Three independent bugs in the Cell/PS3 spufs driver's file and coredump
paths, found by code inspection. The patches are self-contained and have no
ordering dependency.
1/3 spufs_create_context() drops the gang->alive reference on the success
path -- the epilogue tests a value that is a file descriptor on success
-- so the gang directory can be torn down while contexts still
reference it.
2/3 On 4K-page configs the cntl mmap fault handler dereferences
file->private_data as a struct spu_context, but simple_attr_open() has
replaced it with its own object -- a type confusion. Fetch the context
from the inode instead.
3/3 The signal1/signal2/ibox_info coredump notes declare a 4-byte
descriptor while their dump callbacks emit an 8-byte u64, driving
dump_skip_to() backwards (size_t underflow) and truncating the core
dump. Declare the sizes to match what is emitted.
SPU FILE SYSTEM and CELL BROADBAND ENGINE are marked Orphan in MAINTAINERS,
so this is addressed to the powerpc maintainers and linuxppc-dev. A
concurrent spufs fix series from Junrui Luo is in flight; these patches
touch different sites and do not overlap it. Found by inspection; not build-
or runtime-tested here.
Signed-off-by: Zhenhao Wan <[email protected]>
---
Zhenhao Wan (3):
powerpc/spufs: fix gang->alive double-decrement on context creation
powerpc/spufs: fix type confusion in cntl mmap fault handler
powerpc/spufs: fix backwards coredump skip from undersized notes
arch/powerpc/platforms/cell/spufs/file.c | 8 ++++----
arch/powerpc/platforms/cell/spufs/inode.c | 2 +-
2 files changed, 5 insertions(+), 5 deletions(-)
---
base-commit: db2ddb87143519e20a95aa36c60b36107b736a58
change-id: 20260814-spufs-groupa-6246fe77de7a
Best regards,
--
Zhenhao Wan <[email protected]>
