2020-06-14 03:33:19

by Qiushi Wu

Subject: [PATCH] media: sti: Fix reference count leaks

From: Qiushi Wu <[email protected]>

pm_runtime_get_sync() increments the runtime PM usage counter even
when it returns an error code, causing incorrect ref count if
pm_runtime_put_noidle() is not called in error handling paths.
Thus call pm_runtime_put_noidle() if pm_runtime_get_sync() fails.

Signed-off-by: Qiushi Wu <[email protected]>
---
drivers/media/platform/sti/hva/hva-hw.c | 2 ++
1 file changed, 2 insertions(+)

diff --git a/drivers/media/platform/sti/hva/hva-hw.c b/drivers/media/platform/sti/hva/hva-hw.c
index 401aaafa1710..bb13348be083 100644
--- a/drivers/media/platform/sti/hva/hva-hw.c
+++ b/drivers/media/platform/sti/hva/hva-hw.c
@@ -272,6 +272,7 @@ static unsigned long int hva_hw_get_ip_version(struct hva_dev *hva)

if (pm_runtime_get_sync(dev) < 0) {
dev_err(dev, "%s failed to get pm_runtime\n", HVA_PREFIX);
+ pm_runtime_put_noidle(dev);
mutex_unlock(&hva->protect_mutex);
return -EFAULT;
}
@@ -553,6 +554,7 @@ void hva_hw_dump_regs(struct hva_dev *hva, struct seq_file *s)

if (pm_runtime_get_sync(dev) < 0) {
seq_puts(s, "Cannot wake up IP\n");
+ pm_runtime_put_noidle(dev);
mutex_unlock(&hva->protect_mutex);
return;
}
--
2.17.1

2020-09-17 11:44:56

by Hans Verkuil

Subject: Re: [PATCH] media: sti: Fix reference count leaks

Hi Jean-Christophe,

I'll take this patch, but while reviewing it I noticed something else:

On 14/06/2020 05:31, [email protected] wrote:
> From: Qiushi Wu <[email protected]>
>
> pm_runtime_get_sync() increments the runtime PM usage counter even
> when it returns an error code, causing incorrect ref count if
> pm_runtime_put_noidle() is not called in error handling paths.
> Thus call pm_runtime_put_noidle() if pm_runtime_get_sync() fails.
>
> Signed-off-by: Qiushi Wu <[email protected]>
> ---
> drivers/media/platform/sti/hva/hva-hw.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/drivers/media/platform/sti/hva/hva-hw.c b/drivers/media/platform/sti/hva/hva-hw.c
> index 401aaafa1710..bb13348be083 100644
> --- a/drivers/media/platform/sti/hva/hva-hw.c
> +++ b/drivers/media/platform/sti/hva/hva-hw.c
> @@ -272,6 +272,7 @@ static unsigned long int hva_hw_get_ip_version(struct hva_dev *hva)
>
> if (pm_runtime_get_sync(dev) < 0) {
> dev_err(dev, "%s failed to get pm_runtime\n", HVA_PREFIX);
> + pm_runtime_put_noidle(dev);
> mutex_unlock(&hva->protect_mutex);

This appears to be a spurious mutex_unlock() since I don't see a corresponding mutex_lock.

Jean-Christophe, can you check this and, if I am right, post a patch fixing this?

Regards,

Hans

> return -EFAULT;
> }
> @@ -553,6 +554,7 @@ void hva_hw_dump_regs(struct hva_dev *hva, struct seq_file *s)
>
> if (pm_runtime_get_sync(dev) < 0) {
> seq_puts(s, "Cannot wake up IP\n");
> + pm_runtime_put_noidle(dev);
> mutex_unlock(&hva->protect_mutex);
> return;
> }
>

2021-04-21 17:19:47

by Krzysztof Kozlowski

Subject: Re: [PATCH] media: sti: Fix reference count leaks

On Thu, 17 Sept 2020 at 13:45, Hans Verkuil <[email protected]> wrote:
>
> Hi Jean-Christophe,
>
> I'll take this patch, but while reviewing it I noticed something else:
>
> On 14/06/2020 05:31, [email protected] wrote:
> > From: Qiushi Wu <[email protected]>
> >
> > pm_runtime_get_sync() increments the runtime PM usage counter even
> > when it returns an error code, causing incorrect ref count if
> > pm_runtime_put_noidle() is not called in error handling paths.
> > Thus call pm_runtime_put_noidle() if pm_runtime_get_sync() fails.
> >
> > Signed-off-by: Qiushi Wu <[email protected]>
> > ---
> > drivers/media/platform/sti/hva/hva-hw.c | 2 ++
> > 1 file changed, 2 insertions(+)
> >
> > diff --git a/drivers/media/platform/sti/hva/hva-hw.c b/drivers/media/platform/sti/hva/hva-hw.c
> > index 401aaafa1710..bb13348be083 100644
> > --- a/drivers/media/platform/sti/hva/hva-hw.c
> > +++ b/drivers/media/platform/sti/hva/hva-hw.c
> > @@ -272,6 +272,7 @@ static unsigned long int hva_hw_get_ip_version(struct hva_dev *hva)
> >
> > if (pm_runtime_get_sync(dev) < 0) {
> > dev_err(dev, "%s failed to get pm_runtime\n", HVA_PREFIX);
> > + pm_runtime_put_noidle(dev);
> > mutex_unlock(&hva->protect_mutex);
>
> This appears to be a spurious mutex_unlock() since I don't see a corresponding mutex_lock.
>
> Jean-Christophe, can you check this and, if I am right, post a patch fixing this?

Probably patch should be skipped due to uncertain intentions:
https://lore.kernel.org/linux-nfs/[email protected]/

Best regards,
Krzysztof