[PATCH v2] media: qcom: iris: fix runtime PM reference leaks

[PATCH v2] media: qcom: iris: fix runtime PM reference leaks

[Hungyu Lin]

Use pm_runtime_resume_and_get() in iris_enable_power_domains()
to avoid leaking a runtime PM usage count on failure.

Also ensure pm_runtime_put_sync() is always called in
iris_disable_power_domains(), even when iris_opp_set_rate()
fails, so runtime PM references remain balanced.

Fixes: bb8a95aa038e ("media: iris: implement power management")
Signed-off-by: Hungyu Lin <dennylin0707@gmail.com>
---
v2:
- Add Fixes tag suggested by Jie Gan

 drivers/media/platform/qcom/iris/iris_resources.c | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/drivers/media/platform/qcom/iris/iris_resources.c b/drivers/media/platform/qcom/iris/iris_resources.c
index 773f6548370a..f5e3341e1430 100644
--- a/drivers/media/platform/qcom/iris/iris_resources.c
+++ b/drivers/media/platform/qcom/iris/iris_resources.c
@@ -78,11 +78,11 @@ int iris_enable_power_domains(struct iris_core *core, struct device *pd_dev)
 	if (ret)
 		return ret;
 
-	ret = pm_runtime_get_sync(pd_dev);
-	if (ret < 0)
+	ret = pm_runtime_resume_and_get(pd_dev);
+	if (ret)
 		return ret;
 
-	return ret;
+	return 0;
 }
 
 int iris_disable_power_domains(struct iris_core *core, struct device *pd_dev)
@@ -90,12 +90,10 @@ int iris_disable_power_domains(struct iris_core *core, struct device *pd_dev)
 	int ret;
 
 	ret = iris_opp_set_rate(core->dev, 0);
-	if (ret)
-		return ret;
 
 	pm_runtime_put_sync(pd_dev);
 
-	return 0;
+	return ret;
 }
 
 static struct clk *iris_get_clk_by_type(struct iris_core *core, enum platform_clk_type clk_type)
-- 
2.34.1

Re: [PATCH v2] media: qcom: iris: fix runtime PM reference leaks

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] In `iris_core_deinit()`, the return value of `pm_runtime_resume_and_get()` is ignored, leading to unprotected hardware accesses and an unbalanced PM usage counter if resume fails.
--

commit acf00d2e310620bc8e8cebd99a624ed3e592b957
Author: Hungyu Lin <dennylin0707@gmail.com>

media: qcom: iris: fix runtime PM reference leaks

Use pm_runtime_resume_and_get() in iris_enable_power_domains()
to avoid leaking a runtime PM usage count on failure.

Also ensure pm_runtime_put_sync() is always called in
iris_disable_power_domains(), even when iris_opp_set_rate()
fails, so runtime PM references remain balanced.

> diff --git a/drivers/media/platform/qcom/iris/iris_resources.c b/drivers/media/platform/qcom/iris/iris_resources.c
> index 773f6548370a2..f5e3341e14309 100644
> --- a/drivers/media/platform/qcom/iris/iris_resources.c
> +++ b/drivers/media/platform/qcom/iris/iris_resources.c

[ ... ]

[Severity: High]
This isn't a bug introduced by this patch, but I noticed a potential issue
in drivers/media/platform/qcom/iris/iris_core.c:

void iris_core_deinit(struct iris_core *core)
{
	pm_runtime_resume_and_get(core->dev);

	mutex_lock(&core->lock);
	...

Is it safe to ignore the return value of pm_runtime_resume_and_get() here?

If it fails, it returns a negative error code and does not increment the
device's PM usage counter.

Could this lead to unprotected hardware accesses when iris_vpu_power_off()
is called later in the function, potentially causing a synchronous external
abort?

Additionally, the PM usage counter is unconditionally decremented at the
end of the function:

	...
	pm_runtime_put_sync(core->dev);
}

Could this cause an underflow if the initial resume failed, leaving the PM
references unbalanced?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260604035133.39825-1-dennylin0707@gmail.com?part=1