Re: [PATCH v2] media: qcom: iris: fix runtime PM reference leaks

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] In `iris_core_deinit()`, the return value of `pm_runtime_resume_and_get()` is ignored, leading to unprotected hardware accesses and an unbalanced PM usage counter if resume fails.
--

commit acf00d2e310620bc8e8cebd99a624ed3e592b957
Author: Hungyu Lin <dennylin0707@gmail.com>

media: qcom: iris: fix runtime PM reference leaks

Use pm_runtime_resume_and_get() in iris_enable_power_domains()
to avoid leaking a runtime PM usage count on failure.

Also ensure pm_runtime_put_sync() is always called in
iris_disable_power_domains(), even when iris_opp_set_rate()
fails, so runtime PM references remain balanced.

> diff --git a/drivers/media/platform/qcom/iris/iris_resources.c b/drivers/media/platform/qcom/iris/iris_resources.c
> index 773f6548370a2..f5e3341e14309 100644
> --- a/drivers/media/platform/qcom/iris/iris_resources.c
> +++ b/drivers/media/platform/qcom/iris/iris_resources.c

[ ... ]

[Severity: High]
This isn't a bug introduced by this patch, but I noticed a potential issue
in drivers/media/platform/qcom/iris/iris_core.c:

void iris_core_deinit(struct iris_core *core)
{
	pm_runtime_resume_and_get(core->dev);

	mutex_lock(&core->lock);
	...

Is it safe to ignore the return value of pm_runtime_resume_and_get() here?

If it fails, it returns a negative error code and does not increment the
device's PM usage counter.

Could this lead to unprotected hardware accesses when iris_vpu_power_off()
is called later in the function, potentially causing a synchronous external
abort?

Additionally, the PM usage counter is unconditionally decremented at the
end of the function:

	...
	pm_runtime_put_sync(core->dev);
}

Could this cause an underflow if the initial resume failed, leaving the PM
references unbalanced?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260604035133.39825-1-dennylin0707@gmail.com?part=1