Fix write to read only firmware buffer - #1714
Merged
vdadhani merged 2 commits intoAug 19, 2026
Merged
Conversation
…are size The hardcoded MAX_GENI_CFG_RAMn_CNT limit is not accurate for all SoCs: some targets have less CFG RAM than the constant implies, while others like QCS615 need more entries than the old limit of 455 allowed, causing valid firmware to be rejected at load time. Rather than hardcoding a constant, read PROG_RAM_DEPTH from SE_HW_PARAM_2 at runtime to get the actual CFG RAM depth of the hardware instance and use that as the upper bound for firmware size validation. Link: https://lore.kernel.org/all/20260702-qup-se-increase-ram-cnt-v3-1-80b363373a5b@oss.qualcomm.com/ Fixes: d4bf065 ("soc: qcom: geni-se: Add support to load QUP SE Firmware via Linux subsystem") Cc: stable@vger.kernel.org Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Signed-off-by: Viken Dadhaniya <viken.dadhaniya@oss.qualcomm.com>
geni_find_protocol_fw() casts fw->data to a non-const struct se_fw_hdr
pointer and writes back a rounded-up fw_size value:
sefw->fw_size_in_items = cpu_to_le16(fw_size);
The firmware subsystem maps the firmware blob read-only. Writing through
the cast pointer causes a level-3 permission fault on AArch64 and
crashes the kernel during driver probe.
Remove the write-back. fw_size is u16, so incrementing 0xffff wraps
to 0, letting the bounds check pass for an unchecked size; widen it to
u32. The bounds check used the unrounded fw_size, so a segment with an
odd word count can pass validation but trigger an out-of-bounds read
during the copy; round up before computing fw_end. The caller re-reads
fw_size_in_items directly, bypassing the validated value; propagate it
via a new fw_size_out parameter.
While at it, fix serial_protocol being compared with le32_to_cpu();
the field is __le16, which would cause the protocol match to always
fail on big-endian.
Link: https://lore.kernel.org/all/20260819-fix-write-to-read-only-firmware-buffer-v1-1-be86532fe122@oss.qualcomm.com/
Fixes: d4bf065 ("soc: qcom: geni-se: Add support to load QUP SE Firmware via Linux subsystem")
Cc: stable@vger.kernel.org
Signed-off-by: Viken Dadhaniya <viken.dadhaniya@oss.qualcomm.com>
qcomlnxci
requested review from
a team,
jseerapu and
mukesh-savaliya
and removed request for
a team
August 19, 2026 10:39
vdadhani
merged commit Aug 19, 2026
82e50b8
into
qualcomm-linux:tech/bus/peripherals
7 of 9 checks passed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CRs-fixed: 4636998