which would make the other checks I suggested to ensure that neither start
or end were more than (uint64_t)LLONG_MAX unnecessary.
My apologies I was wrong about what I said above - after thinking about it for longer you still need to make sure that at least len is not greater than (uint64_t)LLONG_MAX because in the calculation:
if (start > (uint64_t)LLONG_MAX - len)
return -EINVAL;
if len was more than (uint64_t)LLONG_MAX it would underflow and become a very large positive number and start would never be greater than that (and I said end when I should have said len).