Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider: - [High] firmware: qcom: pas: missing qcom_pas_metadata_release() leaks TZ/DMA memory - [Medium] devres: memory leak due to repeated devm_qcom_pas_context_alloc() on fw reload --
commit bb3acb8beaa539b1cfa0975914c1f8fd75747e36 Author: Mukesh Ojha <[email protected]> media: iris: migrate firmware loading to qcom_mdt_pas_load() and qcom_pas_prepare_and_auth_reset() iris_load_fw_to_memory() calls qcom_mdt_load() which bundles metadata init, memory setup, and segment loading with no PAS context, and iris_fw_load() calls qcom_pas_auth_and_reset() which skips the shmbridge prepare step required before TrustZone authentication. > diff --git a/drivers/media/platform/qcom/iris/iris_firmware.c > b/drivers/media/platform/qcom/iris/iris_firmware.c > index 21cdf1c398357..e73a5dd98b88c 100644 > --- a/drivers/media/platform/qcom/iris/iris_firmware.c > +++ b/drivers/media/platform/qcom/iris/iris_firmware.c [ ... ] > @@ -134,21 +131,20 @@ static int iris_load_fw_to_memory(struct iris_core > *core) > core->iris_firmware_data = core->iris_firmware_desc->firmware_data; > > fw_size = qcom_mdt_get_size(firmware); > - if (fw_size < 0 || res_size < (size_t)fw_size) { > + if (fw_size < 0 || resource_size(&res) < (size_t)fw_size) { > ret = -EINVAL; > goto err_release_fw; > } > > - mem_virt = memremap(mem_phys, res_size, MEMREMAP_WC); > - if (!mem_virt) { > - ret = -ENOMEM; > + core->pas_ctx = devm_qcom_pas_context_alloc(dev, IRIS_PAS_ID, mem_phys, > + resource_size(&res)); [Severity: Medium] Will this leak device-managed memory when firmware is reloaded? If the hardware system error recovery path is triggered (for example, iris_sys_error_handler() calls iris_core_deinit() followed by iris_core_init() and iris_fw_load()), devm_qcom_pas_context_alloc() is called again unconditionally. This overwrites core->pas_ctx without freeing the old devres allocation. > + if (IS_ERR(core->pas_ctx)) { > + ret = PTR_ERR(core->pas_ctx); > + core->pas_ctx = NULL; > goto err_release_fw; > } > > - ret = qcom_mdt_load(dev, firmware, fw_name, > - IRIS_PAS_ID, mem_virt, mem_phys, res_size, NULL); > - > - memunmap(mem_virt); > + ret = qcom_mdt_pas_load(core->pas_ctx, firmware, fw_name, NULL); [Severity: High] Does this sequence leak DMA or TrustZone memory buffers allocated for firmware metadata? When qcom_mdt_pas_load() is called, the underlying PAS subsystem allocates a DMA buffer for the metadata and stores it in the PAS context. The PAS API contract dictates that callers must subsequently call qcom_pas_metadata_release(core->pas_ctx) to free this memory. Looking at iris_fw_load(), this step appears to be completely omitted on both success and error paths before the function returns. Because the DMA allocation is tied to the SCM device (not devres-managed for the iris driver), repeated firmware loads due to probe/unbind cycles or hardware errors could permanently exhaust restricted DMA or secure memory pools. > err_release_fw: > release_firmware(firmware); > > @@ -166,7 +162,7 @@ int iris_fw_load(struct iris_core *core) > return ret; > } > > - ret = qcom_pas_auth_and_reset(IRIS_PAS_ID); > + ret = qcom_pas_prepare_and_auth_reset(core->pas_ctx); > if (ret) { > dev_err(core->dev, "auth and reset failed: %d\n", ret); > return ret; -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=3
