[PATCH 2/4] accel/rocket: fix runtime PM refcount leak in rocket_job_run()

[PATCH 2/4] accel/rocket: fix runtime PM refcount leak in rocket_job_run()

[Wentao Liang]

rocket_job_run() powers the NPU core up with pm_runtime_get_sync(),
which increments the runtime PM usage counter even when it fails, and
then returns the fence without dropping the reference on both the
pm_runtime_get_sync() and the iommu_attach_group() failure paths.

At that point core->in_flight_job is still unset, so neither
rocket_job_handle_irq() nor rocket_reset() will balance the counter
later, and the core can never runtime suspend again.

Use pm_runtime_resume_and_get() instead, which does not bump the usage
counter on failure, and drop the reference with
pm_runtime_put_autosuspend() if iommu_attach_group() fails.

Fixes: 0810d5ad88a1 ("accel/rocket: Add job submission IOCTL")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/accel/rocket/rocket_job.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/accel/rocket/rocket_job.c b/drivers/accel/rocket/rocket_job.c
index ac51bff39833..ce7acf728367 100644
--- a/drivers/accel/rocket/rocket_job.c
+++ b/drivers/accel/rocket/rocket_job.c
@@ -310,13 +310,15 @@ static struct dma_fence *rocket_job_run(struct drm_sched_job *sched_job)
 		dma_fence_put(job->done_fence);
 	job->done_fence = dma_fence_get(fence);
 
-	ret = pm_runtime_get_sync(core->dev);
+	ret = pm_runtime_resume_and_get(core->dev);
 	if (ret < 0)
 		return fence;
 
 	ret = iommu_attach_group(job->domain->domain, core->iommu_group);
-	if (ret < 0)
+	if (ret < 0) {
+		pm_runtime_put_autosuspend(core->dev);
 		return fence;
+	}
 
 	scoped_guard(mutex, &core->job_lock) {
 		core->in_flight_job = job;
-- 
2.34.1

Re: [PATCH 2/4] accel/rocket: fix runtime PM refcount leak in rocket_job_run()

[Igor Paunovic]

Hi Wentao,

This looks already fixed in mainline by commit 9b2dedadf6a9
("accel/rocket: Fix error path handling in rocket_job_run()"), which
is in v7.3-rc1, and the same code is in the 7.2.y and 6.18.y stable
trees. There, rocket_job_run() already uses
pm_runtime_resume_and_get() and drops the reference with
pm_runtime_put() when iommu_attach_group() fails.

Your diff is against the older rocket_job.c (index ac51bff39833, the
v7.1/v7.2 file), so it no longer applies to current mainline.

I checked this with the help of an LLM assistant, against the
git.kernel.org trees.

Igor