[PATCH] media: sti: Fix reference count leaks

[PATCH] media: sti: Fix reference count leaks

[wu000273]

From: Qiushi Wu <wu000273@umn.edu>

pm_runtime_get_sync() increments the runtime PM usage counter even
when it returns an error code, causing incorrect ref count if
pm_runtime_put_noidle() is not called in error handling paths.
Thus call pm_runtime_put_noidle() if pm_runtime_get_sync() fails.

Signed-off-by: Qiushi Wu <wu000273@umn.edu>
---
 drivers/media/platform/sti/hva/hva-hw.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/media/platform/sti/hva/hva-hw.c b/drivers/media/platform/sti/hva/hva-hw.c
index 401aaafa1710..bb13348be083 100644
--- a/drivers/media/platform/sti/hva/hva-hw.c
+++ b/drivers/media/platform/sti/hva/hva-hw.c
@@ -272,6 +272,7 @@ static unsigned long int hva_hw_get_ip_version(struct hva_dev *hva)
 
 	if (pm_runtime_get_sync(dev) < 0) {
 		dev_err(dev, "%s     failed to get pm_runtime\n", HVA_PREFIX);
+		pm_runtime_put_noidle(dev);
 		mutex_unlock(&hva->protect_mutex);
 		return -EFAULT;
 	}
@@ -553,6 +554,7 @@ void hva_hw_dump_regs(struct hva_dev *hva, struct seq_file *s)
 
 	if (pm_runtime_get_sync(dev) < 0) {
 		seq_puts(s, "Cannot wake up IP\n");
+		pm_runtime_put_noidle(dev);
 		mutex_unlock(&hva->protect_mutex);
 		return;
 	}
-- 
2.17.1

Re: [PATCH] media: sti: Fix reference count leaks

[Hans Verkuil]

Hi Jean-Christophe,

I'll take this patch, but while reviewing it I noticed something else:

On 14/06/2020 05:31, wu000273@umn.edu wrote:
> From: Qiushi Wu <wu000273@umn.edu>
> 
> pm_runtime_get_sync() increments the runtime PM usage counter even
> when it returns an error code, causing incorrect ref count if
> pm_runtime_put_noidle() is not called in error handling paths.
> Thus call pm_runtime_put_noidle() if pm_runtime_get_sync() fails.
> 
> Signed-off-by: Qiushi Wu <wu000273@umn.edu>
> ---
>  drivers/media/platform/sti/hva/hva-hw.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/drivers/media/platform/sti/hva/hva-hw.c b/drivers/media/platform/sti/hva/hva-hw.c
> index 401aaafa1710..bb13348be083 100644
> --- a/drivers/media/platform/sti/hva/hva-hw.c
> +++ b/drivers/media/platform/sti/hva/hva-hw.c
> @@ -272,6 +272,7 @@ static unsigned long int hva_hw_get_ip_version(struct hva_dev *hva)
>  
>  	if (pm_runtime_get_sync(dev) < 0) {
>  		dev_err(dev, "%s     failed to get pm_runtime\n", HVA_PREFIX);
> +		pm_runtime_put_noidle(dev);
>  		mutex_unlock(&hva->protect_mutex);

This appears to be a spurious mutex_unlock() since I don't see a corresponding mutex_lock.

Jean-Christophe, can you check this and, if I am right, post a patch fixing this?

Regards,

	Hans

>  		return -EFAULT;
>  	}
> @@ -553,6 +554,7 @@ void hva_hw_dump_regs(struct hva_dev *hva, struct seq_file *s)
>  
>  	if (pm_runtime_get_sync(dev) < 0) {
>  		seq_puts(s, "Cannot wake up IP\n");
> +		pm_runtime_put_noidle(dev);
>  		mutex_unlock(&hva->protect_mutex);
>  		return;
>  	}
> 

Re: [PATCH] media: sti: Fix reference count leaks

[Krzysztof Kozlowski]

On Thu, 17 Sept 2020 at 13:45, Hans Verkuil <hverkuil@xs4all.nl> wrote:
>
> Hi Jean-Christophe,
>
> I'll take this patch, but while reviewing it I noticed something else:
>
> On 14/06/2020 05:31, wu000273@umn.edu wrote:
> > From: Qiushi Wu <wu000273@umn.edu>
> >
> > pm_runtime_get_sync() increments the runtime PM usage counter even
> > when it returns an error code, causing incorrect ref count if
> > pm_runtime_put_noidle() is not called in error handling paths.
> > Thus call pm_runtime_put_noidle() if pm_runtime_get_sync() fails.
> >
> > Signed-off-by: Qiushi Wu <wu000273@umn.edu>
> > ---
> >  drivers/media/platform/sti/hva/hva-hw.c | 2 ++
> >  1 file changed, 2 insertions(+)
> >
> > diff --git a/drivers/media/platform/sti/hva/hva-hw.c b/drivers/media/platform/sti/hva/hva-hw.c
> > index 401aaafa1710..bb13348be083 100644
> > --- a/drivers/media/platform/sti/hva/hva-hw.c
> > +++ b/drivers/media/platform/sti/hva/hva-hw.c
> > @@ -272,6 +272,7 @@ static unsigned long int hva_hw_get_ip_version(struct hva_dev *hva)
> >
> >       if (pm_runtime_get_sync(dev) < 0) {
> >               dev_err(dev, "%s     failed to get pm_runtime\n", HVA_PREFIX);
> > +             pm_runtime_put_noidle(dev);
> >               mutex_unlock(&hva->protect_mutex);
>
> This appears to be a spurious mutex_unlock() since I don't see a corresponding mutex_lock.
>
> Jean-Christophe, can you check this and, if I am right, post a patch fixing this?

Probably patch should be skipped due to uncertain intentions:
https://lore.kernel.org/linux-nfs/YH+7ZydHv4+Y1hlx@kroah.com/

Best regards,
Krzysztof