Re: [PATCH v8 4/9] remoteproc: qcom_q6v5_pas: enable QMI TMD cooling support

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The dtb firmware requested in `qcom_pas_load()` is leaked on the success path.
--

--- Patch [4]: [PATCH v8 4/9] remoteproc: qcom_q6v5_pas: enable QMI TMD cooling support ---
commit 58dbaa804b582ef4740c9e6df30c9004a8e9ffae
Author: Gaurav Kohli <gaurav.kohli@oss.qualcomm.com>

remoteproc: qcom_q6v5_pas: enable QMI TMD cooling support

This commit enables Thermal Mitigation Device (TMD) support for PAS-managed
CDSP and modem remote processors on platforms exposing the QMI TMD service.
It adds per-platform TMD configurations and uses endpoint names for cooling
device registration. This allows the subsystems to act as cooling devices
in the thermal framework.

> diff --git a/drivers/remoteproc/qcom_q6v5_pas.c b/drivers/remoteproc/qcom_q6v5_pas.c
> index 24a766718b107..732fe2961a965 100644
> --- a/drivers/remoteproc/qcom_q6v5_pas.c
> +++ b/drivers/remoteproc/qcom_q6v5_pas.c

[ ... ]

> @@ -1366,6 +1387,9 @@ static const struct qcom_pas_data x1e80100_cdsp_resource = {
>  	.ssr_name = "cdsp",
>  	.sysmon_name = "cdsp",
>  	.ssctl_id = 0x17,
> +	.tmd_instance_id = 0x43,
> +	.tmd_name = cdsp_tmd_name,
> +	.num_tmd = ARRAY_SIZE(cdsp_tmd_name),
>  };

[Severity: High]
This isn't a bug introduced by this patch, but while reviewing it I
noticed a pre-existing memory leak in qcom_pas_load() that affects
devices like the x1e80100_cdsp_resource modified here.

When dtb_pas_id is set, qcom_pas_load() allocates dtb_firmware but
fails to release it on the success path:

drivers/remoteproc/qcom_q6v5_pas.c:qcom_pas_load() {
...
	if (pas->dtb_pas_id) {
		ret = request_firmware(&pas->dtb_firmware, pas->dtb_firmware_name, pas->dev);
...
		ret = qcom_mdt_pas_load(pas->dtb_pas_ctx, pas->dtb_firmware,
					pas->dtb_firmware_name, &pas->dtb_mem_reloc);
		if (ret) {
			qcom_pas_metadata_release(pas->dtb_pas_ctx);
			release_firmware(pas->dtb_firmware);
			return ret;
		}
	}

	return 0;
}

Can this leak the pas->dtb_firmware buffer on successful loads since
release_firmware() is only called in the error path?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260809-b4-qmi-tmd-v8-0-b15d47adc379@oss.qualcomm.com?part=4