powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access()

spufs_mem_mmap_access() computes the local store offset as
address - vma->vm_start, but bounds-checks it against vma->vm_end
instead of the local store size. On 64-bit, offset is always well
below vma->vm_end, so the clamp never fires and len stays unbounded
against the LS_SIZE buffer returned by ctx->ops->get_ls().

Reject offsets at or beyond LS_SIZE and clamp len to the remaining
space, mirroring the guard already used by spufs_mem_mmap_fault() and
spufs_ps_fault().

Fixes: a352894d0705 ("spufs: use new vm_ops->access to allow local state access from gdb")
Reported-by: Yuhao Jiang <danisjiang@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Junrui Luo <moonafterrain@outlook.com>
Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com>
Link: https://patch.msgid.link/SYBPR01MB7881EE775E8B51C09F5A29E7AF152@SYBPR01MB7881.ausprd01.prod.outlook.com

diff --git a/arch/powerpc/platforms/cell/spufs/file.c b/arch/powerpc/platforms/cell/spufs/file.c
index f6de8c1169d5bfc794c6cca535cf29c7fd417610..de7494748fecd673dc9aadffe86a0e87bdcb0363 100644 (file)
--- a/arch/powerpc/platforms/cell/spufs/file.c
+++ b/arch/powerpc/platforms/cell/spufs/file.c
@@ -268,10 +268,12 @@ static int spufs_mem_mmap_access(struct vm_area_struct *vma,
 
        if (write && !(vma->vm_flags & VM_WRITE))
                return -EACCES;
+       if (offset >= LS_SIZE)
+               return -EFAULT;
        if (spu_acquire(ctx))
                return -EINTR;
-       if ((offset + len) > vma->vm_end)
-               len = vma->vm_end - offset;
+       if ((offset + len) > LS_SIZE)
+               len = LS_SIZE - offset;
        local_store = ctx->ops->get_ls(ctx);
        if (write)
                memcpy_toio(local_store + offset, buf, len);