From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0b-0031df01.pphosted.com (mx0b-0031df01.pphosted.com [205.220.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0CA24353A91 for ; Thu, 20 Aug 2026 14:31:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.180.131 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787236295; cv=none; b=nN36q2N8BK4VkMDCykXkvMYQPriVMOixMFhGHEp3u4mbwED+fUYEZDB1IecpKT8IWQO0ZiepUwEZn65DXDADmJO+J81enPSD60TbPUmWyNXwQ14pPz49kH2+gZVLjMGpj0FS45BVtpPzfhsF2uV3Br7EAWKmiGGzTThqg/SU1ic= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787236295; c=relaxed/simple; bh=r/aMG71rbNo/S6UKVNGEmGXZ3oMHRMlBBnvkHh++Zs4=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=GjkxZ72rZ3AHDZTfqrYtetlmi33hf12bET3GELzXCmNSR6o9XU6VHcynRcqB+jeFSCLD/siq+l1TUVOukw7zGwh+aUVGE8LlivW188ryOlZ8v75UpPpc3zKDbumbkZupO5JrBk1113w4VWafe7OLXz5/bOachrVHvZ/Nu6ApDsU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=Ap/JbhVg; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=VApScuvx; arc=none smtp.client-ip=205.220.180.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="Ap/JbhVg"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="VApScuvx" Received: from pps.filterd (m0279872.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 67KE7kae3234908 for ; Thu, 20 Aug 2026 14:31:31 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= PvwUyC83yu4XUNEMIRKr2REu9WIwE214jdhfMG4Sbcw=; b=Ap/JbhVgOoD7MASA 6P5eVIh4VW1RgBKEYqd2+jxiwnc/QOEFnxzSk25fXKRhcJAvZa1NeYonNBZQTRMN 4JIGUvcJRxyEUvRLO22K/Sa3ClRsO8GuXHOB2DEDBUfaBW+LJ2jHlOM5ZEj7ja+s UqiNtfJdZQxMgegKt0MT/EZPq6n1faRP8earRFUa4ypeV7HRZRFWWYG0m4zE0Rb8 Qv19/3+eEKFyoAbo1Qhhu88l3Ng9ETnDR98cPT42wC8fttYTyzBZaIAnrjiiN0UI 3SZRCPHg9r/2ZjOV1i+ZWHkyK+LdHgpLzhImt0MukNja3T3JmHSoRMckGsc4IHKl WgEXBA== Received: from mail-qk1-f198.google.com (mail-qk1-f198.google.com [209.85.222.198]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4g5xbv9bwy-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Thu, 20 Aug 2026 14:31:31 +0000 (GMT) Received: by mail-qk1-f198.google.com with SMTP id af79cd13be357-9372b9db132so118830485a.2 for ; Thu, 20 Aug 2026 07:31:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1787236291; x=1787841091; darn=vger.kernel.org; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=PvwUyC83yu4XUNEMIRKr2REu9WIwE214jdhfMG4Sbcw=; b=VApScuvxjqX3x/m3NtH6grAm+NJBg3rIfHdu8qkNhY0IM7eNaEeD5vlftrj7NuCo3l Ae9Igxbrxi7K4a/B/vf20727qL10dxr7gTlT4N6xg1+jY/VBhwlIg+WK8MhjLMtRbBhc CVaZsOiaoFd88Zy1+bqao1phT/d8RSVb606dYVngacPD+DhezldLBqjZpY7yJwK6wXrq Gq8o1ewF3jd2eSIubHUo1p+Y+wx0VOF/VTBAgAMhRsV3qDY7NKeHr1DzFl9Zn8upYJ5S 8yOsTs/bSTFCmiwpRy4PXLU+E87ytmMFzKROB5UrcDZJf8TRqcDh0zDU2tGKBfEgeSuD Y+zQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787236291; x=1787841091; h=cc:to:in-reply-to:references:message-id:content-transfer-encoding :content-type:mime-version:subject:date:from:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=PvwUyC83yu4XUNEMIRKr2REu9WIwE214jdhfMG4Sbcw=; b=qJr/vjMZcFIlGEDUr8waKtQkBXXCx7ndhCXkh1UIUy7vkWQ/i792Z58Q7PYA5gMQdn quyog3ALt8cNQPrRDPBXfll9qrU3AxCKn1mde5Mu3zoKKhAxoj9zqnFnV5ytkOYS2dFu S/Yvot/b72KKNGoqGfBVZtyWzu1+esUhAlONt+MNbNMix/FCWhuCcK4JLdAzT7YwDMMo KmnNXpQT6cvXpqB0W+ZI44qb+4BJM3Lz+N2LLSSI0M6UQrJwQ8aT15tgK7l3Zaw6UxRA Qdht6mTRKSojXn5GXiiZ1ynHmMnYMiX0MaF26I/zQ0vVHmowYjTC7Tsr05Xw5R8qqz1K xzWg== X-Forwarded-Encrypted: i=1; AHgh+Ro5pFLQgwQlV3VaHULV5sjCFb00rR5phn2W0KbZrgz66a7T2fMNmK5s7mj8sys8mB1W6ddXY7MGtPv7WS8=@vger.kernel.org X-Gm-Message-State: AOJu0YzSTD3Fj3D6JmuTykhI38EB4qS121YsfEHFUgLERcam7FF5zDwv RE59lBP7Tp3OfYIT1ANglCGXA4wm+L4XMaDKZg6Y30W5bFAgBELs4ssJkeWye1Dg7xZanKmATXT ELpHeb/Y7WIjXfphPB4V8+wjMCIkdvjOBcf439/Ou3DMTm/91g7EFpHDs5owFOPtwItUu91SgJo s= X-Gm-Gg: AR+sD11+AiBv4uj0Fxz+Hj8lA+AvnRKn2Zwp06UvTiktm+B/TjrpyCx6WKHZWxbiRq2 mW9sprblidvP7AArQPOQSYtKq5fN+xxC5BTjsFC4NUIMZirCjkMmp7o9kI4oYNfw6VnooKkdmzM hEoIgX88BUOLmBIrpnE30fnSj+mAEYSRjOIsQZo96rF/58q3pDjuQv2959QgkN9G5sMvQFnDQlc WTo7iyXiHbzI1FXJxdr2vNTr0Ptw6xHrPccs/Kj/4+TtZQfsk72eEHpQ3bj9C5fKxrMgwfwSMeW FfRIaycr5VzSP8GEXKA/fM+vx4d+cBEgpfCKFr20+LZA7Ht8zuk1BYZUnxYR8WIfAWUVTdz9ZUb 4iTxpe2UTmWLW9JTnG9/G2fkU/wpYaHo71QLY X-Received: by 2002:a05:620a:2406:10b0:937:2762:ef33 with SMTP id af79cd13be357-9372762f077mr611187385a.41.1787236291108; Thu, 20 Aug 2026 07:31:31 -0700 (PDT) X-Received: by 2002:a05:620a:2406:10b0:937:2762:ef33 with SMTP id af79cd13be357-9372762f077mr611178385a.41.1787236290586; Thu, 20 Aug 2026 07:31:30 -0700 (PDT) Received: from hu-vdadhani-hyd.qualcomm.com ([202.46.23.25]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-482b145c9d7sm15226618f8f.15.2026.08.20.07.31.25 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 20 Aug 2026 07:31:29 -0700 (PDT) From: Viken Dadhaniya Date: Thu, 20 Aug 2026 20:01:00 +0530 Subject: [PATCH v2 3/4] soc: qcom: geni-se: Fix fw_end computed before round-up; propagate size to caller Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-Id: <20260820-fix-write-to-read-only-firmware-buffer-v2-3-7badcdc455fe@oss.qualcomm.com> References: <20260820-fix-write-to-read-only-firmware-buffer-v2-0-7badcdc455fe@oss.qualcomm.com> In-Reply-To: <20260820-fix-write-to-read-only-firmware-buffer-v2-0-7badcdc455fe@oss.qualcomm.com> To: Bjorn Andersson , Konrad Dybcio , Viken Dadhaniya , Mukesh Kumar Savaliya Cc: linux-arm-msm@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org X-Mailer: b4 0.16-dev X-Developer-Signature: v=1; a=ed25519-sha256; t=1787236268; l=4297; i=viken.dadhaniya@oss.qualcomm.com; s=20260324; h=from:subject:message-id; bh=r/aMG71rbNo/S6UKVNGEmGXZ3oMHRMlBBnvkHh++Zs4=; b=VJDY+5gW0WqfRPaejhG3tF65SjrzDwt8p/NFNJLW1L2nnRIUH9XYCXeidUIBosj4+qt4K2aAY zdrsFovCQyADtOxSUoSbcgnjurwweGKpIA4kb/jZ/g9f9OC0veTohS1 X-Developer-Key: i=viken.dadhaniya@oss.qualcomm.com; a=ed25519; pk=C39f+LOIGhh/02LQpT46TsUSXRvBn9qXC8Xb26KJ44Y= X-Authority-Analysis: v=2.4 cv=AMKAkK6n c=1 sm=1 tr=0 ts=6a870fc3 cx=c_pps a=qKBjSQ1v91RyAK45QCPf5w==:117 a=ZePRamnt/+rB5gQjfz0u9A==:17 a=IkcTkHD0fZMA:10 a=Sv0fKeRqtYgA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=yx91gb_oNiZeI1HMLzn7:22 a=VwQbUJbxAAAA:8 a=EUspDBNiAAAA:8 a=TnNaAZle1ZcGXod9oXcA:9 a=QEXdDO2ut3YA:10 a=NFOGd7dJGGMPyQGDc5-O:22 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwODIwMDEwOSBTYWx0ZWRfXwPT90r8GZ+dr o4H7PWQRiLNp0TTLbr6DKruboeUykMOYayo11eTxPskyMC3t2XzAZhD2TOA3iMp0Lput8YymA29 KY/dQwcpN+N/UsRXq+RtakKZgHz3hqLPWFd10RjKS78j5Byuat4DPVr5zSIwXJHPCoOKPjlgPgq dM14QU1quLRN67IaJRpTjzR5Kbp+nW4ZjgcZfmM9HCMfrBYPUqQZQDwHfwvc1RqrtY8PzV6oB62 8Qo/M6XT6EB92wLJCAO38ajo2g9muy7MpE+XMd2Q42Hq1o3Lv9NwbkNHQ+2eogiBpYgzOEM1i6/ K6svJDdvz57lZu6qPMEotjoxlYTRRPIS1lStw4DLdpqjFb29TU/U3LlWqNdfoDImCZKk7z2ZDAg HmxWYf4issFEZ9000G+IbvU/DKnFqeb1ABzMPJhjedtE0dgWFEBxt5FP+rojx/BbYxuW3Dvs/DO 9K0rWei/czJMKXxfLVQ== X-Proofpoint-GUID: T38_7c2Dw5stk6ZwFjMLNAtHg3w6jkT_ X-Proofpoint-Spam-Info: AW1haW4tMjYwODIwMDEwOSBTYWx0ZWRfXwzQ2SNdM7V8o IWJaM9ndqR1cbFuCgdgeD2uB93+yw1o1kL8r0EqnKe2Kgc2Fb8GgWBHa1kdMIhJBQcmnsOU7txe sUY4L6CtjElG5nq+tUeKA54M/fevv/w= X-Proofpoint-ORIG-GUID: T38_7c2Dw5stk6ZwFjMLNAtHg3w6jkT_ X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-08-19_06,2026-08-20_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 spamscore=0 phishscore=0 lowpriorityscore=0 bulkscore=0 adultscore=0 suspectscore=0 malwarescore=0 impostorscore=0 clxscore=1015 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2608200109 fw_end was computed from the raw fw_size_in_items, before the odd-word round-up. A segment with an odd word count could pass the bounds check at the unrounded value but then be copied one word past the validated limit. Move fw_end (and the cfg_{idx,val}_end) calculations to after the round-up so they always reflect the true copy extent. The caller geni_load_se_fw() re-read hdr->fw_size_in_items for the memcpy_toio() length, bypassing the validated and rounded value established by geni_find_protocol_fw(). Add a fw_size_out output parameter and use it in the caller. Fixes: d4bf06592ad6 ("soc: qcom: geni-se: Add support to load QUP SE Firmware via Linux subsystem") Cc: stable@vger.kernel.org Signed-off-by: Viken Dadhaniya --- drivers/soc/qcom/qcom-geni-se.c | 23 ++++++++++++++--------- 1 file changed, 14 insertions(+), 9 deletions(-) diff --git a/drivers/soc/qcom/qcom-geni-se.c b/drivers/soc/qcom/qcom-geni-se.c index 54c0a66d6dd6..11ca8223fbcd 100644 --- a/drivers/soc/qcom/qcom-geni-se.c +++ b/drivers/soc/qcom/qcom-geni-se.c @@ -1230,6 +1230,8 @@ EXPORT_SYMBOL_GPL(geni_se_resources_init); * @se: Pointer to the serial engine structure. * @fw: Pointer to the firmware image. * @protocol: Expected serial engine protocol type. + * @fw_size_out: Non-NULL output parameter; receives the rounded, validated + * firmware word count on success. * * Identifies the appropriate firmware image or configuration required for a * specific communication protocol instance running on a Qualcomm GENI @@ -1239,7 +1241,8 @@ EXPORT_SYMBOL_GPL(geni_se_resources_init); * Return: pointer to a valid 'struct se_fw_hdr' if found, or NULL otherwise. */ static struct se_fw_hdr *geni_find_protocol_fw(struct geni_se *se, const struct firmware *fw, - enum geni_se_protocol_type protocol) + enum geni_se_protocol_type protocol, + u32 *fw_size_out) { struct device *dev = se->dev; const struct elf32_hdr *ehdr; @@ -1289,11 +1292,6 @@ static struct se_fw_hdr *geni_find_protocol_fw(struct geni_se *se, const struct sefw = (struct se_fw_hdr *)(fw->data + phdr->p_offset); fw_size = le16_to_cpu(sefw->fw_size_in_items); - fw_end = le16_to_cpu(sefw->fw_offset) + fw_size * sizeof(u32); - cfg_idx_end = le16_to_cpu(sefw->cfg_idx_offset) + - le16_to_cpu(sefw->cfg_size_in_items) * sizeof(u8); - cfg_val_end = le16_to_cpu(sefw->cfg_val_offset) + - le16_to_cpu(sefw->cfg_size_in_items) * sizeof(u32); if (le32_to_cpu(sefw->magic) != SE_MAGIC_NUM || le32_to_cpu(sefw->version) != 1) continue; @@ -1306,6 +1304,12 @@ static struct se_fw_hdr *geni_find_protocol_fw(struct geni_se *se, const struct sefw->fw_size_in_items = cpu_to_le16(fw_size); } + fw_end = le16_to_cpu(sefw->fw_offset) + fw_size * sizeof(u32); + cfg_idx_end = le16_to_cpu(sefw->cfg_idx_offset) + + le16_to_cpu(sefw->cfg_size_in_items) * sizeof(u8); + cfg_val_end = le16_to_cpu(sefw->cfg_val_offset) + + le16_to_cpu(sefw->cfg_size_in_items) * sizeof(u32); + prog_ram_depth = FIELD_GET(PROG_RAM_DEPTH_MSK, readl_relaxed(se->base + SE_HW_PARAM_2)); if (fw_size >= prog_ram_depth) { @@ -1320,6 +1324,7 @@ static struct se_fw_hdr *geni_find_protocol_fw(struct geni_se *se, const struct continue; } + *fw_size_out = fw_size; return sefw; } @@ -1430,11 +1435,11 @@ static int geni_load_se_fw(struct geni_se *se, const struct firmware *fw, { const u32 *fw_data, *cfg_val_arr; const u8 *cfg_idx_arr; - u32 i, reg_value; + u32 i, reg_value, fw_size_in_items; int ret; struct se_fw_hdr *hdr; - hdr = geni_find_protocol_fw(se, fw, protocol); + hdr = geni_find_protocol_fw(se, fw, protocol, &fw_size_in_items); if (!hdr) return -EINVAL; @@ -1511,7 +1516,7 @@ static int geni_load_se_fw(struct geni_se *se, const struct firmware *fw, /* Program RAM address space. */ memcpy_toio(se->base + SE_GENI_CFG_RAMN, fw_data, - le16_to_cpu(hdr->fw_size_in_items) * sizeof(u32)); + fw_size_in_items * sizeof(u32)); /* Put default values on GENI's output pads. */ writel_relaxed(0x1, se->base + GENI_FORCE_DEFAULT_REG); -- 2.34.1