Re: [PATCH 3/8] media: iris: migrate firmware loading to qcom_mdt_pas_load() and qcom_pas_prepare_and_auth_reset()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] firmware: qcom: pas: missing qcom_pas_metadata_release() leaks TZ/DMA memory
- [Medium] devres: memory leak due to repeated devm_qcom_pas_context_alloc() on fw reload
--

commit bb3acb8beaa539b1cfa0975914c1f8fd75747e36
Author: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>

media: iris: migrate firmware loading to qcom_mdt_pas_load() and qcom_pas_prepare_and_auth_reset()

iris_load_fw_to_memory() calls qcom_mdt_load() which bundles metadata
init, memory setup, and segment loading with no PAS context, and
iris_fw_load() calls qcom_pas_auth_and_reset() which skips the shmbridge
prepare step required before TrustZone authentication.

> diff --git a/drivers/media/platform/qcom/iris/iris_firmware.c b/drivers/media/platform/qcom/iris/iris_firmware.c
> index 21cdf1c398357..e73a5dd98b88c 100644
> --- a/drivers/media/platform/qcom/iris/iris_firmware.c
> +++ b/drivers/media/platform/qcom/iris/iris_firmware.c
[ ... ]
> @@ -134,21 +131,20 @@ static int iris_load_fw_to_memory(struct iris_core *core)
>  	core->iris_firmware_data = core->iris_firmware_desc->firmware_data;
>  
>  	fw_size = qcom_mdt_get_size(firmware);
> -	if (fw_size < 0 || res_size < (size_t)fw_size) {
> +	if (fw_size < 0 || resource_size(&res) < (size_t)fw_size) {
>  		ret = -EINVAL;
>  		goto err_release_fw;
>  	}
>  
> -	mem_virt = memremap(mem_phys, res_size, MEMREMAP_WC);
> -	if (!mem_virt) {
> -		ret = -ENOMEM;
> +	core->pas_ctx = devm_qcom_pas_context_alloc(dev, IRIS_PAS_ID, mem_phys,
> +						    resource_size(&res));

[Severity: Medium]
Will this leak device-managed memory when firmware is reloaded?

If the hardware system error recovery path is triggered (for example,
iris_sys_error_handler() calls iris_core_deinit() followed by
iris_core_init() and iris_fw_load()), devm_qcom_pas_context_alloc() is called
again unconditionally. This overwrites core->pas_ctx without freeing the old
devres allocation.

> +	if (IS_ERR(core->pas_ctx)) {
> +		ret = PTR_ERR(core->pas_ctx);
> +		core->pas_ctx = NULL;
>  		goto err_release_fw;
>  	}
>  
> -	ret = qcom_mdt_load(dev, firmware, fw_name,
> -			    IRIS_PAS_ID, mem_virt, mem_phys, res_size, NULL);
> -
> -	memunmap(mem_virt);
> +	ret = qcom_mdt_pas_load(core->pas_ctx, firmware, fw_name, NULL);

[Severity: High]
Does this sequence leak DMA or TrustZone memory buffers allocated for firmware
metadata?

When qcom_mdt_pas_load() is called, the underlying PAS subsystem allocates a
DMA buffer for the metadata and stores it in the PAS context. The PAS API
contract dictates that callers must subsequently call
qcom_pas_metadata_release(core->pas_ctx) to free this memory.

Looking at iris_fw_load(), this step appears to be completely omitted on both
success and error paths before the function returns. Because the DMA
allocation is tied to the SCM device (not devres-managed for the iris
driver), repeated firmware loads due to probe/unbind cycles or hardware
errors could permanently exhaust restricted DMA or secure memory pools.

>  err_release_fw:
>  	release_firmware(firmware);
>  
> @@ -166,7 +162,7 @@ int iris_fw_load(struct iris_core *core)
>  		return ret;
>  	}
>  
> -	ret = qcom_pas_auth_and_reset(IRIS_PAS_ID);
> +	ret = qcom_pas_prepare_and_auth_reset(core->pas_ctx);
>  	if (ret)  {
>  		dev_err(core->dev, "auth and reset failed: %d\n", ret);
>  		return ret;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260925155737.4161358-1-mukesh.ojha@oss.qualcomm.com?part=3