[PATCH] accel/ivpu: fix usage_count leak when autosuspend_delay is negative

[PATCH] accel/ivpu: fix usage_count leak when autosuspend_delay is negative

[Guangshuo Li]

ivpu_pm_init() calls pm_runtime_use_autosuspend(), but the autosuspend
setting is not disabled when the device is removed or when
initialization fails after runtime PM setup.

When the autosuspend delay is negative, the runtime PM core increments
usage_count to prevent runtime suspend. Without a matching
pm_runtime_dont_use_autosuspend(), this reference is not dropped and
usage_count remains unbalanced.

Call pm_runtime_dont_use_autosuspend() from ivpu_pm_disable() to clean
up the autosuspend state during normal device teardown. Also undo the
autosuspend setting when ivpu_boot() fails after ivpu_pm_init().

This issue was found by manual code inspection.

Fixes: 852be13f3bd3 ("accel/ivpu: Add PM support")
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
 drivers/accel/ivpu/ivpu_drv.c | 4 +++-
 drivers/accel/ivpu/ivpu_pm.c  | 1 +
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/accel/ivpu/ivpu_drv.c b/drivers/accel/ivpu/ivpu_drv.c
index 35e506074d5f..633c90e73f2c 100644
--- a/drivers/accel/ivpu/ivpu_drv.c
+++ b/drivers/accel/ivpu/ivpu_drv.c
@@ -756,13 +756,15 @@ static int ivpu_dev_init(struct ivpu_device *vdev)
 
 	ret = ivpu_boot(vdev);
 	if (ret)
-		goto err_ipc_fini;
+		goto err_pm_fini;
 
 	ivpu_job_done_consumer_init(vdev);
 	ivpu_pm_enable(vdev);
 
 	return 0;
 
+err_pm_fini:
+	pm_runtime_dont_use_autosuspend(vdev->drm.dev);
 err_ipc_fini:
 	ivpu_ipc_fini(vdev);
 err_fw_fini:
diff --git a/drivers/accel/ivpu/ivpu_pm.c b/drivers/accel/ivpu/ivpu_pm.c
index c1ce8329790e..20dc8ec7d70a 100644
--- a/drivers/accel/ivpu/ivpu_pm.c
+++ b/drivers/accel/ivpu/ivpu_pm.c
@@ -445,6 +445,7 @@ void ivpu_pm_enable(struct ivpu_device *vdev)
 
 void ivpu_pm_disable(struct ivpu_device *vdev)
 {
+	pm_runtime_dont_use_autosuspend(vdev->drm.dev);
 	pm_runtime_get_noresume(vdev->drm.dev);
 	pm_runtime_forbid(vdev->drm.dev);
 }
-- 
2.43.0

Re: [PATCH] accel/ivpu: fix usage_count leak when autosuspend_delay is negative

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Background work items scheduled by IRQ handlers are not flushed or canceled on the probe error path, leading to a Use-After-Free when devres frees the device.
--

--- Patch [1]: [PATCH] accel/ivpu: fix usage_count leak when autosuspend_delay is negative ---
commit db53366ef5dbe7e33ab10b0d9f2d73d71bbd452a
Author: Guangshuo Li <lgs201920130244@gmail.com>

accel/ivpu: fix usage_count leak when autosuspend_delay is negative

ivpu_pm_init() calls pm_runtime_use_autosuspend(), but the autosuspend
setting is not disabled when the device is removed or when initialization
fails. This patch adds pm_runtime_dont_use_autosuspend() to ivpu_pm_disable()
and the ivpu_dev_init() error path to prevent a usage_count leak.

> diff --git a/drivers/accel/ivpu/ivpu_drv.c b/drivers/accel/ivpu/ivpu_drv.c
> index 95120957f42a5..f8460aca189cd 100644
> --- a/drivers/accel/ivpu/ivpu_drv.c
> +++ b/drivers/accel/ivpu/ivpu_drv.c
[ ... ]
> @@ -776,13 +776,15 @@ static int ivpu_dev_init(struct ivpu_device *vdev)
>  
>  	ret = ivpu_boot(vdev);
>  	if (ret)
> -		goto err_ipc_fini;
> +		goto err_pm_fini;
>  
>  	ivpu_job_done_consumer_init(vdev);
>  	ivpu_pm_enable(vdev);
>  
>  	return 0;
>  
> +err_pm_fini:
> +	pm_runtime_dont_use_autosuspend(vdev->drm.dev);

[Severity: High]
This is a pre-existing issue, but since we are modifying the error paths
here, I noticed that background work items scheduled by IRQ handlers might
not be flushed or canceled on the probe error path.

If a hardware interrupt occurs during ivpu_boot() after enable_irq() is called,
the handler may queue irq_dct_work or context_abort_work. If a subsequent
initialization step like ivpu_pm_dct_init() fails, the error path disables
interrupts but skips flushing the queued works:

ivpu_boot() {
        ...
        enable_irq(vdev->irq);
        ...
        ret = ivpu_pm_dct_init(vdev);
        if (ret)
                goto err_disable_ipc;
        ...
err_disable_ipc:
        ivpu_ipc_disable(vdev);
        ivpu_hw_irq_disable(vdev);
        disable_irq(vdev->irq);
        ...
}

The error is then returned to ivpu_dev_init(), which jumps to err_pm_fini
where this new cleanup code is placed.

Could this lead to a memory corruption scenario? Without cancel_work_sync()
or flush_work() to halt pending tasks, devres might free the ivpu_device
structure when probe fails. Any pending work items might later execute and
dereference the freed pointer.

>  err_ipc_fini:
>  	ivpu_ipc_fini(vdev);
>  err_fw_fini:

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260807145416.2518999-1-lgs201920130244@gmail.com?part=1