Re: [PATCH v5 4/6] drm/msm: Add cleanup help for disabling IFPC

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] drm/msm: runtime PM reference leak in sel_worker() when needs_hw_init is true
--

commit c158cbf02dcf68346474590fc21ed9ed06a1f23b
Author: Rob Clark <robin.clark@oss.qualcomm.com>

drm/msm: Add cleanup help for disabling IFPC

This series reworks IFPC disable handling to use a dedicated reference count
and guard helper, and defers performance counter resumption until after
hardware initialization completes.

> diff --git a/drivers/gpu/drm/msm/msm_perfcntr.c b/drivers/gpu/drm/msm/msm_perfcntr.c
> index 7fa2e858bd082..e6f4f9b098842 100644
> --- a/drivers/gpu/drm/msm/msm_perfcntr.c
> +++ b/drivers/gpu/drm/msm/msm_perfcntr.c
> @@ -199,10 +199,17 @@ sel_worker(struct work_struct *w)
>  		return;
>  
>  	scoped_guard (mutex, &gpu->lock) {
> +		/*
> +		 * If gpu still needs hw_init, bail.  We'll be rescheduled
> +		 * after hw_init, and there is no point to collect counters
> +		 * beforehand
> +		 */
> +		if (gpu->needs_hw_init)
> +			return;

[Severity: High]
Does this early return in sel_worker() leak the runtime PM usage reference on
&gpu->pdev->dev?

Before entering scoped_guard(mutex, &gpu->lock), sel_worker() in
drivers/gpu/drm/msm/msm_perfcntr.c acquires a runtime PM reference if the
device is active:

	if (!pm_runtime_get_if_active(&gpu->pdev->dev))
		return;

	scoped_guard (mutex, &gpu->lock) {
		if (gpu->needs_hw_init)
			return;
		...
	}

	pm_runtime_put_autosuspend(&gpu->pdev->dev);

When msm_ioctl_perfcntr_config() -> msm_perfcntr_resume_locked() schedules
stream->sel_work while &gpu->pdev->dev is runtime-active (for example, during
the autosuspend window after adreno_get_param() handles MSM_PARAM_TIMESTAMP
or before another thread finishes msm_gpu_hw_init()), pm_runtime_get_if_active()
increments the runtime PM usage count and returns 1.

If gpu->needs_hw_init is still true when sel_worker() acquires gpu->lock,
returning directly from the function inside scoped_guard() releases gpu->lock
but skips pm_runtime_put_autosuspend(&gpu->pdev->dev) at the end of
sel_worker(), leaving the runtime PM reference leaked and preventing the GPU
from suspending.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261104175931.28475-1-robin.clark@oss.qualcomm.com?part=4