Re: [PATCH v2 3/4] soc: qcom: geni-se: Fix fw_end computed before round-up; propagate size to caller

[Konrad Dybcio]

On 8/20/26 4:31 PM, Viken Dadhaniya wrote:
> fw_end was computed from the raw fw_size_in_items, before the odd-word
> round-up. A segment with an odd word count could pass the bounds check
> at the unrounded value but then be copied one word past the validated
> limit. Move fw_end (and the cfg_{idx,val}_end) calculations to after
> the round-up so they always reflect the true copy extent.
> 
> The caller geni_load_se_fw() re-read hdr->fw_size_in_items for the
> memcpy_toio() length, bypassing the validated and rounded value
> established by geni_find_protocol_fw(). Add a fw_size_out output
> parameter and use it in the caller.
> 
> Fixes: d4bf06592ad6 ("soc: qcom: geni-se: Add support to load QUP SE Firmware via Linux subsystem")
> Cc: stable@xxxxxxxxxxxxxxx
> Signed-off-by: Viken Dadhaniya <viken.dadhaniya@xxxxxxxxxxxxxxxx>
> ---

Reviewed-by: Konrad Dybcio <konrad.dybcio@xxxxxxxxxxxxxxxx>

Konrad