Re: [PATCH 6/6] powerpc/spufs: don't hold state_mutex during user access

On Sun, Aug 2, 2026, at 17:51, Junrui Luo via B4 Relay wrote:

From: Junrui Luo <redacted>

spufs_mbox_read(), spufs_ibox_read() and spufs_wbox_write() take the
context state_mutex with spu_acquire() and only drop it once their
transfer loop has finished, so every put_user()/get_user() in those
loops runs with the mutex held. The faulting address comes from
userspace, so the fault can be made to take arbitrarily long via
userfaultfd region or a FUSE-backed mapping.

Drop the mutex around the user accesses: acquire it per mailbox element,
just long enough for the ctx->ops mailbox operation, and release it
before touching the user buffer.

spufs_switch_log_read() has the same problem but its loop needs the lock
for more than just the copy.

Fixes: cdcc89bb1c6e ("[POWERPC] spufs: make mailbox functions handle 
multiple elements")
Reported-by: Yuhao Jiang <redacted>
Signed-off-by: Junrui Luo <redacted>

I'm not sure if anything relies on the accesses to be atomic,
but it does seem unlikely, given that you typically only
have a single CPU thread interacting with an spu context.

It clearly fixes a bug, so

Reviewed-by: Arnd Bergmann <arnd@arndb.de>

      Arnd