From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A537D4DAF8A; Wed, 30 Sep 2026 18:11:28 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790791889; cv=none; b=sa6rMo3K3ZDlsyfu8ogIx/1vU/qfZ7i0fPQEZwGOeMC/wkhvCw5+57+7RS+0bFClwA3bEzGbEWCaMZPwm3ALFSNdqJpAeUY+v2PZuLXTJqKO91rQ0t8YdxBNDe6eKFOf2Tv/vWNEwZW2L3iuQcU61N9HTRr1c4PEmhhCEheml8k= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790791889; c=relaxed/simple; bh=FWrwPynMDsWhbK10uc5RM0rgWWvYQ3y6uUl7s3CdDQg=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=qsz3ujcY7x2ixRDpctuSWQOxL2AwWpGMse5hZwL3CxYe6iles6Xs2yJyyTSJgkVQT/ABJrmojK0do8SnoRjAyRPdGiKYB2sW7+OWcdFKykFXBqXbsD8iIoM5P+EajJePQb4JkwsY2QK8jNR3H91PrVh/XsJ7gjkOZ4BaDSyKPjA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=YstzDX/N; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="YstzDX/N" Received: by smtp.kernel.org (Postfix) with ESMTPSA id F284A1F000FF; Wed, 30 Sep 2026 18:11:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1790791888; bh=TXCLXm6+VlUXU2fD+eLGDzlVx2RsW7oGHND7EQPrrnY=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=YstzDX/NGqFQEt5tf/OkAZS2R57tlq/GCJqvWXP/snriLTrfCS6wSdSvm7aqWIMs5 80CPFzPVQR/GzqzUgA1lSPPCRAQ8tc23oK7hnKg5zeRam4DS3ZYdOcSHW4e8vQjDyF 1ri5wsh75TKu72r3SRY3l8whNjk3G5/sQwm5CIMc= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Ruoyu Wang , Frank Li , Baolin Wang , Vinod Koul , Sasha Levin Subject: [PATCH 5.15 459/752] dmaengine: sprd: Fix runtime PM reference leak in probe Date: Wed, 30 Sep 2026 17:25:29 +0200 Message-ID: <20260930152408.209437340@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260930152358.131179731@linuxfoundation.org> References: <20260930152358.131179731@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 5.15-stable review patch. If anyone has any objections, please let me know. ------------------ From: Ruoyu Wang [ Upstream commit a7df136ec529ee49a789c5029bc37b98b0d4bedd ] pm_runtime_get_sync() increments a device's usage counter even when it fails. sprd_dma_probe() currently jumps directly to controller clock cleanup on that error, bypassing both pm_runtime_put_noidle() and pm_runtime_disable(). This can happen if the preceding unchecked pm_runtime_set_active() fails and the following runtime-resume attempt also returns an error. Enter the existing runtime-PM unwind path instead. This drops the reference without idling the partially initialized device, disables runtime PM, and then releases the controller clocks. The success path and propagated error code are unchanged. This issue was found by a static analysis checker and confirmed by manual source review. Fixes: 9b3b8171f7f4 ("dmaengine: sprd: Add Spreadtrum DMA driver") Signed-off-by: Ruoyu Wang Reviewed-by: Frank Li Reviewed-by: Baolin Wang Link: https://patch.msgid.link/20260813153149.3953497-1-ruoyuw560@gmail.com Signed-off-by: Vinod Koul Signed-off-by: Sasha Levin --- drivers/dma/sprd-dma.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/dma/sprd-dma.c b/drivers/dma/sprd-dma.c index 60115d8d40832..e6ba7f7df8638 100644 --- a/drivers/dma/sprd-dma.c +++ b/drivers/dma/sprd-dma.c @@ -1205,7 +1205,7 @@ static int sprd_dma_probe(struct platform_device *pdev) ret = pm_runtime_get_sync(&pdev->dev); if (ret < 0) - goto err_rpm; + goto err_register; ret = dma_async_device_register(&sdev->dma_dev); if (ret < 0) { @@ -1227,7 +1227,6 @@ static int sprd_dma_probe(struct platform_device *pdev) err_register: pm_runtime_put_noidle(&pdev->dev); pm_runtime_disable(&pdev->dev); -err_rpm: sprd_dma_disable(sdev); return ret; } -- 2.53.0