[PATCH] remoteproc: core: fix integer overflow in rproc_da_to_va() bounds check

[PATCH] remoteproc: core: fix integer overflow in rproc_da_to_va() bounds check

[Atul Akella]

offset is calculated as da - carveout->da and stored in a 32 bit
signed int, while da and carveout->da are both u64. For a
sufficiently small da, the 64bit difference is truncated into the
32 bit int, bypassing the offset < 0 underflow check with a small
positive value. Additionally, offset + len > carveout->len can
itself overflow when offset and len are both large, providing a
second bypass.

Rewrite the bounds check entirely in u64 arithmetic. Reject
underflow before computing offset (da < carveout->da). Replace the
addition-based overflow check with a subtraction-based one
(len > carveout->len - offset) so no intermediate sum can wrap.

Signed-off-by: Atul Akella <atul.akella@gmail.com>
---
 drivers/remoteproc/remoteproc_core.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/drivers/remoteproc/remoteproc_core.c b/drivers/remoteproc/remoteproc_core.c
index 23f8539a99bd..d5fa9d23bd5c 100644
--- a/drivers/remoteproc/remoteproc_core.c
+++ b/drivers/remoteproc/remoteproc_core.c
@@ -198,18 +198,20 @@ void *rproc_da_to_va(struct rproc *rproc, u64 da, size_t len, bool *is_iomem)
 	}
 
 	list_for_each_entry(carveout, &rproc->carveouts, node) {
-		int offset = da - carveout->da;
+		u64 offset;
 
 		/*  Verify that carveout is allocated */
 		if (!carveout->va)
 			continue;
 
 		/* try next carveout if da is too small */
-		if (offset < 0)
+		if (da < carveout->da)
 			continue;
 
-		/* try next carveout if da is too large */
-		if (offset + len > carveout->len)
+		offset = da - carveout->da;
+
+		/* try next carveout if da or len is too large */
+		if (offset > carveout->len || len > carveout->len - offset)
 			continue;
 
 		ptr = carveout->va + offset;
-- 
2.43.0

Re: [PATCH] remoteproc: core: fix integer overflow in rproc_da_to_va() bounds check

[Mathieu Poirier]

On Sat, Oct 31, 2026 at 09:41:30PM +0530, Atul Akella wrote:
> offset is calculated as da - carveout->da and stored in a 32 bit
> signed int, while da and carveout->da are both u64. For a
> sufficiently small da, the 64bit difference is truncated into the
> 32 bit int, bypassing the offset < 0 underflow check with a small
> positive value. Additionally, offset + len > carveout->len can
> itself overflow when offset and len are both large, providing a
> second bypass.
> 
> Rewrite the bounds check entirely in u64 arithmetic. Reject
> underflow before computing offset (da < carveout->da). Replace the
> addition-based overflow check with a subtraction-based one
> (len > carveout->len - offset) so no intermediate sum can wrap.
> 
> Signed-off-by: Atul Akella <atul.akella@gmail.com>
> ---
>  drivers/remoteproc/remoteproc_core.c | 10 ++++++----
>  1 file changed, 6 insertions(+), 4 deletions(-)
>

Applied.

Thanks,
Mathieu
 
> diff --git a/drivers/remoteproc/remoteproc_core.c b/drivers/remoteproc/remoteproc_core.c
> index 23f8539a99bd..d5fa9d23bd5c 100644
> --- a/drivers/remoteproc/remoteproc_core.c
> +++ b/drivers/remoteproc/remoteproc_core.c
> @@ -198,18 +198,20 @@ void *rproc_da_to_va(struct rproc *rproc, u64 da, size_t len, bool *is_iomem)
>  	}
>  
>  	list_for_each_entry(carveout, &rproc->carveouts, node) {
> -		int offset = da - carveout->da;
> +		u64 offset;
>  
>  		/*  Verify that carveout is allocated */
>  		if (!carveout->va)
>  			continue;
>  
>  		/* try next carveout if da is too small */
> -		if (offset < 0)
> +		if (da < carveout->da)
>  			continue;
>  
> -		/* try next carveout if da is too large */
> -		if (offset + len > carveout->len)
> +		offset = da - carveout->da;
> +
> +		/* try next carveout if da or len is too large */
> +		if (offset > carveout->len || len > carveout->len - offset)
>  			continue;
>  
>  		ptr = carveout->va + offset;
> -- 
> 2.43.0
>