Re: [PATCH] soc: qcom: geni-se: Fix write to read-only firmware buffer

[Viken Dadhaniya]

On 8/19/2026 6:44 PM, Konrad Dybcio wrote:
> On 8/19/26 12:14 PM, Viken Dadhaniya wrote:
>> geni_find_protocol_fw() casts fw->data to a non-const struct se_fw_hdr
>> pointer and writes back a rounded-up fw_size value:
>>
>>         sefw->fw_size_in_items = cpu_to_le16(fw_size);
>>
>> The firmware subsystem maps the firmware blob read-only. Writing through
>> the cast pointer causes a level-3 permission fault on AArch64 and
>> crashes the kernel during driver probe.
> 
> Bug 1
> 
>> Remove the write-back. fw_size is u16, so incrementing 0xffff wraps
>> to 0, letting the bounds check pass for an unchecked size; widen it to
>> u32. The bounds check used the unrounded fw_size, so a segment with an
>> odd word count can pass validation but trigger an out-of-bounds read
>> during the copy;
> 
> Bug 2
> 
>> round up before computing fw_end. The caller re-reads
>> fw_size_in_items directly, bypassing the validated value; propagate it
>> via a new fw_size_out parameter.
> 
> Bug 3
> 
>> While at it, fix serial_protocol being compared with le32_to_cpu();
>> the field is __le16, which would cause the protocol match to always
>> fail on big-endian.
> 
> Bug 4
> 
> Please split this up

Split into four patches in v2.

> 
> Konrad