[PATCH] riscv: Fix SR_SUM leakage across context switches

[Paul Walmsley]

On Thu, 22 Oct 2026, Yunhui Cui wrote:

> __switch_to() saves the sstatus value of prev and restores the SR_SUM bit
> of next with csrs. However, csrs only sets bits. If prev has SR_SUM set
> and next has SR_SUM clear in its saved state, the old SR_SUM bit remains
> set in sstatus.
> 
> This lets next run with user memory access enabled even though its saved
> SR_SUM state is clear.
> 
> Use csrrc to save the sstatus value of prev and clear SR_SUM from the
> live CSR before restoring the saved SR_SUM state of next. This keeps
> prev's SR_SUM state intact, while preventing it from leaking to next.
> 
> Fixes: 788aa64c01f1 ("riscv: save the SR_SUM status over switches")
> Cc: stable at vger.kernel.org
> Signed-off-by: Yunhui Cui <cuiyunhui at bytedance.com>

Thanks, queued for v7.4-rc.


- Paul