From nobody Sat Jul 25 02:38:48 2026 Received: from mail-wr1-f52.google.com (mail-wr1-f52.google.com [209.85.221.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B664739185E for ; Mon, 20 Jul 2026 11:31:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.52 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784547068; cv=none; b=OCX+osRWPhs4sJII1peGp3m/cqLCSZpUMa/wfjNyePr9bvlK/BhdZljE1wdogh4cZJIetIGP95ISdeEvVskWF63rV4LNQb/EjC7T95Tc86MbeCVntimerhfBGxALKkz2P3Zqdr0Nsy4N/rAKoICqcSWQrW6R79/QeXPBPwBRWlk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784547068; c=relaxed/simple; bh=DBIzwDmGdKvxBj5ozJZAkztG+cYx/GxYl1BdxuxuMZY=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=s7G098AaCsK2JgCpb01ZmQAfwRPUY5fKkgIeRJ86altWFk5uCVHbKubHWeQA+H55IGo3JjFF5hnLPBDwW0tmWcK1hsE3MAUzl3qlE0XJlsiMysxGEgwoL/EDuHlHlyoLz4OHWVrcZG8k+/2IbPFzNWV0n0zCyfFYiOhoECZ34zw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=QqQUm53B; arc=none smtp.client-ip=209.85.221.52 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="QqQUm53B" Received: by mail-wr1-f52.google.com with SMTP id ffacd0b85a97d-47f7854678cso340724f8f.1 for ; Mon, 20 Jul 2026 04:31:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784547065; x=1785151865; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=Kk/EdydNuPaevf5JbgU06sHPzz6RMAwoT7HsixFynpc=; b=QqQUm53B6RrXI0Fos3U0bPCAI2PoNn0CP0M5BhSW9krqRzIVIaFFwx2NX/OzZ7cQR7 1audHpXqjqQNBddU4NkUQcOQsw9jI4cU7btJenQTaXlw5d2znezq458DMVvDWE6tvLvx s2qyMdw8+Tytf6G3R0x2+0H7YCnfca/Szr1J1gguvRiMnckzrSbWK11U2B3E0NIFTfol Vba4R67zwa5o04jRMdXAc85ca/wz7X82s6ZLsBM6rarA6kGzICFNK+7Gjo1ILzDtIpiS zoY2FOvRjdoyOucaXzjSvjVAYC3nRaQaEnndzpZ5qnn7KbFR06msEF3hSDk5hUhSGtXG FYsg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784547065; x=1785151865; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=Kk/EdydNuPaevf5JbgU06sHPzz6RMAwoT7HsixFynpc=; b=RwxpWB7b5BwlocjWhfXHNXbgSY0NRN/tnlroQobJ6PmiGtLq1KIYdOkeYQbl9xtq+y raNpO23spXA19HCZJCds3e9Yj+6033raXewfcCCJWNh09UQHPWqF2v9U4fXy9J6cokXM Xv3VBw6rJL/r60QkfBp2x7Clg9OPLPLhp94z47BPLKZRF6Ac8CoT9AJ6e9+T8oblSxHb vvH3gaXNsODS5fvWw8dit5PUuC7+S5uz4/udYY5hCI0Xb3lpvCV1vDOxTQZhqKzLzWtM CoTSDxjg+/jwGAj3/YBEXQViyGUGUBW7NElfbYHMJa2+nCxr9humev1EaRMdfMi9sbmF FG3Q== X-Forwarded-Encrypted: i=1; AHgh+RonixTX4owGkwKfSewdoi2DtYV4PZQoYadMX1WxVVEmreAwC1WxpW1aBmTQDXT3j4uMcAVh6nXtNWz1FZ0=@vger.kernel.org X-Gm-Message-State: AOJu0YxkD2BJoCDYcxw+KPptJdi7P2dvD+VCFoxZDcNT1JW5IQhaDeae V2pTcUDA9IIR9P53mTkZ1qE9wbIgzem5d/EC9MO+H8ScrOmCQBfEjzNM3hUjlg== X-Gm-Gg: AR+sD12lSi+HqycJPEsAOJvv6YrC/svWqbIlji7ym4E+3GlywMFJa+3AX3v8b2afQrJ bEA9KGnX9C89po84kzEJqs2DomWEziv2sfxNXb6nycez28oT9kXLqsEoNrHENzur9ISLV5Hpdjo HbsUnXKFVLAKWCQ/CCx2eViqCgcPZ4NdhcYaUYipwr+Pl1D9YM1siq7ITkz9pekbrAOBwUun01p BuC2D/W9rdR+0y0ZLaSEcAT99wrxwDFpNviMYCiRovi3PRPEeJP09xs6PXezAiuUqPkZfZGI8Hb kn3YucFQkLXAbKOd4wsYY38HCdCAkmqcqyYp0O8cVUJvs+YU8CU9Ds2ZE/8enRqcvVaxbXDG3xJ hKY89y2uwRD+eQxkKj8n2WvvnfPmG1SorYP7U12AgebKie/tzVKoh8NtglduNvFT9rbj0AsFUPB eU3iBogAkPOYJxiQfqKtC+IULXWr99qMPMl03Jjw== X-Received: by 2002:adf:e192:0:b0:47f:5710:8cad with SMTP id ffacd0b85a97d-47f622f2a3fmr14665764f8f.4.1784547064514; Mon, 20 Jul 2026 04:31:04 -0700 (PDT) Received: from osama.. ([2a02:908:185:7e40:a26b:a888:7408:fac]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-47f63ed1911sm31098429f8f.22.2026.07.20.04.31.03 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 20 Jul 2026 04:31:03 -0700 (PDT) From: Osama Abdelkader To: Boris Brezillon , Steven Price , Liviu Dudau , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Heiko Stuebner , dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org Cc: Osama Abdelkader , stable@vger.kernel.org Subject: [PATCH] drm/panthor: reject zero-sized firmware sections Date: Mon, 20 Jul 2026 13:30:23 +0200 Message-ID: <20260720113024.11619-1-osama.abdelkader@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" panthor_fw_load_section_entry() skips BO creation when the firmware section VA range is empty. The section is still added to the firmware section list, leaving section->mem as NULL. Later reload and unplug paths iterate over all firmware sections and dereference section->mem, which can lead to a NULL pointer dereference. Reject zero-sized firmware sections before adding them to the section list. Fixes: 2718d91816ee ("drm/panthor: Add the FW logical block") Cc: stable@vger.kernel.org Signed-off-by: Osama Abdelkader --- drivers/gpu/drm/panthor/panthor_fw.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/gpu/drm/panthor/panthor_fw.c b/drivers/gpu/drm/panthor= /panthor_fw.c index a338c4f0a7f5..6335893d3f16 100644 --- a/drivers/gpu/drm/panthor/panthor_fw.c +++ b/drivers/gpu/drm/panthor/panthor_fw.c @@ -596,6 +596,11 @@ static int panthor_fw_load_section_entry(struct pantho= r_device *ptdev, } =20 section_size =3D hdr.va.end - hdr.va.start; + if (!section_size) { + drm_err(&ptdev->base, "Firmware corrupted, zero-sized section\n"); + return -EINVAL; + } + data_size =3D hdr.data.end - hdr.data.start; if (data_size > section_size) { drm_err(&ptdev->base, "Firmware corrupted, section data exceeds section = size\n"); --=20 2.43.0