Six independent fixes for spufs. There is no dependency between them,
so they can be applied or dropped individually.
1/6 spufs_coredump_extra_notes_write() never drops the reference taken
by coredump_next_context(), so every SPE context written into a
core dump leaks a spu_context. The matching ..._size() path gets
this right.
2/6 do_spu_run() copies out an uninitialized 'status' on the paths
where spufs_run_spu() returns before assigning it, leaking four
bytes of kernel stack to userspace.
3/6 spu_process_callback() only aligns the NPC value, never bounds it,
before using it as an offset into the local store. The register is
userspace-controlled, so the following in_be32() can be driven far
past the 256K mapping.
4/6 spufs_setattr() calls setattr_copy() without setattr_prepare().
notify_change() leaves that check to the filesystem, so mode and
ownership of a context's files can be changed without the usual
authorization.
5/6 spufs_create_gang() calls unuse_gang() with the parent directory's
i_rwsem held for write, and the resulting simple_recursive_removal()
takes it again as I_MUTEX_CHILD. The task deadlocks against itself
and leaves the spufs directory write-locked.
6/6 The mailbox read/write handlers hold ctx->state_mutex across
put_user()/get_user(), so a userfaultfd region or FUSE-backed user
buffer can stall the context lock for an arbitrary time.
Patches 1-5 are tagged for stable. 6/6 is deliberately not: it changes the
atomicity of multi-element mailbox transfers rather than just adding a
check, so it seems better to let it soak in mainline first.
Build-tested only. I have no Cell or PS3 hardware, so none of this has
been exercised at runtime.
Signed-off-by: Junrui Luo <[email protected]>
---
Junrui Luo (6):
powerpc/spufs: fix spu_context leak in coredump
powerpc/spufs: don't leak kernel stack via spu_run
powerpc/spufs: bound NPC against local store size
powerpc/spufs: check permissions in spufs_setattr()
powerpc/spufs: fix deadlock on gang creation failure
powerpc/spufs: don't hold state_mutex during user access
arch/powerpc/platforms/cell/spufs/coredump.c | 6 +++-
arch/powerpc/platforms/cell/spufs/file.c | 52 ++++++++++++++++------------
arch/powerpc/platforms/cell/spufs/inode.c | 21 +++++++----
arch/powerpc/platforms/cell/spufs/run.c | 2 ++
arch/powerpc/platforms/cell/spufs/syscalls.c | 2 +-
5 files changed, 52 insertions(+), 31 deletions(-)
---
base-commit: 02dc699f83d04069fdabc996fc22d47cda47a4a9
change-id: 20260802-fixes-f33361c1b2ae
Best regards,
--
Junrui Luo <[email protected]>
