[PATCH] HID: intel-thc-hid: intel-quickspi: fix autosuspend cleanup during teardown

[PATCH] HID: intel-thc-hid: intel-quickspi: fix autosuspend cleanup during teardown

[Guangshuo Li]

quickspi_probe() calls pm_runtime_use_autosuspend(), but
quickspi_remove() does not call the matching
pm_runtime_dont_use_autosuspend() during teardown.

If the autosuspend delay is set to a negative value while autosuspend
is enabled, the runtime PM core increments usage_count to prevent
runtime suspend. Without calling pm_runtime_dont_use_autosuspend()
during teardown, this reference is not dropped.

The documentation for pm_runtime_use_autosuspend() also notes that it
is important to undo it with pm_runtime_dont_use_autosuspend() at
driver exit time, unless runtime PM was initially enabled with
devm_pm_runtime_enable().

Add the missing pm_runtime_dont_use_autosuspend() call to the driver
remove path.

This issue was found by manual code inspection.

Fixes: 6912aaf3fd24 ("HID: intel-thc-hid: intel-quickspi: Add PM implementation")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
 drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c b/drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c
index 4ae2e1718b30..3c87519aca84 100644
--- a/drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c
+++ b/drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c
@@ -713,6 +713,7 @@ static void quickspi_remove(struct pci_dev *pdev)
 	quickspi_hid_remove(qsdev);
 	quickspi_dma_deinit(qsdev);
 
+	pm_runtime_dont_use_autosuspend(qsdev->dev);
 	pm_runtime_get_noresume(qsdev->dev);
 
 	quickspi_dev_deinit(qsdev);
-- 
2.43.0

Re: [PATCH] HID: intel-thc-hid: intel-quickspi: fix autosuspend cleanup during teardown

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

Pre-existing issues:
- [High] The hard IRQ handler accesses MMIO hardware registers without verifying that the device is in an active PM state, risking PCIe errors on spurious interrupts.
- [High] The `quickspi_remove` function destroys the HID device and releases DMA resources before disabling the device interrupts and synchronizing the IRQ handler, leading to a Use-After-Free race condition.
--

--- Patch [1]: [PATCH] HID: intel-thc-hid: intel-quickspi: fix autosuspend cleanup during teardown ---
commit c65b63d920ef0da607b2572a6bd252126299f2eb
Author: Guangshuo Li <lgs201920130244@gmail.com>

HID: intel-thc-hid: intel-quickspi: fix autosuspend cleanup during teardown

This commit fixes a runtime PM reference leak during driver removal. It adds a
missing call to pm_runtime_dont_use_autosuspend() in quickspi_remove() to
balance the initialization done during probe.

> diff --git a/drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c b/drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c
> index 4ae2e1718b30c..3c87519aca84a 100644
> --- a/drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c
> +++ b/drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c
> @@ -713,6 +713,7 @@ static void quickspi_remove(struct pci_dev *pdev)
>  	quickspi_hid_remove(qsdev);
>  	quickspi_dma_deinit(qsdev);
>  
> +	pm_runtime_dont_use_autosuspend(qsdev->dev);
>  	pm_runtime_get_noresume(qsdev->dev);
>  
>  	quickspi_dev_deinit(qsdev);

[Severity: High]
This isn't a bug introduced by this patch, but does this teardown sequence
create a use-after-free race condition?

During driver removal, quickspi_remove() calls quickspi_dma_deinit() to free
DMA buffers before disabling hardware interrupts in quickspi_dev_deinit().

Because the IRQ was requested with devm_request_threaded_irq(), it remains
active and is not synchronized or freed until after quickspi_remove() returns.

If an interrupt fires during this window, could the concurrently running
quickspi_irq_thread_handler() invoke thc_rxdma_read() and read from the
already freed DMA memory?


While reviewing this file, I noticed another pre-existing issue in the
interrupt handling code:

drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c:quickspi_irq_quick_handler() {
    ...
	/* Disable THC interrupt before current interrupt be handled */
	thc_interrupt_enable(qsdev->thc_hw, false);
    ...
}

[Severity: High]
This is a pre-existing issue, but does the hard IRQ handler access MMIO
hardware registers without verifying that the device is in an active PM state?

If a spurious or shared interrupt occurs while the device is in the PCI D3hot
(runtime suspended) state, the handler calls thc_interrupt_enable() which
accesses MMIO directly without a pm_runtime_get_if_active() check.

Could this read and write powered-down MMIO registers and generate an
Unsupported Request (UR) on the PCIe bus?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260808151736.2934050-1-lgs201920130244@gmail.com?part=1

RE: [PATCH] HID: intel-thc-hid: intel-quickspi: fix autosuspend cleanup during teardown

[Xu, Even]

> -----Original Message-----
> From: Guangshuo Li <lgs201920130244@gmail.com>
> Sent: Saturday, August 8, 2026 11:18 PM
> To: Xu, Even <even.xu@intel.com>; Sun, Xinpeng <xinpeng.sun@intel.com>; Jiri
> Kosina <jikos@kernel.org>; Benjamin Tissoires <bentiss@kernel.org>; Sakari Ailus
> <sakari.ailus@linux.intel.com>; Danny D. <d3z.the.dev@gmail.com>; Guangshuo
> Li <lgs201920130244@gmail.com>; Abhishek Tamboli
> <abhishektamboli9@gmail.com>; Mark Pearson <mpearson-lenovo@squebb.ca>;
> Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>; linux-
> input@vger.kernel.org; linux-kernel@vger.kernel.org
> Cc: stable@vger.kernel.org
> Subject: [PATCH] HID: intel-thc-hid: intel-quickspi: fix autosuspend cleanup during
> teardown
> 
> quickspi_probe() calls pm_runtime_use_autosuspend(), but
> quickspi_remove() does not call the matching
> pm_runtime_dont_use_autosuspend() during teardown.
> 
> If the autosuspend delay is set to a negative value while autosuspend is enabled,
> the runtime PM core increments usage_count to prevent runtime suspend.
> Without calling pm_runtime_dont_use_autosuspend() during teardown, this
> reference is not dropped.
> 
> The documentation for pm_runtime_use_autosuspend() also notes that it is
> important to undo it with pm_runtime_dont_use_autosuspend() at driver exit
> time, unless runtime PM was initially enabled with devm_pm_runtime_enable().
> 
> Add the missing pm_runtime_dont_use_autosuspend() call to the driver remove
> path.
> 
> This issue was found by manual code inspection.
> 
> Fixes: 6912aaf3fd24 ("HID: intel-thc-hid: intel-quickspi: Add PM implementation")
> Cc: stable@vger.kernel.org
> Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
> ---
>  drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c
> b/drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c
> index 4ae2e1718b30..3c87519aca84 100644
> --- a/drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c
> +++ b/drivers/hid/intel-thc-hid/intel-quickspi/pci-quickspi.c
> @@ -713,6 +713,7 @@ static void quickspi_remove(struct pci_dev *pdev)
>  	quickspi_hid_remove(qsdev);
>  	quickspi_dma_deinit(qsdev);
> 
> +	pm_runtime_dont_use_autosuspend(qsdev->dev);

Reviewed-by: Even Xu <even.xu@intel.com>

>  	pm_runtime_get_noresume(qsdev->dev);
> 
>  	quickspi_dev_deinit(qsdev);
> --
> 2.43.0

Re: [PATCH] HID: intel-thc-hid: intel-quickspi: fix autosuspend cleanup during teardown

[Krzysztof Kozlowski]

On 08/08/2026 17:17, Guangshuo Li wrote:
> quickspi_probe() calls pm_runtime_use_autosuspend(), but
> quickspi_remove() does not call the matching
> pm_runtime_dont_use_autosuspend() during teardown.
> 
> If the autosuspend delay is set to a negative value while autosuspend
> is enabled, the runtime PM core increments usage_count to prevent
> runtime suspend. Without calling pm_runtime_dont_use_autosuspend()
> during teardown, this reference is not dropped.
> 
> The documentation for pm_runtime_use_autosuspend() also notes that it
> is important to undo it with pm_runtime_dont_use_autosuspend() at
> driver exit time, unless runtime PM was initially enabled with
> devm_pm_runtime_enable().
> 
> Add the missing pm_runtime_dont_use_autosuspend() call to the driver
> remove path.
> 
> This issue was found by manual code inspection.
> 
> Fixes: 6912aaf3fd24 ("HID: intel-thc-hid: intel-quickspi: Add PM implementation")
> Cc: stable@vger.kernel.org
> Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
> ---

You sent vast amount of patches, all separate, making it very difficult
to track and respond in efficient way. Do not do that.

Group your work per subsystem.

You were asked to clarify and respond to incorrect fixes statement. I do
not see how you clarified and responded at all.

Best regards,
Krzysztof