Fix write to read only firmware buffer by vdadhani · Pull Request #980 · qualcomm-linux/kernel

vdadhani · 2026-08-19T10:44:32Z

CRs-fixed: 4636998

…are size The hardcoded MAX_GENI_CFG_RAMn_CNT limit is not accurate for all SoCs: some targets have less CFG RAM than the constant implies, while others like QCS615 need more entries than the old limit of 455 allowed, causing valid firmware to be rejected at load time. Rather than hardcoding a constant, read PROG_RAM_DEPTH from SE_HW_PARAM_2 at runtime to get the actual CFG RAM depth of the hardware instance and use that as the upper bound for firmware size validation. Link: https://lore.kernel.org/all/20260702-qup-se-increase-ram-cnt-v3-1-80b363373a5b@oss.qualcomm.com/ Fixes: d4bf065 ("soc: qcom: geni-se: Add support to load QUP SE Firmware via Linux subsystem") Cc: stable@vger.kernel.org Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com> Signed-off-by: Viken Dadhaniya <viken.dadhaniya@oss.qualcomm.com>

geni_find_protocol_fw() casts fw->data to a non-const struct se_fw_hdr pointer and writes back a rounded-up fw_size value: sefw->fw_size_in_items = cpu_to_le16(fw_size); The firmware subsystem maps the firmware blob read-only. Writing through the cast pointer causes a level-3 permission fault on AArch64 and crashes the kernel during driver probe. Remove the write-back. fw_size is u16, so incrementing 0xffff wraps to 0, letting the bounds check pass for an unchecked size; widen it to u32. The bounds check used the unrounded fw_size, so a segment with an odd word count can pass validation but trigger an out-of-bounds read during the copy; round up before computing fw_end. The caller re-reads fw_size_in_items directly, bypassing the validated value; propagate it via a new fw_size_out parameter. While at it, fix serial_protocol being compared with le32_to_cpu(); the field is __le16, which would cause the protocol match to always fail on big-endian. Link: https://lore.kernel.org/all/20260819-fix-write-to-read-only-firmware-buffer-v1-1-be86532fe122@oss.qualcomm.com/ Fixes: d4bf065 ("soc: qcom: geni-se: Add support to load QUP SE Firmware via Linux subsystem") Cc: stable@vger.kernel.org Signed-off-by: Viken Dadhaniya <viken.dadhaniya@oss.qualcomm.com>

qcomlnxci · 2026-08-27T12:36:48Z

Test jobs on c6450f2

qcomlnxci · 2026-08-27T12:36:52Z

Test Matrix

Test Case	hamoa-iot-evk-multimedia	lemans-evk-multimedia	monaco-evk-multimedia	purwa-iot-evk-multimedia	qcs615-ride-multimedia	qcs6490-rb3gen2-multimedia	qcs8300-ride-multimedia	qcs9100-ride-r3-multimedia	shikra-iqs-evk-multimedia
Audio_Card_Registration	◻️	✅ Pass	◻️	✅ Pass	◻️	✅ Pass	⚠️ skip	⚠️ skip	⚠️ skip
BT_FW_KMD_Service	◻️	✅ Pass	◻️	✅ Pass	◻️	✅ Pass	✅ Pass	✅ Pass	✅ Pass
BT_ON_OFF	◻️	✅ Pass	◻️	✅ Pass	◻️	✅ Pass	✅ Pass	✅ Pass	✅ Pass
BT_SCAN	◻️	✅ Pass	◻️	✅ Pass	◻️	✅ Pass	✅ Pass	✅ Pass	✅ Pass
CPUFreq_Validation	◻️	✅ Pass	◻️	✅ Pass	◻️	✅ Pass	✅ Pass	✅ Pass	✅ Pass
CPU_affinity	◻️	✅ Pass	◻️	✅ Pass	◻️	✅ Pass	✅ Pass	✅ Pass	✅ Pass
DSP_AudioPD	◻️	✅ Pass	◻️	✅ Pass	◻️	✅ Pass	✅ Pass	✅ Pass	⚠️ skip
Ethernet_Basic_Validation	◻️	✅ Pass	◻️	⚠️ skip	◻️	⚠️ skip	❌ Fail	❌ Fail	⚠️ skip
Freq_Scaling	◻️	✅ Pass	◻️	✅ Pass	◻️	✅ Pass	✅ Pass	✅ Pass	✅ Pass
GIC	◻️	✅ Pass	◻️	✅ Pass	◻️	✅ Pass	✅ Pass	✅ Pass	❌ Fail
IPA	◻️	✅ Pass	◻️	✅ Pass	◻️	✅ Pass	✅ Pass	✅ Pass	✅ Pass
Interrupts	◻️	✅ Pass	◻️	✅ Pass	◻️	✅ Pass	✅ Pass	✅ Pass	✅ Pass
KVM_Driver	◻️	✅ Pass	◻️	❌ Fail	◻️	❌ Fail	❌ Fail	❌ Fail	❌ Fail
KVM_EL2_DTB	◻️	✅ Pass	◻️	❌ Fail	◻️	❌ Fail	❌ Fail	❌ Fail	❌ Fail
KVM_Infra	◻️	✅ Pass	◻️	❌ Fail	◻️	❌ Fail	❌ Fail	❌ Fail	❌ Fail
OpenCV	◻️	✅ Pass	◻️	✅ Pass	◻️	✅ Pass	✅ Pass	✅ Pass	✅ Pass
PCIe	◻️	✅ Pass	◻️	✅ Pass	◻️	✅ Pass	✅ Pass	✅ Pass	✅ Pass
Probe_Failure_Check	◻️	❌ Fail	◻️	❌ Fail	◻️	❌ Fail	❌ Fail	❌ Fail	❌ Fail
RMNET	◻️	✅ Pass	◻️	✅ Pass	◻️	✅ Pass	✅ Pass	✅ Pass	✅ Pass
UFS_Validation	◻️	✅ Pass	◻️	✅ Pass	◻️	✅ Pass	✅ Pass	✅ Pass	⚠️ skip
USBHost	◻️	✅ Pass	◻️	✅ Pass	◻️	❌ Fail	❌ Fail	❌ Fail	❌ Fail
WiFi_Firmware_Driver	◻️	✅ Pass	◻️	✅ Pass	◻️	✅ Pass	✅ Pass	✅ Pass	✅ Pass
WiFi_OnOff	◻️	✅ Pass	◻️	✅ Pass	◻️	✅ Pass	✅ Pass	✅ Pass	⚠️ skip
adsp_remoteproc	◻️	✅ Pass	◻️	✅ Pass	◻️	✅ Pass	✅ Pass	✅ Pass	⚠️ skip
cdsp_remoteproc	◻️	✅ Pass	◻️	✅ Pass	◻️	✅ Pass	✅ Pass	✅ Pass	✅ Pass
gpdsp_remoteproc	◻️	✅ Pass	◻️	⚠️ skip	◻️	⚠️ skip	✅ Pass	✅ Pass	⚠️ skip
hotplug	◻️	✅ Pass	◻️	✅ Pass	◻️	✅ Pass	✅ Pass	✅ Pass	✅ Pass
irq	◻️	✅ Pass	◻️	✅ Pass	◻️	✅ Pass	✅ Pass	✅ Pass	✅ Pass
kaslr	◻️	✅ Pass	◻️	✅ Pass	◻️	✅ Pass	✅ Pass	✅ Pass	✅ Pass
pinctrl	◻️	✅ Pass	◻️	✅ Pass	◻️	✅ Pass	✅ Pass	✅ Pass	✅ Pass
qcom_hwrng	◻️	✅ Pass	◻️	✅ Pass	◻️	✅ Pass	✅ Pass	✅ Pass	◻️
rngtest	◻️	✅ Pass	◻️	✅ Pass	◻️	✅ Pass	✅ Pass	✅ Pass	✅ Pass
shmbridge	◻️	✅ Pass	◻️	✅ Pass	◻️	✅ Pass	✅ Pass	✅ Pass	✅ Pass
smmu	◻️	❌ Fail	◻️	❌ Fail	◻️	✅ Pass	✅ Pass	❌ Fail	✅ Pass
watchdog	◻️	✅ Pass	◻️	✅ Pass	◻️	✅ Pass	✅ Pass	✅ Pass	✅ Pass
wpss_remoteproc	◻️	✅ Pass	◻️	✅ Pass	◻️	✅ Pass	✅ Pass	✅ Pass	✅ Pass

vdadhani added 2 commits August 19, 2026 16:13

vdadhani requested review from a team, aiquny, Kaushal Kumar (quic-kaushalk) and Ricardo Salveti (ricardosalveti) August 19, 2026 10:44

Avaneesh Dwivedi (akdwived-dev) approved these changes Aug 27, 2026

View reviewed changes

Navigation Menu

Uh oh!

Fix write to read only firmware buffer - #980

Fix write to read only firmware buffer#980
vdadhani wants to merge 2 commits into
qualcomm-linux:qcom-6.18.yfrom
vdadhani:fix-write-to-read-only-firmware-buffer

vdadhani commented Aug 19, 2026

Uh oh!

qcomlnxci commented Aug 27, 2026

Uh oh!

qcomlnxci commented Aug 27, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

vdadhani commented Aug 19, 2026

Uh oh!

qcomlnxci commented Aug 27, 2026

Test jobs on c6450f2

Uh oh!

qcomlnxci commented Aug 27, 2026

Test Matrix

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants