From nobody Fri Jul 24 20:48:47 2026 Received: from mail-wr1-f48.google.com (mail-wr1-f48.google.com [209.85.221.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9F36C44C642 for ; Fri, 24 Jul 2026 17:26:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.48 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784913992; cv=none; b=RZPNwHq8RA2jTy/OEUZIfteW44+Py1FaralpBzqxtarsFWvPPUWPkDKgkjJJIam9rlcFxhjkMujxwkwPtu1sji1uD+q+scJPuL0qazaI7tvy5Ss+VAjEX0AL1zyUVooHqdJuvqsv9Ad192zMKnn8nvQ3RFKouFYqfahESJu9m8M= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784913992; c=relaxed/simple; bh=VCprKjKopLE70ZKvyvvnzLiG0vQtjLlAe1X/dFaDbdQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=eFVEfu2aJ8f5zCX5koCdl/jLjvOWh6is8rx4O1vUsB7Pd1znFDSZikJGsE2/dh71MiPeprtPr5iadO1QJRUAIYgoScKMBswog/NKzpLJmvZ3MxGsKYyILB8EiBeCfSpQIoy9Cu+Zc3c0E2aJP9Ro+A6man0ABqBB3Zpgqeskjj8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=sBaNMnnT; arc=none smtp.client-ip=209.85.221.48 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="sBaNMnnT" Received: by mail-wr1-f48.google.com with SMTP id ffacd0b85a97d-47f96c5b722so512766f8f.0 for ; Fri, 24 Jul 2026 10:26:27 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784913985; x=1785518785; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=ohKPnFyz+LLapn/ZZQ/A2iwQbIU5uk0jaD/t+e7o7KM=; b=sBaNMnnTmpvPLCk6Jco77s3g0XMYYkJbBZQQFRnnkT5c4b0soXkYtwGu7/iRO2DeYH D7HP/gqQF2qBA6dOFDbT5XS8DA4866urjp70bXjc892gSOfaOqP+29j5qnSkI6nWgUVe OgJQAnNCmyGT7sMDlD6gwjlLKXpJ66jny+cAbMfJY1cUPbE0QAuD6hdFe6MIznQZX5Wm oTgqcnguqd3wCDI+Z6ZJbiGO3/RKAvXqu2rN3cMV3rTEnou8SnqCxFVOZubuVOdcDvBe MP3mvBSDD9fF9frXo5YvVsBewnYN/l9Ow2YaHZG69MyzUuiH6sWK9jUZFmjfe1/RE5vz KpUQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784913985; x=1785518785; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=ohKPnFyz+LLapn/ZZQ/A2iwQbIU5uk0jaD/t+e7o7KM=; b=T+jN/K6jrbojCIaZd9hCBfsMD1itFmEbWYHhJyeBw36L5leaTNA5zaSy+UWq92E4cm e6bQ9dXW9UMmzsalJlVkdAi8aHcNhEiy2y5vnwa4EITm34koszyE6t+Tl3Lpt++OCdRR eoX/ks9dMmOc1/BVeZuLT+8vMKkDEJvYxM1j3v7ZaZjitvPGnQ4UJ1HqDvPrqDrct7WG 0RA7/rgR3gZ1lqnYkFI/qGN3VfVIWtbogqF3tY/cmWLFwZAb40MlmyyPSelE2xjhQCsg /EbJ0aI98oIY8YP+uWulRZs4P8drdZNgegN9NnQ27+JDYakPrCUZ7zvZev1X7s/PuPM0 YLdw== X-Forwarded-Encrypted: i=1; AHgh+Rr1w+x9UOzc7sm3mwyMDZ6ou5BOC++oaKYGllKMvPNOl4VivjCI3aJYt5vql3SMSJUovRH5LVI1e93eRnw=@vger.kernel.org X-Gm-Message-State: AOJu0YzPb+i6Ofpa+B6oBTnDVJL9lm2Dn13dyShGOkG2ETbe34pRVjrL 8gpdrUxHNMGtCVv5uRhitR160GVsaMkhvy1qRxk3BpZBIciF7KViKhna X-Gm-Gg: AR+sD11SJf42N2GJftpweXCq5IJJISwhdTZrGiqm5/YwUMUVyU/hSta6To1iVKuOd/M SuCt8m+Sz4qpYk3QuUtPtRTpZSIkIAz5izIVpzOc7MXFxO1f66A86FaeMEQRKbkQFr6GeMe73Es bXbq9ZgiOuBWgYx67qcKd+Rcjowzh+gLJyoBzSxoYM1Kh+EJM9BuuB2HuWv/DGqFOIrYNBih7XM iSNBu4CTSc1lKJ+y/DWvhJJ8bhPQExiEd9Hi5pq7lDssoAkfgUP1Ne/uzZRSgvTdXznOPOCViM8 v1y0pJfxLGyiFGIoN2U8Nhv1u28NyS8lOIsxgQUKYiizMXLco/q3ORkB6SPL6zwzkETEKMr7nJx C+BLzokOlI1BXzKCLFgR5SYa6tRb1dSroEiCaJ/nRWVSXwCs6aGZGKV8IRef7xkNVPmFtc/pEAF l/gue4YOAnC7OEeK23XLIao5ycq9W8eKQgwHbp9NU4GpE4cYkpOg== X-Received: by 2002:a05:600c:468e:b0:495:7a36:bf5c with SMTP id 5b1f17b1804b1-4957a36bffbmr59403685e9.10.1784913984948; Fri, 24 Jul 2026 10:26:24 -0700 (PDT) Received: from osama.. ([2a02:908:185:7e40:f13b:d8f5:8fee:f758]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-496b4858e28sm5411665e9.2.2026.07.24.10.26.23 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 24 Jul 2026 10:26:24 -0700 (PDT) From: Osama Abdelkader To: Boris Brezillon , Steven Price , Liviu Dudau , Maarten Lankhorst , Maxime Ripard , Thomas Zimmermann , David Airlie , Simona Vetter , Heiko Stuebner , dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org Cc: Osama Abdelkader , stable@vger.kernel.org Subject: [PATCH v2] drm/panthor: skip zero-sized firmware sections Date: Fri, 24 Jul 2026 19:26:20 +0200 Message-ID: <20260724172621.63046-1-osama.abdelkader@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" panthor_fw_load_section_entry() skips BO creation when the firmware section VA range is empty. If such a section is added to the firmware section list, section->mem is left as NULL. Later reload and unplug paths iterate over all firmware sections and dereference section->mem, which can lead to a NULL pointer dereference. Zero-sized firmware sections are valid, so accept them as no-op entries but skip adding them to the section list. Fixes: 2718d91816ee ("drm/panthor: Add the FW logical block") Cc: stable@vger.kernel.org Signed-off-by: Osama Abdelkader --- drivers/gpu/drm/panthor/panthor_fw.c | 4 ++++ 1 file changed, 4 insertions(+) v2: - Accept zero-sized firmware sections as no-op entries instead of rejecting them, as suggested by Steven. diff --git a/drivers/gpu/drm/panthor/panthor_fw.c b/drivers/gpu/drm/panthor= /panthor_fw.c index a338c4f0a7f5..66d9f5947af0 100644 --- a/drivers/gpu/drm/panthor/panthor_fw.c +++ b/drivers/gpu/drm/panthor/panthor_fw.c @@ -601,8 +601,11 @@ static int panthor_fw_load_section_entry(struct pantho= r_device *ptdev, if (data_size > section_size) { drm_err(&ptdev->base, "Firmware corrupted, section data exceeds section = size\n"); return -EINVAL; } =20 + if (!section_size) + return 0; + name_len =3D iter->size - iter->offset; =20 section =3D drmm_kzalloc(&ptdev->base, sizeof(*section), GFP_KERNEL); --=20 2.43.0