FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

Fix write to read only firmware buffer by vdadhani · Pull Request #980 · qualcomm-linux/kernel · GitHub

/ kernel Public

Fix write to read only firmware buffer - #980

Open
vdadhani wants to merge 2 commits into
qualcomm-linux:qcom-6.18.yfrom
vdadhani:fix-write-to-read-only-firmware-buffer
ConversationCommits (2)ChecksFiles changed
Open

Fix write to read only firmware buffer#980
vdadhani wants to merge 2 commits into
qualcomm-linux:qcom-6.18.yfrom
vdadhani:fix-write-to-read-only-firmware-buffer

Conversation

vdadhani commented Aug 19, 2026

Copy link
Copy Markdown

CRs-fixed: 4636998

FROMLIST: soc: qcom: geni-se: Use HW PROG_RAM_DEPTH to validate firmw…
daa39c6 
…are size

The hardcoded MAX_GENI_CFG_RAMn_CNT limit is not accurate for all SoCs:
some targets have less CFG RAM than the constant implies, while others
like QCS615 need more entries than the old limit of 455 allowed, causing
valid firmware to be rejected at load time.

Rather than hardcoding a constant, read PROG_RAM_DEPTH from SE_HW_PARAM_2
at runtime to get the actual CFG RAM depth of the hardware instance and
use that as the upper bound for firmware size validation.

Link: https://lore.kernel.org/all/20260702-qup-se-increase-ram-cnt-v3-1-80b363373a5b@oss.qualcomm.com/
Fixes: d4bf065 ("soc: qcom: geni-se: Add support to load QUP SE Firmware via Linux subsystem")
Cc: stable@vger.kernel.org
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Signed-off-by: Viken Dadhaniya <viken.dadhaniya@oss.qualcomm.com>
FROMLIST: soc: qcom: geni-se: Fix write to read-only firmware buffer
c6450f2 
geni_find_protocol_fw() casts fw->data to a non-const struct se_fw_hdr
pointer and writes back a rounded-up fw_size value:

        sefw->fw_size_in_items = cpu_to_le16(fw_size);

The firmware subsystem maps the firmware blob read-only. Writing through
the cast pointer causes a level-3 permission fault on AArch64 and
crashes the kernel during driver probe.

Remove the write-back. fw_size is u16, so incrementing 0xffff wraps
to 0, letting the bounds check pass for an unchecked size; widen it to
u32. The bounds check used the unrounded fw_size, so a segment with an
odd word count can pass validation but trigger an out-of-bounds read
during the copy; round up before computing fw_end. The caller re-reads
fw_size_in_items directly, bypassing the validated value; propagate it
via a new fw_size_out parameter.

While at it, fix serial_protocol being compared with le32_to_cpu();
the field is __le16, which would cause the protocol match to always
fail on big-endian.

Link: https://lore.kernel.org/all/20260819-fix-write-to-read-only-firmware-buffer-v1-1-be86532fe122@oss.qualcomm.com/
Fixes: d4bf065 ("soc: qcom: geni-se: Add support to load QUP SE Firmware via Linux subsystem")
Cc: stable@vger.kernel.org
Signed-off-by: Viken Dadhaniya <viken.dadhaniya@oss.qualcomm.com>

qcomlnxci commented Aug 27, 2026

Copy link
Copy Markdown

Test jobs on c6450f2

qcomlnxci commented Aug 27, 2026

Copy link
Copy Markdown

Test Matrix

Test Case hamoa-iot-evk-multimedia lemans-evk-multimedia monaco-evk-multimedia purwa-iot-evk-multimedia qcs615-ride-multimedia qcs6490-rb3gen2-multimedia qcs8300-ride-multimedia qcs9100-ride-r3-multimedia shikra-iqs-evk-multimedia
Audio_Card_Registration ◻️ ✅ Pass ◻️ ✅ Pass ◻️ ✅ Pass ⚠️ skip ⚠️ skip ⚠️ skip
BT_FW_KMD_Service ◻️ ✅ Pass ◻️ ✅ Pass ◻️ ✅ Pass ✅ Pass ✅ Pass ✅ Pass
BT_ON_OFF ◻️ ✅ Pass ◻️ ✅ Pass ◻️ ✅ Pass ✅ Pass ✅ Pass ✅ Pass
BT_SCAN ◻️ ✅ Pass ◻️ ✅ Pass ◻️ ✅ Pass ✅ Pass ✅ Pass ✅ Pass
CPUFreq_Validation ◻️ ✅ Pass ◻️ ✅ Pass ◻️ ✅ Pass ✅ Pass ✅ Pass ✅ Pass
CPU_affinity ◻️ ✅ Pass ◻️ ✅ Pass ◻️ ✅ Pass ✅ Pass ✅ Pass ✅ Pass
DSP_AudioPD ◻️ ✅ Pass ◻️ ✅ Pass ◻️ ✅ Pass ✅ Pass ✅ Pass ⚠️ skip
Ethernet_Basic_Validation ◻️ ✅ Pass ◻️ ⚠️ skip ◻️ ⚠️ skip ❌ Fail ❌ Fail ⚠️ skip
Freq_Scaling ◻️ ✅ Pass ◻️ ✅ Pass ◻️ ✅ Pass ✅ Pass ✅ Pass ✅ Pass
GIC ◻️ ✅ Pass ◻️ ✅ Pass ◻️ ✅ Pass ✅ Pass ✅ Pass ❌ Fail
IPA ◻️ ✅ Pass ◻️ ✅ Pass ◻️ ✅ Pass ✅ Pass ✅ Pass ✅ Pass
Interrupts ◻️ ✅ Pass ◻️ ✅ Pass ◻️ ✅ Pass ✅ Pass ✅ Pass ✅ Pass
KVM_Driver ◻️ ✅ Pass ◻️ ❌ Fail ◻️ ❌ Fail ❌ Fail ❌ Fail ❌ Fail
KVM_EL2_DTB ◻️ ✅ Pass ◻️ ❌ Fail ◻️ ❌ Fail ❌ Fail ❌ Fail ❌ Fail
KVM_Infra ◻️ ✅ Pass ◻️ ❌ Fail ◻️ ❌ Fail ❌ Fail ❌ Fail ❌ Fail
OpenCV ◻️ ✅ Pass ◻️ ✅ Pass ◻️ ✅ Pass ✅ Pass ✅ Pass ✅ Pass
PCIe ◻️ ✅ Pass ◻️ ✅ Pass ◻️ ✅ Pass ✅ Pass ✅ Pass ✅ Pass
Probe_Failure_Check ◻️ ❌ Fail ◻️ ❌ Fail ◻️ ❌ Fail ❌ Fail ❌ Fail ❌ Fail
RMNET ◻️ ✅ Pass ◻️ ✅ Pass ◻️ ✅ Pass ✅ Pass ✅ Pass ✅ Pass
UFS_Validation ◻️ ✅ Pass ◻️ ✅ Pass ◻️ ✅ Pass ✅ Pass ✅ Pass ⚠️ skip
USBHost ◻️ ✅ Pass ◻️ ✅ Pass ◻️ ❌ Fail ❌ Fail ❌ Fail ❌ Fail
WiFi_Firmware_Driver ◻️ ✅ Pass ◻️ ✅ Pass ◻️ ✅ Pass ✅ Pass ✅ Pass ✅ Pass
WiFi_OnOff ◻️ ✅ Pass ◻️ ✅ Pass ◻️ ✅ Pass ✅ Pass ✅ Pass ⚠️ skip
adsp_remoteproc ◻️ ✅ Pass ◻️ ✅ Pass ◻️ ✅ Pass ✅ Pass ✅ Pass ⚠️ skip
cdsp_remoteproc ◻️ ✅ Pass ◻️ ✅ Pass ◻️ ✅ Pass ✅ Pass ✅ Pass ✅ Pass
gpdsp_remoteproc ◻️ ✅ Pass ◻️ ⚠️ skip ◻️ ⚠️ skip ✅ Pass ✅ Pass ⚠️ skip
hotplug ◻️ ✅ Pass ◻️ ✅ Pass ◻️ ✅ Pass ✅ Pass ✅ Pass ✅ Pass
irq ◻️ ✅ Pass ◻️ ✅ Pass ◻️ ✅ Pass ✅ Pass ✅ Pass ✅ Pass
kaslr ◻️ ✅ Pass ◻️ ✅ Pass ◻️ ✅ Pass ✅ Pass ✅ Pass ✅ Pass
pinctrl ◻️ ✅ Pass ◻️ ✅ Pass ◻️ ✅ Pass ✅ Pass ✅ Pass ✅ Pass
qcom_hwrng ◻️ ✅ Pass ◻️ ✅ Pass ◻️ ✅ Pass ✅ Pass ✅ Pass ◻️
rngtest ◻️ ✅ Pass ◻️ ✅ Pass ◻️ ✅ Pass ✅ Pass ✅ Pass ✅ Pass
shmbridge ◻️ ✅ Pass ◻️ ✅ Pass ◻️ ✅ Pass ✅ Pass ✅ Pass ✅ Pass
smmu ◻️ ❌ Fail ◻️ ❌ Fail ◻️ ✅ Pass ✅ Pass ❌ Fail ✅ Pass
watchdog ◻️ ✅ Pass ◻️ ✅ Pass ◻️ ✅ Pass ✅ Pass ✅ Pass ✅ Pass
wpss_remoteproc ◻️ ✅ Pass ◻️ ✅ Pass ◻️ ✅ Pass ✅ Pass ✅ Pass ✅ Pass

This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Ricardo Salveti (ricardosalveti) Awaiting requested review from ricardosalveti ricardosalveti was automatically assigned from qualcomm-linux/qualcomm-kernel-maint
Kaushal Kumar (quic-kaushalk) Awaiting requested review from quic-kaushalk quic-kaushalk was automatically assigned from qualcomm-linux/qualcomm-kernel-maint
aiquny Awaiting requested review from aiquny aiquny was automatically assigned from qualcomm-linux/qualcomm-kernel-maint
1 more reviewer
Avaneesh Dwivedi (akdwived-dev) akdwived-dev approved these changes
Reviewers whose approvals may not affect merge requirements

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

Back | FazBrowse Home | New Git URL