On 20/07/2026 12:30, Osama Abdelkader wrote:
> panthor_fw_load_section_entry() skips BO creation when the firmware section
> VA range is empty. The section is still added to the firmware section list,
> leaving section->mem as NULL.
>
> Later reload and unplug paths iterate over all firmware sections and
> dereference section->mem, which can lead to a NULL pointer dereference.
Good catch.
> Reject zero-sized firmware sections before adding them to the section list.
Sadly we were trying to support zero-sized sections - hence the "if
(section_size)" further down.
I think it would probably be better to just not add the section to the
list if it's zero sized and otherwise accept the firmware.
Thanks,
Steve
> Fixes: 2718d91816ee ("drm/panthor: Add the FW logical block")
> Cc: [email protected]
> Signed-off-by: Osama Abdelkader <[email protected]>
> ---
> drivers/gpu/drm/panthor/panthor_fw.c | 5 +++++
> 1 file changed, 5 insertions(+)
>
> diff --git a/drivers/gpu/drm/panthor/panthor_fw.c
> b/drivers/gpu/drm/panthor/panthor_fw.c
> index a338c4f0a7f5..6335893d3f16 100644
> --- a/drivers/gpu/drm/panthor/panthor_fw.c
> +++ b/drivers/gpu/drm/panthor/panthor_fw.c
> @@ -596,6 +596,11 @@ static int panthor_fw_load_section_entry(struct
> panthor_device *ptdev,
> }
>
> section_size = hdr.va.end - hdr.va.start;
> + if (!section_size) {
> + drm_err(&ptdev->base, "Firmware corrupted, zero-sized
> section\n");
> + return -EINVAL;
> + }
> +
> data_size = hdr.data.end - hdr.data.start;
> if (data_size > section_size) {
> drm_err(&ptdev->base, "Firmware corrupted, section data exceeds
> section size\n");
