remoteproc: qcom: Fix leak when custom dump_segments addition fails

Free allocated minidump_region 'name' in qcom_add_minidump_segments()
when failing before adding the region to 'dump_segments'. Otherwise,
the 'name' is not tracked and is never freed by qcom_minidump_cleanup().

Return error when adding to 'dump_segments' fails.

Cc: stable@vger.kernel.org # v5.11
Fixes: 8ed8485c4f05 ("remoteproc: qcom: Add capability to collect minidumps")
Reviewed-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
Signed-off-by: Wasim Nazir <wasim.nazir@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20260318-rproc-memleak-v2-1-ade70ab858f2@oss.qualcomm.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>

diff --git a/drivers/remoteproc/qcom_common.c b/drivers/remoteproc/qcom_common.c
index fd2b6824ad265ec967741c8c1977e9d4f3bd424d..e1a955476c9b3ad71049bd98b1fc4568fb13a256 100644 (file)
--- a/drivers/remoteproc/qcom_common.c
+++ b/drivers/remoteproc/qcom_common.c
@@ -109,6 +109,7 @@ static int qcom_add_minidump_segments(struct rproc *rproc, struct minidump_subsy
        struct minidump_region __iomem *ptr;
        struct minidump_region region;
        int seg_cnt, i;
+       int ret = 0;
        dma_addr_t da;
        size_t size;
        char *name;
@@ -129,17 +130,22 @@ static int qcom_add_minidump_segments(struct rproc *rproc, struct minidump_subsy
                if (le32_to_cpu(region.valid) == MINIDUMP_REGION_VALID) {
                        name = kstrndup(region.name, MAX_REGION_NAME_LENGTH - 1, GFP_KERNEL);
                        if (!name) {
-                               iounmap(ptr);
-                               return -ENOMEM;
+                               ret = -ENOMEM;
+                               break;
                        }
                        da = le64_to_cpu(region.address);
                        size = le64_to_cpu(region.size);
-                       rproc_coredump_add_custom_segment(rproc, da, size, rproc_dumpfn_t, name);
+                       ret = rproc_coredump_add_custom_segment(rproc, da, size, rproc_dumpfn_t,
+                                                               name);
+                       if (ret) {
+                               kfree(name);
+                               break;
+                       }
                }
        }
 
        iounmap(ptr);
-       return 0;
+       return ret;
 }
 
 void qcom_minidump(struct rproc *rproc, unsigned int minidump_id,