Re: [PATCH 2/6] powerpc/spufs: don't leak kernel stack via spu_run
From: "Arnd Bergmann" <arnd@arndb.de>
Date: 2026-08-03 09:09:48
Also in:
lkml, stable
On Sun, Aug 2, 2026, at 17:51, Junrui Luo via B4 Relay wrote:
Initialize status to 0, which is what userspace would have observed had
the assignment been reached anyway: spufs_run_spu() resets
ctx->event_return to 0 on entry, and 0 is the "no events pending" value
for this word.
Fixes: 67207b9664a8 ("[PATCH] spufs: The SPU file system, base")
Reported-by: Yuhao Jiang <redacted>
Cc: stable@vger.kernel.org
Signed-off-by: Junrui Luo <redacted>Reviewed-by: Arnd Bergmann <arnd@arndb.de>
quoted hunk ↗ jump to hunk
@@ -37,7 +37,7 @@ static long do_spu_run(struct file *filp, { long ret; struct spufs_inode_info *i; - u32 npc, status; + u32 npc, status = 0; ret = -EFAULT; if (get_user(npc, unpc))
I think I would prefer skipping the broken put_user() in case
of an error, but your version also works.
Arnd