CVE-2024-35994

In the Linux kernel, the following vulnerability has been resolved:
firmware: qcom: uefisecapp: Fix memory related IO errors and crashes It
turns out that while the QSEECOM APP_SEND command has specific fields for
request and response buffers, uefisecapp expects them both to be in a
single memory region. Failure to adhere to this has (so far) resulted in
either no response being written to the response buffer (causing an EIO to
be emitted down the line), the SCM call to fail with EINVAL (i.e., directly
from TZ/firmware), or the device to be hard-reset. While this issue can be
triggered deterministically, in the current form it seems to happen rather
sporadically (which is why it has gone unnoticed during earlier testing).
This is likely due to the two kzalloc() calls (for request and response)
being directly after each other. Which means that those likely return
consecutive regions most of the time, especially when not much else is
going on in the system. Fix this by allocating a single memory region for
both request and response buffers, properly aligning both structs inside
it. This unfortunately also means that the qcom_scm_qseecom_app_send()
interface needs to be restructured, as it should no longer map the DMA
regions separately. Therefore, move the responsibility of DMA allocation
(or mapping) to the caller.