remoteproc: core: Fix integer overflow in rproc_da_to_va() bounds check

offset is calculated as da - carveout->da and stored in a 32 bit
signed int, while da and carveout->da are both u64. For a
sufficiently small da, the 64bit difference is truncated into the
32 bit int, bypassing the offset < 0 underflow check with a small
positive value. Additionally, offset + len > carveout->len can
itself overflow when offset and len are both large, providing a
second bypass.

Rewrite the bounds check entirely in u64 arithmetic. Reject
underflow before computing offset (da < carveout->da). Replace the
addition-based overflow check with a subtraction-based one
(len > carveout->len - offset) so no intermediate sum can wrap.

Signed-off-by: Atul Akella <atul.akella@gmail.com>
Link: https://lore.kernel.org/r/20261031161131.1647-1-atul.akella@gmail.com
Fixes: 400e64df6b23 ("remoteproc: add framework for controlling remote processors")
Cc: stable@vger.kernel.org
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>

0 files changed, 0 insertions, 0 deletions