Re: [PATCH] soc: qcom: geni-se: Fix write to read-only firmware buffer

[Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>]

On 8/19/26 12:14 PM, Viken Dadhaniya wrote:
> geni_find_protocol_fw() casts fw->data to a non-const struct se_fw_hdr
> pointer and writes back a rounded-up fw_size value:
> 
>         sefw->fw_size_in_items = cpu_to_le16(fw_size);
> 
> The firmware subsystem maps the firmware blob read-only. Writing through
> the cast pointer causes a level-3 permission fault on AArch64 and
> crashes the kernel during driver probe.

Bug 1

> Remove the write-back. fw_size is u16, so incrementing 0xffff wraps
> to 0, letting the bounds check pass for an unchecked size; widen it to
> u32. The bounds check used the unrounded fw_size, so a segment with an
> odd word count can pass validation but trigger an out-of-bounds read
> during the copy;

Bug 2

> round up before computing fw_end. The caller re-reads
> fw_size_in_items directly, bypassing the validated value; propagate it
> via a new fw_size_out parameter.

Bug 3

> While at it, fix serial_protocol being compared with le32_to_cpu();
> the field is __le16, which would cause the protocol match to always
> fail on big-endian.

Bug 4

Please split this up

Konrad