[PATCH 0/2] remoteproc: mtk_scp: Fix bounds checks in da_to_va callbacks

[Atul Akella <atul.akella@gmail.com>]

mt8183_scp_da_to_va() and mt8192_scp_da_to_va() validate the device
address and length that the ELF loader passes in from the firmware's
program headers. Both checks can be bypassed through integer truncation
or wraparound. These two patches fix them with overflow-safe comparisons.

The fixes have different origin commits, so they are split for stable
backporting.

Compile tested only (arm64 defconfig, W=1). Not tested on hardware.

Atul Akella (2):
  remoteproc: mtk_scp: Fix bounds check in mt8183_scp_da_to_va()
  remoteproc: mtk_scp: Fix bounds check in mt8192_scp_da_to_va()

 drivers/remoteproc/mtk_scp.c | 32 +++++++++++++++++---------------
 1 file changed, 17 insertions(+), 15 deletions(-)

-- 
2.43.0