxxxxx>
> Signed-off-by: Junrui Luo <moonafterrain@xxxxxxxxxxx>

I'm not sure if anything relies on the accesses to be atomic,
but it does seem unlikely, given that you typically only
have a single CPU thread interacting with an spu context.

It clearly fixes a bug, so

Reviewed-by: Arnd Bergmann <arnd@xxxxxxxx>

      Arnd