[PATCH] drm/panthor: reject zero-sized firmware sections

[Osama Abdelkader]

panthor_fw_load_section_entry() skips BO creation when the firmware section
VA range is empty. The section is still added to the firmware section list,
leaving section->mem as NULL.

Later reload and unplug paths iterate over all firmware sections and
dereference section->mem, which can lead to a NULL pointer dereference.

Reject zero-sized firmware sections before adding them to the section list.

Fixes: 2718d91816ee ("drm/panthor: Add the FW logical block")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Osama Abdelkader <osama.abdelkader@xxxxxxxxx>
---
 drivers/gpu/drm/panthor/panthor_fw.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/gpu/drm/panthor/panthor_fw.c b/drivers/gpu/drm/panthor/panthor_fw.c
index a338c4f0a7f5..6335893d3f16 100644
--- a/drivers/gpu/drm/panthor/panthor_fw.c
+++ b/drivers/gpu/drm/panthor/panthor_fw.c
@@ -596,6 +596,11 @@ static int panthor_fw_load_section_entry(struct panthor_device *ptdev,
 	}
 
 	section_size = hdr.va.end - hdr.va.start;
+	if (!section_size) {
+		drm_err(&ptdev->base, "Firmware corrupted, zero-sized section\n");
+		return -EINVAL;
+	}
+
 	data_size = hdr.data.end - hdr.data.start;
 	if (data_size > section_size) {
 		drm_err(&ptdev->base, "Firmware corrupted, section data exceeds section size\n");
-- 
2.43.0