Re: [PATCH 7/9] EDAC/versalnet: Add bounds validation in rpmsg_cb()

[Pandey, Radhey Shyam]

On 7/24/2026 10:49 PM, Shubhrajyoti Datta wrote:
> The firmware-supplied offset and length values from the RPMsg payload
> are used without validation to index into mc_priv->regs[] (REG_MAX=152
> entries). A malformed or buggy firmware message could write past the end
> of the array, corrupting adjacent structure members and the kernel heap.
> Add check for the same.
>
> Signed-off-by: Shubhrajyoti Datta <shubhrajyoti.datta@xxxxxxx>
> ---
>
>   drivers/edac/versalnet_edac.c | 3 +++
>   1 file changed, 3 insertions(+)
>
> diff --git a/drivers/edac/versalnet_edac.c b/drivers/edac/versalnet_edac.c
> index e9561242f292..baca90f44c58 100644
> --- a/drivers/edac/versalnet_edac.c
> +++ b/drivers/edac/versalnet_edac.c
> @@ -602,6 +602,9 @@ static int rpmsg_cb(struct rpmsg_device *rpdev, void *data,
>   	length = result[MSG_ERR_LENGTH];
>   	offset = result[MSG_ERR_OFFSET];
>   
> +	if (offset + length > REG_MAX)
> +		return -EINVAL;
> +

Nit - Integer overflow on offset + length

>   	/*
>   	 * The data can come in two stretches. Construct the regs from two
>   	 * messages. The offset indicates the offset from which the data is to