This series fixes four issues in geni_find_protocol_fw() and
geni_load_se_fw(), all introduced by commit d4bf06592ad6 ("soc: qcom:
geni-se: Add support to load QUP SE Firmware via Linux subsystem").
The most critical issue (patch 4/4) causes a level-3 permission fault
and crashes the kernel during QUP firmware load on CentOS; writing through
a non-const cast into a read-only firmware mapping is undefined behavior
regardless of whether the fault is raised.
The remaining three patches fix related issues that were uncovered while
addressing the above:
- The fw_end bounds check was computed from the unrounded fw_size,
allowing an odd-word-count segment to pass validation but trigger an
out-of-bounds read during the subsequent memcpy_toio() (patch 3/4).
- fw_size was stored as u16; incrementing 0xffff silently wraps to 0,
bypassing the MAX_GENI_CFG_RAMn_CNT check and permitting an
arbitrarily large copy into SE RAM (patch 2/4).
- serial_protocol is __le16 but was decoded with le32_to_cpu(), causing
the protocol match to always fail on big-endian systems and preventing
any firmware from loading (patch 1/4).
---
Changes in v3:
- Replace "the previous commit" with a self-contained reference to
geni_find_protocol_fw() to avoid ordering assumptions
- Add Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
- Link to v2: https://patch.msgid.link/20260820-fix-write-to-read-only-firmware-buffer-v2-0-7badcdc455fe@oss.qualcomm.com
Changes in v2:
- Split into four atomic patches (one fix per commit) for easier review and bisection.
- Link to v1: https://patch.msgid.link/20260819-fix-write-to-read-only-firmware-buffer-v1-1-be86532fe122@oss.qualcomm.com
---
Viken Dadhaniya (4):
soc: qcom: geni-se: Fix endian conversion for serial_protocol comparison
soc: qcom: geni-se: Widen fw_size to u32 to prevent wrap-around
soc: qcom: geni-se: Fix fw_end computed before round-up; propagate size to caller
soc: qcom: geni-se: Fix write to read-only firmware buffer
drivers/soc/qcom/qcom-geni-se.c | 45 ++++++++++++++++++++++-------------------
1 file changed, 24 insertions(+), 21 deletions(-)
---
base-commit: e6664f2b33db9b6811eb4cec109f06cb2b4f458d
change-id: 20260819-fix-write-to-read-only-firmware-buffer-39ca7834e310
Best regards,
--
Viken Dadhaniya <viken.dadhaniya@oss.qualcomm.com>