[PATCH 0/4] remoteproc: qcom: Fix DA-to-VA bounds checks

[Atul Akella <atul.akella@gmail.com>]

This series fixes the same bounds check bug in da_to_va() across four
Qualcomm remoteproc PIL drivers: qcom_q6v5_adsp, qcom_q6v5_pas,
qcom_q6v5_wcss, and qcom_wcnss.

In each driver, offset is a signed 32bit integer assigned from
the 64 bit difference da - <base>, where both operands are u64.
If da is smaller than <base>, the subtraction underflows before
the result is truncated on assignment. This can produce a small
positive offset and bypass the existing underflow check.
Separately, the offset + len bounds check can overflow.

da and len originate from firmware ELF program headers
(p_paddr and p_memsz) via rproc_da_to_va(). The returned
address is used by the ELF loader to write firmware segments, so a
malformed firmware image can cause writes outside the carveout.

Each patch keeps offset in u64, rejects addresses below the
relocation base before subtraction, and uses a subtraction based
bounds check to avoid overflow.

Atul Akella (4):
  remoteproc: qcom: Fix bounds check in adsp_da_to_va()
  remoteproc: qcom: Fix bounds check in qcom_pas_da_to_va()
  remoteproc: qcom: Fix bounds check in q6v5_wcss_da_to_va()
  remoteproc: qcom: Fix bounds check in wcnss_da_to_va()

 drivers/remoteproc/qcom_q6v5_adsp.c | 6 ++++--
 drivers/remoteproc/qcom_q6v5_pas.c  | 6 ++++--
 drivers/remoteproc/qcom_q6v5_wcss.c | 6 ++++--
 drivers/remoteproc/qcom_wcnss.c     | 6 ++++--
 4 files changed, 16 insertions(+), 8 deletions(-)

-- 
2.43.0