[PATCH] remoteproc: qcom_q6v5_pas: release the DTB firmware after loading it

[Qianhui Xu]

qcom_pas_load() requests the DTB firmware into pas->dtb_firmware and
only releases it when qcom_mdt_pas_load() fails.  On the success path
nothing drops the reference and the pointer stays set, so every boot of
a remote processor that has a dtb image leaks the firmware buffer, and
a second boot overwrites the stale pointer and leaks it again.

qcom_pas_start() only needs pas->dtb_pas_ctx (it maps the spare carveout
and authenticates through the PAS context), so the firmware buffer can
be released as soon as it has been loaded.  Scope it to qcom_pas_load()
and drop the struct member.

Signed-off-by: Qianhui Xu <xiaqinghuan@xxxxxxxxxxxxxxxx>
---
 drivers/remoteproc/qcom_q6v5_pas.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/drivers/remoteproc/qcom_q6v5_pas.c b/drivers/remoteproc/qcom_q6v5_pas.c
index a005546c2..5a5dc5334 100644
--- a/drivers/remoteproc/qcom_q6v5_pas.c
+++ b/drivers/remoteproc/qcom_q6v5_pas.c
@@ -94,7 +94,6 @@ struct qcom_pas {
 	const char *info_name;
 
 	const struct firmware *firmware;
-	const struct firmware *dtb_firmware;
 
 	phys_addr_t mem_phys;
 	phys_addr_t dtb_mem_phys;
@@ -242,18 +241,20 @@ static int qcom_pas_load(struct rproc *rproc, const struct firmware *fw)
 		qcom_pas_shutdown(pas->lite_dtb_pas_id);
 
 	if (pas->dtb_pas_id) {
-		ret = request_firmware(&pas->dtb_firmware, pas->dtb_firmware_name, pas->dev);
+		const struct firmware *dtb_firmware;
+
+		ret = request_firmware(&dtb_firmware, pas->dtb_firmware_name, pas->dev);
 		if (ret) {
 			dev_err(pas->dev, "request_firmware failed for %s: %d\n",
 				pas->dtb_firmware_name, ret);
 			return ret;
 		}
 
-		ret = qcom_mdt_pas_load(pas->dtb_pas_ctx, pas->dtb_firmware,
+		ret = qcom_mdt_pas_load(pas->dtb_pas_ctx, dtb_firmware,
 					pas->dtb_firmware_name, &pas->dtb_mem_reloc);
+		release_firmware(dtb_firmware);
 		if (ret) {
 			qcom_pas_metadata_release(pas->dtb_pas_ctx);
-			release_firmware(pas->dtb_firmware);
 			return ret;
 		}
 	}
-- 
2.53.0