Re: [PATCH] powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access()

[Madhavan Srinivasan]

On Mon, 01 Jun 2026 15:50:00 +0800, Junrui Luo wrote:
> spufs_mem_mmap_access() computes the local store offset as
> address - vma->vm_start, but bounds-checks it against vma->vm_end
> instead of the local store size. On 64-bit, offset is always well
> below vma->vm_end, so the clamp never fires and len stays unbounded
> against the LS_SIZE buffer returned by ctx->ops->get_ls().
> 
> Reject offsets at or beyond LS_SIZE and clamp len to the remaining
> space, mirroring the guard already used by spufs_mem_mmap_fault() and
> spufs_ps_fault().
> 
> [...]

Applied to powerpc/fixes.

[1/1] powerpc/spufs: fix out-of-bounds access in spufs_mem_mmap_access()
      https://git.kernel.org/powerpc/c/47b87f469a35b5ffc81c16eee6b13a9b6c8d55c6

cheers