cxl/test: Fix integer overflow in mock LSA bounds checks

Pre-existing issue discovered by sashiko-bot.

mock_get_lsa() and mock_set_lsa() validate the requested LSA range with
"offset + length > LSA_SIZE". Both offset and length are u32 and, in
mock_get_lsa(), both are taken directly from the user-supplied payload.
The addition is evaluated modulo 2^32, so a large offset combined with a
small length wraps around and passes the check.

Rewrite the checks to first bound offset, then compare length against the
remaining LSA size.

Suggested-by: sashiko-bot
Fixes: 7d3eb23c4ccf ("tools/testing/cxl: Introduce a mock memory device + driver")
Link: https://lore.kernel.org/linux-cxl/20260605143748.235271F00893@smtp.kernel.org/
Assisted-by: Claude:claude-opus-4-8
Reviewed-by: Alison Schofield <alison.schofield@intel.com>
Signed-off-by: Dave Jiang <dave.jiang@intel.com>

diff --git a/tools/testing/cxl/test/mem.c b/tools/testing/cxl/test/mem.c
index 2e9a5f151e983dd8e56aa9000a529561fa2eebc3..9a7cd3f46a1ee53f1f4d902132fdbd5274f302d8 100644 (file)
--- a/tools/testing/cxl/test/mem.c
+++ b/tools/testing/cxl/test/mem.c
@@ -1063,7 +1063,7 @@ static int mock_get_lsa(struct cxl_mockmem_data *mdata,
                return -EINVAL;
        offset = le32_to_cpu(get_lsa->offset);
        length = le32_to_cpu(get_lsa->length);
-       if (offset + length > LSA_SIZE)
+       if (offset > LSA_SIZE || length > LSA_SIZE - offset)
                return -EINVAL;
        if (length > cmd->size_out)
                return -EINVAL;
@@ -1083,7 +1083,7 @@ static int mock_set_lsa(struct cxl_mockmem_data *mdata,
                return -EINVAL;
        offset = le32_to_cpu(set_lsa->offset);
        length = cmd->size_in - sizeof(*set_lsa);
-       if (offset + length > LSA_SIZE)
+       if (offset > LSA_SIZE || length > LSA_SIZE - offset)
                return -EINVAL;
 
        memcpy(lsa + offset, &set_lsa->data[0], length);