From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0b-0031df01.pphosted.com (mx0b-0031df01.pphosted.com [205.220.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6AE213438BC for ; Thu, 20 Aug 2026 14:31:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.180.131 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787236281; cv=none; b=GPWVD7eQwERvqnFBFMAcRYuLGXCp3eGeEwqPvWyWgz5yY9p2/Y9vEVeBGV+G89KQcBy68rz/k2lL6h9krOoxsm1Vv6Fmb6/jAmE24V38TqtlZRWVy9+/2OlwoZ6QbIxymlJWJHexuBLUwkJ3IuO/1Ubi1l7/+S4Ybsmf/eN+QDc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787236281; c=relaxed/simple; bh=ciwHRYjQuEd3C8uscy3buW66CO8Rv1fx4UFqivYmwyI=; h=From:Subject:Date:Message-Id:MIME-Version:Content-Type:To:Cc; b=P58/mgYyXj3PLoce95lN9mj0ocHQjnILtYk/A8iZDfjM/6uKrAfyyhf9AdvVgFmDOKzpMwZu9WcRa9frIUAtxhW94cgN0gpABVisID78L3zLkz1JWQ7qt3PLFXVbeRsMlO108gyWQgYbZR32/xUhYISFC9AmeC3Bv05fzsvlLJc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=KKos8eij; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=LZOx5xVV; arc=none smtp.client-ip=205.220.180.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="KKos8eij"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="LZOx5xVV" Received: from pps.filterd (m0279869.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 67KE7qdq2444577 for ; Thu, 20 Aug 2026 14:31:18 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:message-id :mime-version:subject:to; s=qcppdkim1; bh=MW9JEteA9muiYxcGdyLndH i/JmVW1xLrRy/23aBzD8U=; b=KKos8eijqIXxBxTIYFTSnmdxG1kjcUaMvdAMmU MM0HKQlHmhgfDPKPYHSkscuGiCuQuwbpv9Qmvw7omEZoH4tXKEQDiKi0VMMe6uUm TWtAfUIRkwL+FMqNS4g0syvf8JfUIMP+tXOxBmH+8ySS3bIFCfSJCnDOZbYjwNWE pBic1/QCDw+1q/KcdtPEIaRDas/9wIx5ZDTykHBi704uNUn7CNetnH/5Zs7W0cVA w/ZIeR6DEnT9VwX+7wxHx2hh+wbmMXOVUHaUZdZ6PFBXbTn+0WeEVwlGPUf5Fo8o sKyMc+xKxofXgijPFQSLpoLhJCFXdozXojNdb19IUyfDBJnA== Received: from mail-qk1-f199.google.com (mail-qk1-f199.google.com [209.85.222.199]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4g5x05sfht-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Thu, 20 Aug 2026 14:31:17 +0000 (GMT) Received: by mail-qk1-f199.google.com with SMTP id af79cd13be357-92e695a3b28so114455485a.1 for ; Thu, 20 Aug 2026 07:31:17 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1787236277; x=1787841077; darn=vger.kernel.org; h=cc:to:content-transfer-encoding:content-type:mime-version :message-id:date:subject:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=MW9JEteA9muiYxcGdyLndHi/JmVW1xLrRy/23aBzD8U=; b=LZOx5xVVGAjm1z+p5PqqNMzqTJtn8Q4w2UnB92zZVlaDDA5NV6vaBdURMCSsuMtcVR j290+piZ/w7V2eODNNTGpwxeRG93wD7MYihekGCwfFNtEC1Vuvz++UQVZmqhmeMVFnaf +GsxuwqhRwccsZ4dh0I7T/XVY10EsLwdRgf54zvSLfv0Id/0uvLX6IQuuto/X+RcIOWp V9lrEEmVFEufk/O6Q19LVxHcB1lo7sOLJoqolgVmDiwzLp3aOK2S4q/eUZkrWAFVgUNO R4A5ZzcVVAjZu369mNVrWu3F9ip/6HwJ66IGnlnvHw7lrttbpvoVy5TABdCZ5GSFQ5+n ZEyA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787236277; x=1787841077; h=cc:to:content-transfer-encoding:content-type:mime-version :message-id:date:subject:from:x-gm-gg:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to:content-type; bh=MW9JEteA9muiYxcGdyLndHi/JmVW1xLrRy/23aBzD8U=; b=BubLog+XmPJOIvmiimjC/LBhKL4n15RP2MTRwT7g7Ud+TaEpx6GKWq2j15ywNfnQ+m vm4FJIZTZKTyQeih4M4ynNWkFIAlRZJnDYgzvTblnWeD+5m7wGJEvCc9cziObRiQBHdI GxA64Ltm/+fy5H0RwQJlFsffphLf0pfsIYj0lQUxJBbLQoJGb2J49Ek2Lpmqa3vvAKvu FUxD6WaYXFXkW89ru9btGQdm7EcfgS1i1QM8doNScsq7uJ1viNH+SrySZygKmG6gO2FL P6MmeAFowS/1SaqNK9rwpS7nxUofycm/NwEkTKJKKnihGC6V07jE29JOVH/tNKFL+ccF gSEQ== X-Forwarded-Encrypted: i=1; AHgh+RoexvYaOGzQqB1ue/M8+cLDN1oVRBX8muOCF23DSzDKUBdzaDC++A1ZbkH+LuNriD1Tdmh6Au7OrMbhacA=@vger.kernel.org X-Gm-Message-State: AOJu0Yyh0dFlr8OSpnpKjVCOdBGaKrHAvihhLvLd3vVC+9YIqAJ+Zkr7 bFDaz+pPY7eFNUH3r2OdO2oa0jiPqMS+Gz5dYiysayRJ47QUPUglAZyWBwQHTI3UVFsIarc0UKT 55LBCaLt6dDqMULHpCJ+qra+1N6w+geEFGYX3TZgP7pDqF8LSQj/I8rFuIO2yARB9vjqkstwgm2 k= X-Gm-Gg: AR+sD107Fj27wrs174eTCxU789+OImWfrw7plRT21uOiOBZn+N9OZZXhTDZZj+zVN99 2v1NGViJ13eQWHHdUTYVw6B7AhdAFfOqdOvdCX90VgzgpjNJfcpLdbuuuzy9B6bZo6BwtqH6bQk Gnuzvt2Pd2sMHqp4f01nctTS8rb0rNuNBKymkppwtjG/M+mc22OnbnLOsjx4PRJQ2C56YiiwMkL tMWBNZ3X0LosmN90TBJw0KhjF575PeoHVnYsDeojsa47bw+Vqf9QnfP3HiH5kRH3+nz5ZqmN0nO XBPigO4fTTAD3NzH+phOeiapA+nv2nwEaKEElzh4x9dgOrYc6gBMKxuNuRh1JxeV/4wnQZbvynM XYcrpJw9M50AlWQE0quUoqi70xsBNSHgFRtB6 X-Received: by 2002:a05:620a:268f:b0:92b:6e09:b0d9 with SMTP id af79cd13be357-9372858eaaemr724732585a.21.1787236276745; Thu, 20 Aug 2026 07:31:16 -0700 (PDT) X-Received: by 2002:a05:620a:268f:b0:92b:6e09:b0d9 with SMTP id af79cd13be357-9372858eaaemr724696385a.21.1787236274752; Thu, 20 Aug 2026 07:31:14 -0700 (PDT) Received: from hu-vdadhani-hyd.qualcomm.com ([202.46.23.25]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-482b145c9d7sm15226618f8f.15.2026.08.20.07.31.08 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 20 Aug 2026 07:31:12 -0700 (PDT) From: Viken Dadhaniya Subject: [PATCH v2 0/4] Fix endian, overflow, and write-protection bugs in SE firmware loading Date: Thu, 20 Aug 2026 20:00:57 +0530 Message-Id: <20260820-fix-write-to-read-only-firmware-buffer-v2-0-7badcdc455fe@oss.qualcomm.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit X-B4-Tracking: v=1; b=H4sIAKIPh2oC/5WOwQ6CMBBEf8X07BLaKoIn/8NwKGUrNUB1W0BC+ HcLfoGXSd5kdmYX5pEsenY9LIxwtN66PoI4HphuVP9AsHVkJlKRpTkvwNgPTGQDQnBAqGpwfTt Hm7pJEUI1GIMEstDqkssTSp6yWPYijJf70L38sR+qJ+qwtW+JxvrgaN4/GfmW+3t05MChwjw7S 2GQC3Fz3ifvQbXadV0ShZXrun4BEAf7HPUAAAA= X-Change-ID: 20260819-fix-write-to-read-only-firmware-buffer-39ca7834e310 To: Bjorn Andersson , Konrad Dybcio , Viken Dadhaniya , Mukesh Kumar Savaliya Cc: linux-arm-msm@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org X-Mailer: b4 0.16-dev X-Developer-Signature: v=1; a=ed25519-sha256; t=1787236268; l=2071; i=viken.dadhaniya@oss.qualcomm.com; s=20260324; h=from:subject:message-id; bh=ciwHRYjQuEd3C8uscy3buW66CO8Rv1fx4UFqivYmwyI=; b=vHO/Ikmrwnx0ik1NavaLPPk/gDouDK9U4oE/6qfPIHO0SYMl6+hsfmyO1tNxdwDl+zt+MjWGz C2591qjY6vIBHfJ6o1/K3HdoNlRNzME1YFBtQUB1lJ3+dDuEblIC25Y X-Developer-Key: i=viken.dadhaniya@oss.qualcomm.com; a=ed25519; pk=C39f+LOIGhh/02LQpT46TsUSXRvBn9qXC8Xb26KJ44Y= X-Proofpoint-ORIG-GUID: 93QNJ8PSBfzYosL1cxnfJUxh8pteXY2X X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwODIwMDEwOSBTYWx0ZWRfX40VFVehUHOAw sILjAw6EY71je1KwWvFpS9gGLTZa/sBObXi5kpbgw98PnDPcxPttB4CZD+pJo9J4HrRxccVTC/l R+IjpEOUAmsbSpgCGGuTg2DQ1vY+7OvZI+FFqtH20su97FaPsIImM0yuNwd7wrtwCkjpaQCtiAh KAsQxntLBafPnDBUwD3ymtniEpBKz9TlNrpYhRRa5pIESqO9gKeymPe844y3vI5/iW1eq5ASkVt bTwYbAMezZcF1yKOQUmOvtmAal9n1HdenS0PvUJIupL3ME21OKfWldvtj0CCb/Vky3uGm1I1Qt8 EtYGAvESzi1XeqgOQ634bhL0zlgdmQHTvvyeHjdW/Hbd2KRJu5Nk/s/LwIN5LX79kDukfiUX+xM aPCcZ01I0C4pp3g+Bve34V0VAe7eNa4HtjY+0gCsvu1+EDcVD6/9/HdfodonIUSSYWmGGgrkPNN dLjNjekwoLsV7SJ2crg== X-Proofpoint-Spam-Info: AW1haW4tMjYwODIwMDEwOSBTYWx0ZWRfX1Dd7TwW3AtIL EOtiWBM1YNUB1fO55PmF8gva7V27TCeGNuGG4go1jImb0kIdClo5a+/5oOABkA7qDBYP0NiVFP9 VEUKdG0TconrnIHXAxEk1f7oKhuqWfI= X-Authority-Analysis: v=2.4 cv=VfPH+lp9 c=1 sm=1 tr=0 ts=6a870fb5 cx=c_pps a=HLyN3IcIa5EE8TELMZ618Q==:117 a=ZePRamnt/+rB5gQjfz0u9A==:17 a=IkcTkHD0fZMA:10 a=Sv0fKeRqtYgA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=_glEPmIy2e8OvE2BGh3C:22 a=bC-a23v3AAAA:8 a=EUspDBNiAAAA:8 a=XQMRRsFmXZ0RbJubXJcA:9 a=QEXdDO2ut3YA:10 a=bTQJ7kPSJx9SKPbeHEYW:22 a=FO4_E8m0qiDe52t0p3_H:22 X-Proofpoint-GUID: 93QNJ8PSBfzYosL1cxnfJUxh8pteXY2X X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-08-19_06,2026-08-20_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 bulkscore=0 phishscore=0 lowpriorityscore=0 clxscore=1015 priorityscore=1501 suspectscore=0 malwarescore=0 impostorscore=0 adultscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2608200109 This series fixes four issues in geni_find_protocol_fw() and geni_load_se_fw(), all introduced by commit d4bf06592ad6 ("soc: qcom: geni-se: Add support to load QUP SE Firmware via Linux subsystem"). The most critical issue (patch 4/4) causes a level-3 permission fault and crashes the kernel during QUP firmware load on CentOS; writing through a non-const cast into a read-only firmware mapping is undefined behavior regardless of whether the fault is raised. The remaining three patches fix related issues that were uncovered while addressing the above: - The fw_end bounds check was computed from the unrounded fw_size, allowing an odd-word-count segment to pass validation but trigger an out-of-bounds read during the subsequent memcpy_toio() (patch 3/4). - fw_size was stored as u16; incrementing 0xffff silently wraps to 0, bypassing the MAX_GENI_CFG_RAMn_CNT check and permitting an arbitrarily large copy into SE RAM (patch 2/4). - serial_protocol is __le16 but was decoded with le32_to_cpu(), causing the protocol match to always fail on big-endian systems and preventing any firmware from loading (patch 1/4). --- Changes in v2: - Split into four atomic patches (one fix per commit) for easier review and bisection. - Link to v1: https://patch.msgid.link/20260819-fix-write-to-read-only-firmware-buffer-v1-1-be86532fe122@oss.qualcomm.com --- Viken Dadhaniya (4): soc: qcom: geni-se: Fix endian conversion for serial_protocol comparison soc: qcom: geni-se: Widen fw_size to u32 to prevent wrap-around soc: qcom: geni-se: Fix fw_end computed before round-up; propagate size to caller soc: qcom: geni-se: Fix write to read-only firmware buffer drivers/soc/qcom/qcom-geni-se.c | 45 ++++++++++++++++++++++------------------- 1 file changed, 24 insertions(+), 21 deletions(-) --- base-commit: e6664f2b33db9b6811eb4cec109f06cb2b4f458d change-id: 20260819-fix-write-to-read-only-firmware-buffer-39ca7834e310 Best regards, -- Viken Dadhaniya