panthor_fw_load_section_entry() skips BO creation when the firmware section
VA range is empty. The section is still added to the firmware section list,
leaving section->mem as NULL.
Later reload and unplug paths iterate over all firmware sections and
dereference section->mem, which can lead to a NULL pointer dereference.
Reject zero-sized firmware sections before adding them to the section list.
Fixes: 2718d91816ee ("drm/panthor: Add the FW logical block")
Cc: [email protected]
Signed-off-by: Osama Abdelkader <[email protected]>
---
drivers/gpu/drm/panthor/panthor_fw.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/gpu/drm/panthor/panthor_fw.c
b/drivers/gpu/drm/panthor/panthor_fw.c
index a338c4f0a7f5..6335893d3f16 100644
--- a/drivers/gpu/drm/panthor/panthor_fw.c
+++ b/drivers/gpu/drm/panthor/panthor_fw.c
@@ -596,6 +596,11 @@ static int panthor_fw_load_section_entry(struct
panthor_device *ptdev,
}
section_size = hdr.va.end - hdr.va.start;
+ if (!section_size) {
+ drm_err(&ptdev->base, "Firmware corrupted, zero-sized
section\n");
+ return -EINVAL;
+ }
+
data_size = hdr.data.end - hdr.data.start;
if (data_size > section_size) {
drm_err(&ptdev->base, "Firmware corrupted, section data exceeds
section size\n");
--
2.43.0
