Re: [PATCH] hwrng: mtk - use pm_runtime_resume_and_get() in mtk_rng_read()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found no new issues
in this patch, but noticed 1 related pre-existing issue it does not
introduce:
- [High] hwrng: mtk - premature hwrng registration and unchecked runtime
  PM in mtk_rng_read() [1]
--

commit dfb825399ed095d750b85ef745a6c83b7ac41f98
Author: Gu Bin <gubin@cmss.chinamobile.com>

hwrng: mtk - use pm_runtime_resume_and_get() in mtk_rng_read()

This commit replaces pm_runtime_get_sync() with pm_runtime_resume_and_get()
in mtk_rng_read() and returns early if resuming the device fails.

> diff --git a/drivers/char/hw_random/mtk-rng.c b/drivers/char/hw_random/mtk-rng.c
> index 127b82d979e8e..1e8e458dab25c 100644
> --- a/drivers/char/hw_random/mtk-rng.c
> +++ b/drivers/char/hw_random/mtk-rng.c
> @@ -95,7 +95,9 @@ static int mtk_rng_read(struct hwrng *rng, void *buf, size_t max, bool wait)
>  	struct mtk_rng *priv = to_mtk_rng(rng);
>  	int retval = 0;
>  
> -	pm_runtime_get_sync(priv->dev);
> +	retval = pm_runtime_resume_and_get(priv->dev);
> +	if (retval < 0)
> +		return retval;
>  
>  	while (max >= sizeof(u32)) {
>  		if (!mtk_rng_wait_ready(rng, wait))

[Severity: High]
This problem wasn't introduced by this patch, but can mtk_rng_read() be
called while runtime PM is disabled [1]?

In mtk_rng_probe(), devm_hwrng_register() is called before dev_set_drvdata()
and devm_pm_runtime_enable():

drivers/char/hw_random/mtk-rng.c:mtk_rng_probe() {
	...
	ret = devm_hwrng_register(&pdev->dev, &priv->rng);
	if (ret) {
		dev_err(&pdev->dev, "failed to register rng device: %d\n",
			ret);
		return ret;
	}

	if (!(priv->flags & MTK_RNG_SMC)) {
		dev_set_drvdata(&pdev->dev, priv);
		pm_runtime_set_autosuspend_delay(&pdev->dev,
						 RNG_AUTOSUSPEND_TIMEOUT);
		pm_runtime_use_autosuspend(&pdev->dev);
		ret = devm_pm_runtime_enable(&pdev->dev);
	...
}

Because devm_hwrng_register() immediately exposes the RNG and starts
hwrng_fillfn(), and because reverse-order devres teardown on unbind disables
runtime PM before unregistering the RNG, mtk_rng_read() can run while
runtime PM is disabled, causing pm_runtime_resume_and_get() to fail with
-EACCES (or previously causing unclocked MMIO reads when CONFIG_PM is
enabled).  Enabling runtime PM and setting drvdata before calling
devm_hwrng_register() would avoid this window during both probe and unbind.

[1] https://sashiko.dev/#/bug/linux-371c6254-7dda-4dcc-bf98-1919a85f9f5b

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261111073237.1647-1-gubin@cmss.chinamobile.com?part=1