From: Biren Pandya <birenpandya@gmail.com>
To: "Jonathan Cameron" <jic23@kernel.org>,
"David Lechner" <dlechner@baylibre.com>,
"Nuno Sá" <nuno.sa@analog.com>,
"Andy Shevchenko" <andy@kernel.org>,
"Linus Walleij" <linusw@kernel.org>
Cc: linux-iio@vger.kernel.org, linux-kernel@vger.kernel.org,
Biren Pandya <birenpandya@gmail.com>
Subject: [PATCH 2/2] iio: accel: kxsd9: fix runtime PM leaks and unchecked returns
Date: Fri, 03 Jul 2026 22:53:23 +0530 [thread overview]
Message-ID: <20260703-kxsd9-v3-proper-v1-2-e9f08af25d7e@gmail.com> (raw)
In-Reply-To: <20260703-kxsd9-v3-proper-v1-0-e9f08af25d7e@gmail.com>
The driver fails to check the return value of pm_runtime_get_sync(),
leading to potential silent failures. Additionally, error paths leak the
runtime PM usage counter by returning without decrementing it.
Fix this by transitioning to pm_runtime_resume_and_get():
- In kxsd9_write_raw() and kxsd9_read_raw(), check the resume status and
guarantee pm_runtime_put_autosuspend() is called on all return paths.
Simultaneously, refactor the control flow to align with standard IIO
idioms (removing the dead -EINVAL initializer in favor of explicit
assignments).
- In kxsd9_buffer_preenable(), propagate the resume error code.
- In kxsd9_common_remove(), only decrement the usage counter on a
successful resume, while retaining the unconditional power-down for a
best-effort shutdown.
Fixes: 9a9a369d6178 ("iio: accel: kxsd9: Deploy system and runtime PM")
Signed-off-by: Biren Pandya <birenpandya@gmail.com>
---
drivers/iio/accel/kxsd9.c | 42 ++++++++++++++++++++++--------------------
1 file changed, 22 insertions(+), 20 deletions(-)
diff --git a/drivers/iio/accel/kxsd9.c b/drivers/iio/accel/kxsd9.c
index 27adcdd312014..e9a0790e2eea2 100644
--- a/drivers/iio/accel/kxsd9.c
+++ b/drivers/iio/accel/kxsd9.c
@@ -139,18 +139,17 @@ static int kxsd9_write_raw(struct iio_dev *indio_dev,
int val2,
long mask)
{
- int ret = -EINVAL;
struct kxsd9_state *st = iio_priv(indio_dev);
+ int ret;
- pm_runtime_get_sync(st->dev);
+ ret = pm_runtime_resume_and_get(st->dev);
+ if (ret < 0)
+ return ret;
- if (mask == IIO_CHAN_INFO_SCALE) {
- /* Check no integer component */
- if (val)
- ret = -EINVAL;
- else
- ret = kxsd9_write_scale(indio_dev, val2);
- }
+ if (mask == IIO_CHAN_INFO_SCALE && !val)
+ ret = kxsd9_write_scale(indio_dev, val2);
+ else
+ ret = -EINVAL;
pm_runtime_put_autosuspend(st->dev);
@@ -161,20 +160,22 @@ static int kxsd9_read_raw(struct iio_dev *indio_dev,
struct iio_chan_spec const *chan,
int *val, int *val2, long mask)
{
- int ret = -EINVAL;
struct kxsd9_state *st = iio_priv(indio_dev);
unsigned int regval;
__be16 raw_val;
u16 nval;
+ int ret;
- pm_runtime_get_sync(st->dev);
+ ret = pm_runtime_resume_and_get(st->dev);
+ if (ret < 0)
+ return ret;
switch (mask) {
case IIO_CHAN_INFO_RAW:
ret = regmap_bulk_read(st->map, chan->address, &raw_val,
sizeof(raw_val));
if (ret)
- goto error_ret;
+ break;
nval = be16_to_cpu(raw_val);
/* Only 12 bits are valid */
nval >>= 4;
@@ -191,18 +192,20 @@ static int kxsd9_read_raw(struct iio_dev *indio_dev,
KXSD9_REG_CTRL_C,
®val);
if (ret < 0)
- goto error_ret;
+ break;
*val = 0;
*val2 = kxsd9_micro_scales[regval & KXSD9_CTRL_C_FS_MASK];
ret = IIO_VAL_INT_PLUS_MICRO;
break;
+ default:
+ ret = -EINVAL;
+ break;
}
-error_ret:
pm_runtime_put_autosuspend(st->dev);
return ret;
-};
+}
static irqreturn_t kxsd9_trigger_handler(int irq, void *p)
{
@@ -240,9 +243,7 @@ static int kxsd9_buffer_preenable(struct iio_dev *indio_dev)
{
struct kxsd9_state *st = iio_priv(indio_dev);
- pm_runtime_get_sync(st->dev);
-
- return 0;
+ return pm_runtime_resume_and_get(st->dev);
}
static int kxsd9_buffer_postdisable(struct iio_dev *indio_dev)
@@ -480,8 +481,9 @@ void kxsd9_common_remove(struct device *dev)
iio_device_unregister(indio_dev);
iio_triggered_buffer_cleanup(indio_dev);
- pm_runtime_get_sync(dev);
- pm_runtime_put_noidle(dev);
+
+ if (pm_runtime_resume_and_get(dev) >= 0)
+ pm_runtime_put_noidle(dev);
pm_runtime_disable(dev);
kxsd9_power_down(st);
}
--
Git-155)
next prev parent reply other threads:[~2026-07-03 17:23 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-03 17:23 [PATCH 0/2] iio: accel: kxsd9: fix use-after-free and PM leaks Biren Pandya
2026-07-03 17:23 ` [PATCH 1/2] iio: accel: kxsd9: fix use-after-free on remove Biren Pandya
2026-07-05 0:09 ` Jonathan Cameron
2026-07-03 17:23 ` Biren Pandya [this message]
2026-07-05 0:19 ` [PATCH 2/2] iio: accel: kxsd9: fix runtime PM leaks and unchecked returns Jonathan Cameron
2026-07-05 0:05 ` [PATCH 0/2] iio: accel: kxsd9: fix use-after-free and PM leaks Jonathan Cameron
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260703-kxsd9-v3-proper-v1-2-e9f08af25d7e@gmail.com \
--to=birenpandya@gmail.com \
--cc=andy@kernel.org \
--cc=dlechner@baylibre.com \
--cc=jic23@kernel.org \
--cc=linusw@kernel.org \
--cc=linux-iio@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=nuno.sa@analog.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
Powered by JetHome