Re: [PATCH 0/2] remoteproc: mtk_scp: Fix bounds checks in da_to_va callbacks

[Mathieu Poirier <mathieu.poirier@linaro.org>]

On Mon, Oct 05, 2026 at 11:25:16AM +0000, Atul Akella wrote:
> mt8183_scp_da_to_va() and mt8192_scp_da_to_va() validate the device
> address and length that the ELF loader passes in from the firmware's
> program headers. Both checks can be bypassed through integer truncation
> or wraparound. These two patches fix them with overflow-safe comparisons.
> 
> The fixes have different origin commits, so they are split for stable
> backporting.
> 
> Compile tested only (arm64 defconfig, W=1). Not tested on hardware.
> 
> Atul Akella (2):
>   remoteproc: mtk_scp: Fix bounds check in mt8183_scp_da_to_va()
>   remoteproc: mtk_scp: Fix bounds check in mt8192_scp_da_to_va()
> 
>  drivers/remoteproc/mtk_scp.c | 32 +++++++++++++++++---------------
>  1 file changed, 17 insertions(+), 15 deletions(-)

I will apply this set when 7.4-rc1 comes out.

Thanks,
Mathieu

> 
> -- 
> 2.43.0
> 
>