Re: [PATCH 4/8] iio: adc: rzt2h: Add optional reset support

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] iio: pm: shared reset_control deassert_count leak on driver unbind
--

commit 2c9879cdb042266b9cb867be82cd949d29dd6f14
Author: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>

iio: adc: rzt2h: Add optional reset support

Prepare the driver for RZ/V2H(P), where the ADC has a module reset line
that is not present on RZ/T2H. Asserts the optional reset when the ADC is
runtime-suspended and deasserts it on runtime resume before calibration.
Uses a shared reset control to support SoCs where the reset line is shared.

> diff --git a/drivers/iio/adc/rzt2h_adc.c b/drivers/iio/adc/rzt2h_adc.c
> index f1a830da6f9b7..4726f892da232 100644
> --- a/drivers/iio/adc/rzt2h_adc.c
> +++ b/drivers/iio/adc/rzt2h_adc.c
[ ... ]
> @@ -706,6 +708,10 @@ static int rzt2h_adc_probe(struct platform_device *pdev)
>  
>  	platform_set_drvdata(pdev, adc);
>  
> +	adc->rstc = devm_reset_control_get_optional_shared(dev, NULL);
> +	if (IS_ERR(adc->rstc))
> +		return PTR_ERR(adc->rstc);
> +
>  	ret = rzt2h_adc_parse_properties(adc);
>  	if (ret)
>  		return ret;
[ ... ]
> @@ -767,10 +773,22 @@ static const struct of_device_id rzt2h_adc_match[] = {
>  };
>  MODULE_DEVICE_TABLE(of, rzt2h_adc_match);
>  
> +static int rzt2h_adc_pm_runtime_suspend(struct device *dev)
> +{
> +	struct rzt2h_adc *adc = dev_get_drvdata(dev);
> +
> +	return reset_control_assert(adc->rstc);
> +}

[Severity: High]
Does this driver leak the shared reset control's deassert count when unbound?

If the driver is unbound (e.g., via sysfs or module unload) while the device
is in the RPM_ACTIVE state, devm_pm_runtime_enable() merely calls
pm_runtime_disable() which forcibly cancels pending autosuspends without
invoking the runtime suspend callback.

This RPM_ACTIVE state is reliably reached if unbind happens while the IIO
buffer is active (where IIO core triggers an asynchronous
pm_runtime_put_autosuspend), or within 300ms (the autosuspend delay) after a
single-channel read_raw operation.

Since the driver lacks a .remove callback or custom devm action to
synchronously suspend the device on teardown, this
rzt2h_adc_pm_runtime_suspend() is completely bypassed and
reset_control_assert() is missed.

Will this cause a permanent denial of service for shared hardware resources,
preventing the physical reset line from being asserted for other ADC instances
until a reboot?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260929124248.237032-1-prabhakar.mahadev-lad.rj@bp.renesas.com?part=4