spufs_arch_write_note() positions the next coredump note with
dump_skip_to(cprm, roundup(cprm->pos - ret + sz, 4));
where sz is the note's declared spufs_coredump_read[].size and ret is the
number of bytes the dump callback actually emitted. It also stores sz in
en.n_descsz and reserves roundup(sz, 4) bytes in spufs_ctx_note_size().
Three entries declare sizeof(u32) but their dump callbacks emit a u64:
- "signal1"/"signal2" emit sizeof(ctx->csa.spu_chnldata_RW[n]), and
spu_chnldata_RW is u64;
- "ibox_info" emits sizeof(ctx->csa.priv2.puint_mb_R), and puint_mb_R
is u64.
The mismatch only bites when the dump emits data: each callback returns 0
unless a signal/mailbox entry is pending. When one is present ret (8)
exceeds sz (4), so roundup(cprm->pos - ret + sz, 4) lands *before*
cprm->pos and dump_skip_to() computes a size_t to_skip that underflows to
nearly SIZE_MAX. The following dump_emit() then fails, truncating the core
dump on a regular file (or, on a pipe, zero-filling up to RLIMIT_CORE
before aborting). n_descsz is likewise understated, and
spufs_ctx_note_size() under-reserves the note by four bytes.
Declare these three notes as sizeof(u64) to match what the callbacks emit.
For signal1/signal2 this is also what the runtime read returns; ibox_info's
puint_mb_R is a genuine u64 field, so its 8-byte dump is in-bounds (its file
exposes only the low u32). "mbox_info" (pu_mb_R, u32) and "wbox_info" (emits
at most its declared 4 * sizeof(u32) and pads forward) are already
consistent and left unchanged.
Fixes: 5456ffdee666 ("powerpc/spufs: simplify spufs core dumping")
Reported-by: Yuhao Jiang <[email protected]>
Assisted-by: Claude:claude-opus-5
Cc: [email protected]
Signed-off-by: Zhenhao Wan <[email protected]>
---
arch/powerpc/platforms/cell/spufs/file.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/arch/powerpc/platforms/cell/spufs/file.c
b/arch/powerpc/platforms/cell/spufs/file.c
index 8c7515140efb..7d8c733ccac0 100644
--- a/arch/powerpc/platforms/cell/spufs/file.c
+++ b/arch/powerpc/platforms/cell/spufs/file.c
@@ -2588,14 +2588,14 @@ const struct spufs_coredump_reader
spufs_coredump_read[] = {
{ "decr", NULL, spufs_decr_get, 19 },
{ "decr_status", NULL, spufs_decr_status_get, 19 },
{ "mem", spufs_mem_dump, NULL, LS_SIZE, },
- { "signal1", spufs_signal1_dump, NULL, sizeof(u32) },
+ { "signal1", spufs_signal1_dump, NULL, sizeof(u64) },
{ "signal1_type", NULL, spufs_signal1_type_get, 19 },
- { "signal2", spufs_signal2_dump, NULL, sizeof(u32) },
+ { "signal2", spufs_signal2_dump, NULL, sizeof(u64) },
{ "signal2_type", NULL, spufs_signal2_type_get, 19 },
{ "event_mask", NULL, spufs_event_mask_get, 19 },
{ "event_status", NULL, spufs_event_status_get, 19 },
{ "mbox_info", spufs_mbox_info_dump, NULL, sizeof(u32) },
- { "ibox_info", spufs_ibox_info_dump, NULL, sizeof(u32) },
+ { "ibox_info", spufs_ibox_info_dump, NULL, sizeof(u64) },
{ "wbox_info", spufs_wbox_info_dump, NULL, 4 * sizeof(u32)},
{ "dma_info", spufs_dma_info_dump, NULL, sizeof(struct spu_dma_info)},
{ "proxydma_info", spufs_proxydma_info_dump,
--
2.34.1
