* [PATCH] soc: qcom: mdt_loader: Fix error return values in mdt_header_valid()
@ 2025-06-25 15:22 Dan Carpenter
2025-06-25 15:32 ` Konrad Dybcio
` (2 more replies)
0 siblings, 3 replies; 7+ messages in thread
From: Dan Carpenter @ 2025-06-25 15:22 UTC (permalink / raw)
To: Bjorn Andersson
Cc: Konrad Dybcio, Dmitry Baryshkov, linux-arm-msm, linux-kernel,
kernel-janitors
This function is supposed to return true for valid headers and false for
invalid. In a couple places it returns -EINVAL instead which means the
invalid headers are counted as true. Change it to return false.
Fixes: 9f9967fed9d0 ("soc: qcom: mdt_loader: Ensure we don't read past the ELF header")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
---
drivers/soc/qcom/mdt_loader.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/soc/qcom/mdt_loader.c b/drivers/soc/qcom/mdt_loader.c
index 1b4ebae458f3..0ca268bdf1f8 100644
--- a/drivers/soc/qcom/mdt_loader.c
+++ b/drivers/soc/qcom/mdt_loader.c
@@ -33,14 +33,14 @@ static bool mdt_header_valid(const struct firmware *fw)
return false;
if (ehdr->e_phentsize != sizeof(struct elf32_phdr))
- return -EINVAL;
+ return false;
phend = size_add(size_mul(sizeof(struct elf32_phdr), ehdr->e_phnum), ehdr->e_phoff);
if (phend > fw->size)
return false;
if (ehdr->e_shentsize != sizeof(struct elf32_shdr))
- return -EINVAL;
+ return false;
shend = size_add(size_mul(sizeof(struct elf32_shdr), ehdr->e_shnum), ehdr->e_shoff);
if (shend > fw->size)
--
2.47.2
^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [PATCH] soc: qcom: mdt_loader: Fix error return values in mdt_header_valid()
2025-06-25 15:22 [PATCH] soc: qcom: mdt_loader: Fix error return values in mdt_header_valid() Dan Carpenter
@ 2025-06-25 15:32 ` Konrad Dybcio
2025-07-21 23:35 ` Val Packett
2025-07-23 14:46 ` neil.armstrong
2 siblings, 0 replies; 7+ messages in thread
From: Konrad Dybcio @ 2025-06-25 15:32 UTC (permalink / raw)
To: Dan Carpenter, Bjorn Andersson
Cc: Konrad Dybcio, Dmitry Baryshkov, linux-arm-msm, linux-kernel,
kernel-janitors
On 6/25/25 5:22 PM, Dan Carpenter wrote:
> This function is supposed to return true for valid headers and false for
> invalid. In a couple places it returns -EINVAL instead which means the
> invalid headers are counted as true. Change it to return false.
>
> Fixes: 9f9967fed9d0 ("soc: qcom: mdt_loader: Ensure we don't read past the ELF header")
> Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
> ---
Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Konrad
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH] soc: qcom: mdt_loader: Fix error return values in mdt_header_valid()
2025-06-25 15:22 [PATCH] soc: qcom: mdt_loader: Fix error return values in mdt_header_valid() Dan Carpenter
2025-06-25 15:32 ` Konrad Dybcio
@ 2025-07-21 23:35 ` Val Packett
2025-08-05 9:32 ` Dan Carpenter
2025-07-23 14:46 ` neil.armstrong
2 siblings, 1 reply; 7+ messages in thread
From: Val Packett @ 2025-07-21 23:35 UTC (permalink / raw)
To: Dan Carpenter, Bjorn Andersson
Cc: Konrad Dybcio, Dmitry Baryshkov, linux-arm-msm, linux-kernel,
kernel-janitors
Hi,
On 6/25/25 12:22 PM, Dan Carpenter wrote:
> This function is supposed to return true for valid headers and false for
> invalid. In a couple places it returns -EINVAL instead which means the
> invalid headers are counted as true. Change it to return false.
[..]
> if (ehdr->e_shentsize != sizeof(struct elf32_shdr))
> - return -EINVAL;
> + return false;
>
> shend = size_add(size_mul(sizeof(struct elf32_shdr), ehdr->e_shnum), ehdr->e_shoff);
> if (shend > fw->size)
this has broken all firmware loading on my x1e laptop (Dell Latitude 7455).
Apparently e_shentsize is always 0 in Qualcomm firmware files.
Confirmed externally with readelf:
% readelf --all
/lib/firmware/qcom/x1e80100/dell/latitude-7455/qcadsp8380.mbn
[..]
Start of program headers: 52 (bytes into file)
Start of section headers: 0 (bytes into file)
Flags: 0x73
Size of this header: 52 (bytes)
Size of program headers: 32 (bytes)
Number of program headers: 58
Size of section headers: 0 (bytes)
Number of section headers: 0
Section header string table index: 0
There are no sections in this file.
There are no section groups in this file.
(Not just with my files, also readelf'd the Lenovo ones committed to
linux-firmware, same deal.)
Thanks,
~val
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH] soc: qcom: mdt_loader: Fix error return values in mdt_header_valid()
2025-06-25 15:22 [PATCH] soc: qcom: mdt_loader: Fix error return values in mdt_header_valid() Dan Carpenter
2025-06-25 15:32 ` Konrad Dybcio
2025-07-21 23:35 ` Val Packett
@ 2025-07-23 14:46 ` neil.armstrong
2025-07-23 15:46 ` Neil Armstrong
2 siblings, 1 reply; 7+ messages in thread
From: neil.armstrong @ 2025-07-23 14:46 UTC (permalink / raw)
To: Dan Carpenter, Bjorn Andersson
Cc: Konrad Dybcio, Dmitry Baryshkov, linux-arm-msm, linux-kernel,
kernel-janitors
Hi,
On 25/06/2025 17:22, Dan Carpenter wrote:
> This function is supposed to return true for valid headers and false for
> invalid. In a couple places it returns -EINVAL instead which means the
> invalid headers are counted as true. Change it to return false.
>
> Fixes: 9f9967fed9d0 ("soc: qcom: mdt_loader: Ensure we don't read past the ELF header")
> Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
> ---
> drivers/soc/qcom/mdt_loader.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/soc/qcom/mdt_loader.c b/drivers/soc/qcom/mdt_loader.c
> index 1b4ebae458f3..0ca268bdf1f8 100644
> --- a/drivers/soc/qcom/mdt_loader.c
> +++ b/drivers/soc/qcom/mdt_loader.c
> @@ -33,14 +33,14 @@ static bool mdt_header_valid(const struct firmware *fw)
> return false;
>
> if (ehdr->e_phentsize != sizeof(struct elf32_phdr))
> - return -EINVAL;
> + return false;
>
> phend = size_add(size_mul(sizeof(struct elf32_phdr), ehdr->e_phnum), ehdr->e_phoff);
> if (phend > fw->size)
> return false;
>
> if (ehdr->e_shentsize != sizeof(struct elf32_shdr))
> - return -EINVAL;
> + return false;
>
> shend = size_add(size_mul(sizeof(struct elf32_shdr), ehdr->e_shnum), ehdr->e_shoff);
> if (shend > fw->size)
This patch on linux-next breaks loading DSP firmwares on at least SM8550, SM8650, X1E8:
[ 7.572665] remoteproc remoteproc1: Booting fw image qcom/sm8550/adsp.mbn, size 28342616
[ 7.615176] remoteproc remoteproc1: Failed to load program segments: -22
CI runs:
https://git.codelinaro.org/linaro/qcomlt/ci/staging/cdba-tester/-/jobs/248846#L1323
https://git.codelinaro.org/linaro/qcomlt/ci/staging/cdba-tester/-/jobs/248850#L2037
Bisect log:
# bad: [a933d3dc1968fcfb0ab72879ec304b1971ed1b9a] Add linux-next specific files for 20250723
# good: [89be9a83ccf1f88522317ce02f854f30d6115c41] Linux 6.16-rc7
git bisect start 'a933d3dc1968fcfb0ab72879ec304b1971ed1b9a' 'v6.16-rc7'
# bad: [a56f8f8967ad980d45049973561b89dcd9e37e5d] Merge branch 'main' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git
git bisect bad a56f8f8967ad980d45049973561b89dcd9e37e5d
# bad: [f6a8dede4030970707e9bae5b3ae76f60df4b75a] Merge branch 'fs-next' of linux-next
git bisect bad f6a8dede4030970707e9bae5b3ae76f60df4b75a
# bad: [b863560c5a26fbcf164f5759c98bb5e72e26848d] Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc.git
git bisect bad b863560c5a26fbcf164f5759c98bb5e72e26848d
# good: [6fe8797df6f2e3a7e3c736d5bd4862915a06a690] Merge branch 'for-next/core' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux
git bisect good 6fe8797df6f2e3a7e3c736d5bd4862915a06a690
# good: [c522d00e1b4b00c5224c2acb9c2738bcc9c04ff5] Merge tag 'ti-k3-dt-for-v6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/ti/linux into soc/dt
git bisect good c522d00e1b4b00c5224c2acb9c2738bcc9c04ff5
# good: [6a323f22a8b925f3646c884e2f9c733c79393f1d] Merge branch 'soc/drivers' into for-next
git bisect good 6a323f22a8b925f3646c884e2f9c733c79393f1d
# good: [5d8b3562faac8030b5c26efc1cd739a41c4db722] Merge branch 'soc/dt' into for-next
git bisect good 5d8b3562faac8030b5c26efc1cd739a41c4db722
# bad: [b79c0d780e519d760c2529f0bf849111b9270192] Merge tag 'apple-soc-drivers-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/sven/linux into soc/drivers
git bisect bad b79c0d780e519d760c2529f0bf849111b9270192
# good: [9841d92754d0f3846977a39844c3395ee2463381] Merge tag 'memory-controller-drv-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-mem-ctrl into soc/drivers
git bisect good 9841d92754d0f3846977a39844c3395ee2463381
# good: [64a026dd896e423a177fe87e11aa69bf5348c27b] soc: qcom: socinfo: Add support to retrieve TME build details
git bisect good 64a026dd896e423a177fe87e11aa69bf5348c27b
# good: [9cea10a4f5a39fde32bf7b8addfa5f9175174e0e] dt-bindings: sram: qcom,imem: Add a number of missing compatibles
git bisect good 9cea10a4f5a39fde32bf7b8addfa5f9175174e0e
# good: [0445eee835d6e59d635e242ba1d9273f168035fa] soc: apple: rtkit: Make shmem_destroy optional
git bisect good 0445eee835d6e59d635e242ba1d9273f168035fa
# bad: [5b8141596b06fba7313cdfbd5f589649d7fde662] Merge tag 'qcom-drivers-for-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/drivers
git bisect bad 5b8141596b06fba7313cdfbd5f589649d7fde662
# bad: [9f35ab0e53ccbea57bb9cbad8065e0406d516195] soc: qcom: mdt_loader: Fix error return values in mdt_header_valid()
git bisect bad 9f35ab0e53ccbea57bb9cbad8065e0406d516195
# first bad commit: [9f35ab0e53ccbea57bb9cbad8065e0406d516195] soc: qcom: mdt_loader: Fix error return values in mdt_header_valid()
Neil
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH] soc: qcom: mdt_loader: Fix error return values in mdt_header_valid()
2025-07-23 14:46 ` neil.armstrong
@ 2025-07-23 15:46 ` Neil Armstrong
2025-07-23 16:16 ` Akhil P Oommen
0 siblings, 1 reply; 7+ messages in thread
From: Neil Armstrong @ 2025-07-23 15:46 UTC (permalink / raw)
To: Dan Carpenter, Bjorn Andersson
Cc: Konrad Dybcio, Dmitry Baryshkov, linux-arm-msm, linux-kernel,
kernel-janitors
On 23/07/2025 16:46, neil.armstrong@linaro.org wrote:
> Hi,
>
> On 25/06/2025 17:22, Dan Carpenter wrote:
>> This function is supposed to return true for valid headers and false for
>> invalid. In a couple places it returns -EINVAL instead which means the
>> invalid headers are counted as true. Change it to return false.
>>
>> Fixes: 9f9967fed9d0 ("soc: qcom: mdt_loader: Ensure we don't read past the ELF header")
>> Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
>> ---
>> drivers/soc/qcom/mdt_loader.c | 4 ++--
>> 1 file changed, 2 insertions(+), 2 deletions(-)
>>
>> diff --git a/drivers/soc/qcom/mdt_loader.c b/drivers/soc/qcom/mdt_loader.c
>> index 1b4ebae458f3..0ca268bdf1f8 100644
>> --- a/drivers/soc/qcom/mdt_loader.c
>> +++ b/drivers/soc/qcom/mdt_loader.c
>> @@ -33,14 +33,14 @@ static bool mdt_header_valid(const struct firmware *fw)
>> return false;
>> if (ehdr->e_phentsize != sizeof(struct elf32_phdr))
>> - return -EINVAL;
>> + return false;
>> phend = size_add(size_mul(sizeof(struct elf32_phdr), ehdr->e_phnum), ehdr->e_phoff);
>> if (phend > fw->size)
>> return false;
>> if (ehdr->e_shentsize != sizeof(struct elf32_shdr))
>> - return -EINVAL;
>> + return false;
>> shend = size_add(size_mul(sizeof(struct elf32_shdr), ehdr->e_shnum), ehdr->e_shoff);
>> if (shend > fw->size)
>
> This patch on linux-next breaks loading DSP firmwares on at least SM8550, SM8650, X1E8:
>
> [ 7.572665] remoteproc remoteproc1: Booting fw image qcom/sm8550/adsp.mbn, size 28342616
> [ 7.615176] remoteproc remoteproc1: Failed to load program segments: -22
It also breaks GMU loading on the same platforms:
[ 7.418330] msm_dpu ae01000.display-controller: [drm:adreno_load_gpu [msm]] *ERROR* gpu hw init failed: -22
Neil
>
> CI runs:
> https://git.codelinaro.org/linaro/qcomlt/ci/staging/cdba-tester/-/jobs/248846#L1323
> https://git.codelinaro.org/linaro/qcomlt/ci/staging/cdba-tester/-/jobs/248850#L2037
>
> Bisect log:
> # bad: [a933d3dc1968fcfb0ab72879ec304b1971ed1b9a] Add linux-next specific files for 20250723
> # good: [89be9a83ccf1f88522317ce02f854f30d6115c41] Linux 6.16-rc7
> git bisect start 'a933d3dc1968fcfb0ab72879ec304b1971ed1b9a' 'v6.16-rc7'
> # bad: [a56f8f8967ad980d45049973561b89dcd9e37e5d] Merge branch 'main' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git
> git bisect bad a56f8f8967ad980d45049973561b89dcd9e37e5d
> # bad: [f6a8dede4030970707e9bae5b3ae76f60df4b75a] Merge branch 'fs-next' of linux-next
> git bisect bad f6a8dede4030970707e9bae5b3ae76f60df4b75a
> # bad: [b863560c5a26fbcf164f5759c98bb5e72e26848d] Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc.git
> git bisect bad b863560c5a26fbcf164f5759c98bb5e72e26848d
> # good: [6fe8797df6f2e3a7e3c736d5bd4862915a06a690] Merge branch 'for-next/core' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux
> git bisect good 6fe8797df6f2e3a7e3c736d5bd4862915a06a690
> # good: [c522d00e1b4b00c5224c2acb9c2738bcc9c04ff5] Merge tag 'ti-k3-dt-for-v6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/ti/linux into soc/dt
> git bisect good c522d00e1b4b00c5224c2acb9c2738bcc9c04ff5
> # good: [6a323f22a8b925f3646c884e2f9c733c79393f1d] Merge branch 'soc/drivers' into for-next
> git bisect good 6a323f22a8b925f3646c884e2f9c733c79393f1d
> # good: [5d8b3562faac8030b5c26efc1cd739a41c4db722] Merge branch 'soc/dt' into for-next
> git bisect good 5d8b3562faac8030b5c26efc1cd739a41c4db722
> # bad: [b79c0d780e519d760c2529f0bf849111b9270192] Merge tag 'apple-soc-drivers-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/sven/linux into soc/drivers
> git bisect bad b79c0d780e519d760c2529f0bf849111b9270192
> # good: [9841d92754d0f3846977a39844c3395ee2463381] Merge tag 'memory-controller-drv-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/krzk/linux-mem-ctrl into soc/drivers
> git bisect good 9841d92754d0f3846977a39844c3395ee2463381
> # good: [64a026dd896e423a177fe87e11aa69bf5348c27b] soc: qcom: socinfo: Add support to retrieve TME build details
> git bisect good 64a026dd896e423a177fe87e11aa69bf5348c27b
> # good: [9cea10a4f5a39fde32bf7b8addfa5f9175174e0e] dt-bindings: sram: qcom,imem: Add a number of missing compatibles
> git bisect good 9cea10a4f5a39fde32bf7b8addfa5f9175174e0e
> # good: [0445eee835d6e59d635e242ba1d9273f168035fa] soc: apple: rtkit: Make shmem_destroy optional
> git bisect good 0445eee835d6e59d635e242ba1d9273f168035fa
> # bad: [5b8141596b06fba7313cdfbd5f589649d7fde662] Merge tag 'qcom-drivers-for-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux into soc/drivers
> git bisect bad 5b8141596b06fba7313cdfbd5f589649d7fde662
> # bad: [9f35ab0e53ccbea57bb9cbad8065e0406d516195] soc: qcom: mdt_loader: Fix error return values in mdt_header_valid()
> git bisect bad 9f35ab0e53ccbea57bb9cbad8065e0406d516195
> # first bad commit: [9f35ab0e53ccbea57bb9cbad8065e0406d516195] soc: qcom: mdt_loader: Fix error return values in mdt_header_valid()
>
> Neil
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH] soc: qcom: mdt_loader: Fix error return values in mdt_header_valid()
2025-07-23 15:46 ` Neil Armstrong
@ 2025-07-23 16:16 ` Akhil P Oommen
0 siblings, 0 replies; 7+ messages in thread
From: Akhil P Oommen @ 2025-07-23 16:16 UTC (permalink / raw)
To: Neil Armstrong, Dan Carpenter, Bjorn Andersson
Cc: Konrad Dybcio, Dmitry Baryshkov, linux-arm-msm, linux-kernel,
kernel-janitors
On 7/23/2025 9:16 PM, Neil Armstrong wrote:
> On 23/07/2025 16:46, neil.armstrong@linaro.org wrote:
>> Hi,
>>
>> On 25/06/2025 17:22, Dan Carpenter wrote:
>>> This function is supposed to return true for valid headers and false for
>>> invalid. In a couple places it returns -EINVAL instead which means the
>>> invalid headers are counted as true. Change it to return false.
>>>
>>> Fixes: 9f9967fed9d0 ("soc: qcom: mdt_loader: Ensure we don't read
>>> past the ELF header")
>>> Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
>>> ---
>>> drivers/soc/qcom/mdt_loader.c | 4 ++--
>>> 1 file changed, 2 insertions(+), 2 deletions(-)
>>>
>>> diff --git a/drivers/soc/qcom/mdt_loader.c b/drivers/soc/qcom/
>>> mdt_loader.c
>>> index 1b4ebae458f3..0ca268bdf1f8 100644
>>> --- a/drivers/soc/qcom/mdt_loader.c
>>> +++ b/drivers/soc/qcom/mdt_loader.c
>>> @@ -33,14 +33,14 @@ static bool mdt_header_valid(const struct
>>> firmware *fw)
>>> return false;
>>> if (ehdr->e_phentsize != sizeof(struct elf32_phdr))
>>> - return -EINVAL;
>>> + return false;
>>> phend = size_add(size_mul(sizeof(struct elf32_phdr), ehdr-
>>> >e_phnum), ehdr->e_phoff);
>>> if (phend > fw->size)
>>> return false;
>>> if (ehdr->e_shentsize != sizeof(struct elf32_shdr))
>>> - return -EINVAL;
>>> + return false;
>>> shend = size_add(size_mul(sizeof(struct elf32_shdr), ehdr-
>>> >e_shnum), ehdr->e_shoff);
>>> if (shend > fw->size)
>>
>> This patch on linux-next breaks loading DSP firmwares on at least
>> SM8550, SM8650, X1E8:
>>
>> [ 7.572665] remoteproc remoteproc1: Booting fw image qcom/sm8550/
>> adsp.mbn, size 28342616
>> [ 7.615176] remoteproc remoteproc1: Failed to load program
>> segments: -22
>
> It also breaks GMU loading on the same platforms:
we don't use mdt_loader for GMU fw. This must be due to the zap fw
loading has some issues with this change.
-Akhil
> [ 7.418330] msm_dpu ae01000.display-controller: [drm:adreno_load_gpu
> [msm]] *ERROR* gpu hw init failed: -22
>
> Neil
>
>>
>> CI runs:
>> https://git.codelinaro.org/linaro/qcomlt/ci/staging/cdba-tester/-/
>> jobs/248846#L1323
>> https://git.codelinaro.org/linaro/qcomlt/ci/staging/cdba-tester/-/
>> jobs/248850#L2037
>>
>> Bisect log:
>> # bad: [a933d3dc1968fcfb0ab72879ec304b1971ed1b9a] Add linux-next
>> specific files for 20250723
>> # good: [89be9a83ccf1f88522317ce02f854f30d6115c41] Linux 6.16-rc7
>> git bisect start 'a933d3dc1968fcfb0ab72879ec304b1971ed1b9a' 'v6.16-rc7'
>> # bad: [a56f8f8967ad980d45049973561b89dcd9e37e5d] Merge branch 'main'
>> of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git
>> git bisect bad a56f8f8967ad980d45049973561b89dcd9e37e5d
>> # bad: [f6a8dede4030970707e9bae5b3ae76f60df4b75a] Merge branch 'fs-
>> next' of linux-next
>> git bisect bad f6a8dede4030970707e9bae5b3ae76f60df4b75a
>> # bad: [b863560c5a26fbcf164f5759c98bb5e72e26848d] Merge branch 'for-
>> next' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc.git
>> git bisect bad b863560c5a26fbcf164f5759c98bb5e72e26848d
>> # good: [6fe8797df6f2e3a7e3c736d5bd4862915a06a690] Merge branch 'for-
>> next/core' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux
>> git bisect good 6fe8797df6f2e3a7e3c736d5bd4862915a06a690
>> # good: [c522d00e1b4b00c5224c2acb9c2738bcc9c04ff5] Merge tag 'ti-k3-
>> dt-for-v6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/ti/
>> linux into soc/dt
>> git bisect good c522d00e1b4b00c5224c2acb9c2738bcc9c04ff5
>> # good: [6a323f22a8b925f3646c884e2f9c733c79393f1d] Merge branch 'soc/
>> drivers' into for-next
>> git bisect good 6a323f22a8b925f3646c884e2f9c733c79393f1d
>> # good: [5d8b3562faac8030b5c26efc1cd739a41c4db722] Merge branch 'soc/
>> dt' into for-next
>> git bisect good 5d8b3562faac8030b5c26efc1cd739a41c4db722
>> # bad: [b79c0d780e519d760c2529f0bf849111b9270192] Merge tag 'apple-
>> soc-drivers-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/
>> sven/linux into soc/drivers
>> git bisect bad b79c0d780e519d760c2529f0bf849111b9270192
>> # good: [9841d92754d0f3846977a39844c3395ee2463381] Merge tag 'memory-
>> controller-drv-6.17' of https://git.kernel.org/pub/scm/linux/kernel/
>> git/krzk/linux-mem-ctrl into soc/drivers
>> git bisect good 9841d92754d0f3846977a39844c3395ee2463381
>> # good: [64a026dd896e423a177fe87e11aa69bf5348c27b] soc: qcom: socinfo:
>> Add support to retrieve TME build details
>> git bisect good 64a026dd896e423a177fe87e11aa69bf5348c27b
>> # good: [9cea10a4f5a39fde32bf7b8addfa5f9175174e0e] dt-bindings: sram:
>> qcom,imem: Add a number of missing compatibles
>> git bisect good 9cea10a4f5a39fde32bf7b8addfa5f9175174e0e
>> # good: [0445eee835d6e59d635e242ba1d9273f168035fa] soc: apple: rtkit:
>> Make shmem_destroy optional
>> git bisect good 0445eee835d6e59d635e242ba1d9273f168035fa
>> # bad: [5b8141596b06fba7313cdfbd5f589649d7fde662] Merge tag 'qcom-
>> drivers-for-6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/
>> qcom/linux into soc/drivers
>> git bisect bad 5b8141596b06fba7313cdfbd5f589649d7fde662
>> # bad: [9f35ab0e53ccbea57bb9cbad8065e0406d516195] soc: qcom:
>> mdt_loader: Fix error return values in mdt_header_valid()
>> git bisect bad 9f35ab0e53ccbea57bb9cbad8065e0406d516195
>> # first bad commit: [9f35ab0e53ccbea57bb9cbad8065e0406d516195] soc:
>> qcom: mdt_loader: Fix error return values in mdt_header_valid()
>>
>> Neil
>
>
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH] soc: qcom: mdt_loader: Fix error return values in mdt_header_valid()
2025-07-21 23:35 ` Val Packett
@ 2025-08-05 9:32 ` Dan Carpenter
0 siblings, 0 replies; 7+ messages in thread
From: Dan Carpenter @ 2025-08-05 9:32 UTC (permalink / raw)
To: Val Packett, Neil Armstrong
Cc: Bjorn Andersson, Konrad Dybcio, Dmitry Baryshkov, linux-arm-msm,
linux-kernel, kernel-janitors, Neil Armstrong
On Mon, Jul 21, 2025 at 08:35:22PM -0300, Val Packett wrote:
> Hi,
>
> On 6/25/25 12:22 PM, Dan Carpenter wrote:
> > This function is supposed to return true for valid headers and false for
> > invalid. In a couple places it returns -EINVAL instead which means the
> > invalid headers are counted as true. Change it to return false.
> [..]
> > if (ehdr->e_shentsize != sizeof(struct elf32_shdr))
> > - return -EINVAL;
> > + return false;
> > shend = size_add(size_mul(sizeof(struct elf32_shdr), ehdr->e_shnum), ehdr->e_shoff);
> > if (shend > fw->size)
>
> this has broken all firmware loading on my x1e laptop (Dell Latitude 7455).
>
> Apparently e_shentsize is always 0 in Qualcomm firmware files.
>
> Confirmed externally with readelf:
>
> % readelf --all
> /lib/firmware/qcom/x1e80100/dell/latitude-7455/qcadsp8380.mbn
> [..]
> Start of program headers: 52 (bytes into file)
> Start of section headers: 0 (bytes into file)
> Flags: 0x73
> Size of this header: 52 (bytes)
> Size of program headers: 32 (bytes)
> Number of program headers: 58
> Size of section headers: 0 (bytes)
> Number of section headers: 0
> Section header string table index: 0
>
> There are no sections in this file.
>
> There are no section groups in this file.
>
>
> (Not just with my files, also readelf'd the Lenovo ones committed to
> linux-firmware, same deal.)
Thanks Val,
What a great bug report! Could you please try the patch I just sent.
Neil, I forgot to CC you. Sorry!
https://lore.kernel.org/all/5d392867c81da4b667f61430d3aa7065f61b7096.1754385120.git.dan.carpenter@linaro.org/
regards,
dan carpenter
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2025-08-05 9:32 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-06-25 15:22 [PATCH] soc: qcom: mdt_loader: Fix error return values in mdt_header_valid() Dan Carpenter
2025-06-25 15:32 ` Konrad Dybcio
2025-07-21 23:35 ` Val Packett
2025-08-05 9:32 ` Dan Carpenter
2025-07-23 14:46 ` neil.armstrong
2025-07-23 15:46 ` Neil Armstrong
2025-07-23 16:16 ` Akhil P Oommen
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).