Free allocated minidump_region 'name' in qcom_add_minidump_segments()
when failing before adding the region to 'dump_segments'. Otherwise,
the 'name' is not tracked and is never freed by qcom_minidump_cleanup().

Return error when adding to 'dump_segments' fails.

Signed-off-by: Wasim Nazir <wasim.nazir@oss.qualcomm.com>
---
 drivers/remoteproc/qcom_common.c | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/drivers/remoteproc/qcom_common.c b/drivers/remoteproc/qcom_common.c
index 6c31140268ac..aa93d3324561 100644
--- a/drivers/remoteproc/qcom_common.c
+++ b/drivers/remoteproc/qcom_common.c
@@ -110,6 +110,7 @@ static int qcom_add_minidump_segments(struct rproc *rproc, struct minidump_subsy
 	struct minidump_region __iomem *ptr;
 	struct minidump_region region;
 	int seg_cnt, i;
+	int ret = 0;
 	dma_addr_t da;
 	size_t size;
 	char *name;
@@ -130,17 +131,22 @@ static int qcom_add_minidump_segments(struct rproc *rproc, struct minidump_subsy
 		if (le32_to_cpu(region.valid) == MINIDUMP_REGION_VALID) {
 			name = kstrndup(region.name, MAX_REGION_NAME_LENGTH - 1, GFP_KERNEL);
 			if (!name) {
-				iounmap(ptr);
-				return -ENOMEM;
+				ret = -ENOMEM;
+				break;
 			}
 			da = le64_to_cpu(region.address);
 			size = le64_to_cpu(region.size);
-			rproc_coredump_add_custom_segment(rproc, da, size, rproc_dumpfn_t, name);
+			ret = rproc_coredump_add_custom_segment(rproc, da, size, rproc_dumpfn_t,
+								name);
+			if (ret) {
+				kfree(name);
+				break;
+			}
 		}
 	}
 
 	iounmap(ptr);
-	return 0;
+	return ret;
 }
 
 void qcom_minidump(struct rproc *rproc, unsigned int minidump_id,

---
base-commit: b84a0ebe421ca56995ff78b66307667b62b3a900
change-id: 20260316-rproc-memleak-367ef8e1a64b

Best regards,
-- 
Wasim Nazir <wasim.nazir@oss.qualcomm.com>

On Mon, Mar 16, 2026 at 05:57:54PM +0530, Wasim Nazir wrote:
> Free allocated minidump_region 'name' in qcom_add_minidump_segments()
> when failing before adding the region to 'dump_segments'. Otherwise,
> the 'name' is not tracked and is never freed by qcom_minidump_cleanup().
> 
> Return error when adding to 'dump_segments' fails.
> 
> Signed-off-by: Wasim Nazir <wasim.nazir@oss.qualcomm.com>

This should have fixes tag and cc to stable mailing list.

With above changes

Reviewed-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>

> ---
>  drivers/remoteproc/qcom_common.c | 14 ++++++++++----
>  1 file changed, 10 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/remoteproc/qcom_common.c b/drivers/remoteproc/qcom_common.c
> index 6c31140268ac..aa93d3324561 100644
> --- a/drivers/remoteproc/qcom_common.c
> +++ b/drivers/remoteproc/qcom_common.c
> @@ -110,6 +110,7 @@ static int qcom_add_minidump_segments(struct rproc *rproc, struct minidump_subsy
>  	struct minidump_region __iomem *ptr;
>  	struct minidump_region region;
>  	int seg_cnt, i;
> +	int ret = 0;
>  	dma_addr_t da;
>  	size_t size;
>  	char *name;
> @@ -130,17 +131,22 @@ static int qcom_add_minidump_segments(struct rproc *rproc, struct minidump_subsy
>  		if (le32_to_cpu(region.valid) == MINIDUMP_REGION_VALID) {
>  			name = kstrndup(region.name, MAX_REGION_NAME_LENGTH - 1, GFP_KERNEL);
>  			if (!name) {
> -				iounmap(ptr);
> -				return -ENOMEM;
> +				ret = -ENOMEM;
> +				break;
>  			}
>  			da = le64_to_cpu(region.address);
>  			size = le64_to_cpu(region.size);
> -			rproc_coredump_add_custom_segment(rproc, da, size, rproc_dumpfn_t, name);
> +			ret = rproc_coredump_add_custom_segment(rproc, da, size, rproc_dumpfn_t,
> +								name);
> +			if (ret) {
> +				kfree(name);
> +				break;
> +			}
>  		}
>  	}
>  
>  	iounmap(ptr);
> -	return 0;
> +	return ret;
>  }
>  
>  void qcom_minidump(struct rproc *rproc, unsigned int minidump_id,
> 
> ---
> base-commit: b84a0ebe421ca56995ff78b66307667b62b3a900
> change-id: 20260316-rproc-memleak-367ef8e1a64b
> 
> Best regards,
> -- 
> Wasim Nazir <wasim.nazir@oss.qualcomm.com>
> 

-- 
-Mukesh Ojha