[PATCH v3 0/4] Fix endian, overflow, and write-protection bugs in SE firmware loading

[Viken Dadhaniya]

This series fixes four issues in geni_find_protocol_fw() and
geni_load_se_fw(), all introduced by commit d4bf06592ad6 ("soc: qcom:
geni-se: Add support to load QUP SE Firmware via Linux subsystem").

The most critical issue (patch 4/4) causes a level-3 permission fault
and crashes the kernel during QUP firmware load on CentOS; writing through
a non-const cast into a read-only firmware mapping is undefined behavior
regardless of whether the fault is raised.

The remaining three patches fix related issues that were uncovered while
addressing the above:

- The fw_end bounds check was computed from the unrounded fw_size,
  allowing an odd-word-count segment to pass validation but trigger an
  out-of-bounds read during the subsequent memcpy_toio() (patch 3/4).

- fw_size was stored as u16; incrementing 0xffff silently wraps to 0,
  bypassing the MAX_GENI_CFG_RAMn_CNT check and permitting an
  arbitrarily large copy into SE RAM (patch 2/4).

- serial_protocol is __le16 but was decoded with le32_to_cpu(), causing
  the protocol match to always fail on big-endian systems and preventing
  any firmware from loading (patch 1/4).

---
Changes in v3:
- Replace "the previous commit" with a self-contained reference to
  geni_find_protocol_fw() to avoid ordering assumptions
- Add Reviewed-by: Konrad Dybcio <konrad.dybcio@xxxxxxxxxxxxxxxx>
- Link to v2: https://patch.msgid.link/20260820-fix-write-to-read-only-firmware-buffer-v2-0-7badcdc455fe@xxxxxxxxxxxxxxxx

Changes in v2:
- Split into four atomic patches (one fix per commit) for easier review and bisection.
- Link to v1: https://patch.msgid.link/20260819-fix-write-to-read-only-firmware-buffer-v1-1-be86532fe122@xxxxxxxxxxxxxxxx

---
Viken Dadhaniya (4):
      soc: qcom: geni-se: Fix endian conversion for serial_protocol comparison
      soc: qcom: geni-se: Widen fw_size to u32 to prevent wrap-around
      soc: qcom: geni-se: Fix fw_end computed before round-up; propagate size to caller
      soc: qcom: geni-se: Fix write to read-only firmware buffer

 drivers/soc/qcom/qcom-geni-se.c | 45 ++++++++++++++++++++++-------------------
 1 file changed, 24 insertions(+), 21 deletions(-)
---
base-commit: e6664f2b33db9b6811eb4cec109f06cb2b4f458d
change-id: 20260819-fix-write-to-read-only-firmware-buffer-39ca7834e310

Best regards,
--  
Viken Dadhaniya <viken.dadhaniya@xxxxxxxxxxxxxxxx>