[PATCH] drm/bridge: cdns-dsi: Fix runtime PM leak in cdns_dsi_bridge_atomic_pre_enable()

[PATCH] drm/bridge: cdns-dsi: Fix runtime PM leak in cdns_dsi_bridge_atomic_pre_enable()

[Wentao Liang]

cdns_dsi_bridge_atomic_pre_enable() resumes the DSI controller with
pm_runtime_get_sync() and returns early with a WARN_ON() when the
resume fails.  pm_runtime_get_sync() increments the runtime PM usage
count even when it fails, so returning without dropping the reference
leaks it and prevents the device from ever suspending again once the
error has been hit.

Drop the runtime PM reference with pm_runtime_put_noidle() on the
resume failure path before returning.

Fixes: e19233955d9e ("drm/bridge: Add Cadence DSI driver")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c b/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c
index 0dd85e26248c..fca4528edfa6 100644
--- a/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c
+++ b/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c
@@ -733,8 +733,10 @@ static void cdns_dsi_bridge_atomic_pre_enable(struct drm_bridge *bridge,
 	 * enable their streams.
 	 */
 
-	if (WARN_ON(pm_runtime_get_sync(dsi->base.dev) < 0))
+	if (WARN_ON(pm_runtime_get_sync(dsi->base.dev) < 0)) {
+		pm_runtime_put_noidle(dsi->base.dev);
 		return;
+	}
 
 	new_bridge_state = drm_atomic_get_new_bridge_state(state, bridge);
 	if (WARN_ON(!new_bridge_state))
-- 
2.34.1

Re: [PATCH] drm/bridge: cdns-dsi: Fix runtime PM leak in cdns_dsi_bridge_atomic_pre_enable()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] drm/cdns-dsi: double pm_runtime_put() causes usage counter underflow
--

commit 863c1242b6ff6841137bcc0956d0095317384036
Author: Wentao Liang <vulab@iscas.ac.cn>

drm/bridge: cdns-dsi: Fix runtime PM leak in cdns_dsi_bridge_atomic_pre_enable()

This commit attempts to fix a runtime PM leak when pm_runtime_get_sync() fails
by adding a call to pm_runtime_put_noidle(). The function then returns early.

> diff --git a/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c b/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c
> index c3e466ded84ab..dcf7d3e409815 100644
> --- a/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c
> +++ b/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c
> @@ -733,8 +733,10 @@ static void cdns_dsi_bridge_atomic_pre_enable(struct drm_bridge *bridge,
>  	 * enable their streams.
>  	 */
>  
> -	if (WARN_ON(pm_runtime_get_sync(dsi->base.dev) < 0))
> +	if (WARN_ON(pm_runtime_get_sync(dsi->base.dev) < 0)) {
> +		pm_runtime_put_noidle(dsi->base.dev);

[Severity: Medium]
Will this lead to a double-put of the runtime PM reference?

Since cdns_dsi_bridge_atomic_pre_enable() returns void, the DRM core is
unaware that the bridge failed to enable. The atomic commit continues normally,
and when the bridge is later disabled, cdns_dsi_bridge_atomic_post_disable()
is called unconditionally.

If we look at cdns_dsi_bridge_atomic_post_disable(), it executes a second put
during teardown:

static void cdns_dsi_bridge_atomic_post_disable(...)
{
	...
	pm_runtime_put(dsi->base.dev);
}

Wouldn't this decrement the usage count again and cause a runtime PM usage
counter underflow?

>  		return;
> +	}
>  
>  	new_bridge_state = drm_atomic_get_new_bridge_state(state, bridge);
>  	if (WARN_ON(!new_bridge_state))

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260916100405.2012604-1-vulab@iscas.ac.cn?part=1

Re: [PATCH] drm/bridge: cdns-dsi: Fix runtime PM leak in cdns_dsi_bridge_atomic_pre_enable()

[Laurent Pinchart]

On Wed, Sep 16, 2026 at 10:04:05AM +0000, Wentao Liang wrote:
> cdns_dsi_bridge_atomic_pre_enable() resumes the DSI controller with
> pm_runtime_get_sync() and returns early with a WARN_ON() when the
> resume fails.  pm_runtime_get_sync() increments the runtime PM usage
> count even when it fails, so returning without dropping the reference
> leaks it and prevents the device from ever suspending again once the
> error has been hit.
> 
> Drop the runtime PM reference with pm_runtime_put_noidle() on the
> resume failure path before returning.
> 
> Fixes: e19233955d9e ("drm/bridge: Add Cadence DSI driver")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>  drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c b/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c
> index 0dd85e26248c..fca4528edfa6 100644
> --- a/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c
> +++ b/drivers/gpu/drm/bridge/cadence/cdns-dsi-core.c
> @@ -733,8 +733,10 @@ static void cdns_dsi_bridge_atomic_pre_enable(struct drm_bridge *bridge,
>  	 * enable their streams.
>  	 */
>  
> -	if (WARN_ON(pm_runtime_get_sync(dsi->base.dev) < 0))
> +	if (WARN_ON(pm_runtime_get_sync(dsi->base.dev) < 0)) {
> +		pm_runtime_put_noidle(dsi->base.dev);
>  		return;
> +	}

Anything wrong with pm_runtime_resume_and_get() ?

>  
>  	new_bridge_state = drm_atomic_get_new_bridge_state(state, bridge);
>  	if (WARN_ON(!new_bridge_state))

-- 
Regards,

Laurent Pinchart