[PATCH] net: ipa: Fix runtime PM reference leak in ipa_remove()

[PATCH] net: ipa: Fix runtime PM reference leak in ipa_remove()

[Wentao Liang]

ipa_remove() takes a runtime PM reference with pm_runtime_get_sync() and
is supposed to release it at the out_power_put label. If the modem fails
to stop, the function returns early and never drops that reference, so
the device usage counter stays elevated forever. Release the reference
before returning.

Fixes: cdf2e9419dd9 ("soc: qcom: ipa: main code")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/net/ipa/ipa_main.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/ipa/ipa_main.c b/drivers/net/ipa/ipa_main.c
index 788dd99af2a4..aab38fea91c6 100644
--- a/drivers/net/ipa/ipa_main.c
+++ b/drivers/net/ipa/ipa_main.c
@@ -975,6 +975,7 @@ static void ipa_remove(struct platform_device *pdev)
 			 */
 			dev_err(dev, "Failed to stop modem (%pe), leaking resources\n",
 				ERR_PTR(ret));
+			pm_runtime_put_noidle(dev);
 			return;
 		}
 
-- 
2.34.1

Re: [PATCH] net: ipa: Fix runtime PM reference leak in ipa_remove()

[Alex Elder]

On 9/17/26 6:51 AM, Wentao Liang wrote:
> ipa_remove() takes a runtime PM reference with pm_runtime_get_sync() and
> is supposed to release it at the out_power_put label. If the modem fails
> to stop, the function returns early and never drops that reference, so
> the device usage counter stays elevated forever. Release the reference
> before returning.
> 
> Fixes: cdf2e9419dd9 ("soc: qcom: ipa: main code")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>   drivers/net/ipa/ipa_main.c | 1 +
>   1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/net/ipa/ipa_main.c b/drivers/net/ipa/ipa_main.c
> index 788dd99af2a4..aab38fea91c6 100644
> --- a/drivers/net/ipa/ipa_main.c
> +++ b/drivers/net/ipa/ipa_main.c
> @@ -975,6 +975,7 @@ static void ipa_remove(struct platform_device *pdev)
>   			 */
>   			dev_err(dev, "Failed to stop modem (%pe), leaking resources\n",
>   				ERR_PTR(ret));
> +			pm_runtime_put_noidle(dev);
>   			return;
>   		}
>   

This issue has already been fixed.  See:
   6b9eaa61ff2df net: ipa: balance runtime PM reference on remove error

How did you find this problem?  that commit indicates a static
analysis checker was used.  If you benefited from any tools like
that you should probably explain that.

Thanks.

					-Alex

Re: [PATCH] net: ipa: Fix runtime PM reference leak in ipa_remove()

[Wentao Liang]

Hi Alex,

Sorry for the very late reply, and for the noise.

You are right that this is already fixed, and I should have caught it
before posting.  6b9eaa61ff2df ("net: ipa: balance runtime PM reference on
remove error") makes the same change, and it has been in mainline since
v7.3-rc1.  I rechecked ipa_remove() in the current tree, and that error
path now releases the reference:

			dev_err(dev, "Failed to stop modem (%pe), leaking resources\n",
				ERR_PTR(ret));
			pm_runtime_put_noidle(dev);
			return;

so the usage count is balanced there and there is nothing left to fix.
The patch needs no v2; please disregard it.  The patchwork entry already
shows as not applicable.

You asked how I found the problem.  The candidate came from our static
analysis tooling, which flagged the missing put on that error path.  I
then used DeepSeek and GPT-6.1 Sol to audit the finding and to help write
the change, and I reviewed the result myself before sending it.

What I got wrong is that the diff was prepared from an old snapshot
(v7.1-rc4 based) and I did not check the current tree before posting, so
I missed that the fix had already landed.  That is on me, and I am sorry
for the review time it cost you.

I am going through the outstanding feedback on my patches by hand now,
thread by thread, and will answer each one.

Thanks,
Wentao

Re: [PATCH] net: ipa: Fix runtime PM reference leak in ipa_remove()

[Alex Elder]

On 11/8/26 4:25 AM, Wentao Liang wrote:
> Hi Alex,
> 
> Sorry for the very late reply, and for the noise.

Sounds like you learned a few things:
- Always base your work on a recent published branch (like
   the latest Linux -rc, or linux-next/master, or whatever
   the maintainer prefers).
- When using tools like your static analysis tool and/or AI
   assistance as a major part of your effort, state that with
   and "Assisted-by" tag.
- Pace yourself on sending patches, allowing reviewers time
   to see them.  At least one day (so people anywhere in the
   world will get a chance), and more (because people are also
   busy).

Consider the last point especially true on AI-generated content.
Take the extra time to really review in depth any change, and
really understand its effects (both locally, and in the broader
context of where the code sits in the system).

One last lesson is that a single apology message to anyone who
might have been affected by your messages would have been fine.
I got three, and they largely overlapped each other.

It's OK, but I'm glad you view this as something you have learned
from.  Keep going, but keep improving.

					-Alex
> 
> You are right that this is already fixed, and I should have caught it
> before posting.  6b9eaa61ff2df ("net: ipa: balance runtime PM reference on
> remove error") makes the same change, and it has been in mainline since
> v7.3-rc1.  I rechecked ipa_remove() in the current tree, and that error
> path now releases the reference:
> 
> 			dev_err(dev, "Failed to stop modem (%pe), leaking resources\n",
> 				ERR_PTR(ret));
> 			pm_runtime_put_noidle(dev);
> 			return;
> 
> so the usage count is balanced there and there is nothing left to fix.
> The patch needs no v2; please disregard it.  The patchwork entry already
> shows as not applicable.
> 
> You asked how I found the problem.  The candidate came from our static
> analysis tooling, which flagged the missing put on that error path.  I
> then used DeepSeek and GPT-6.1 Sol to audit the finding and to help write
> the change, and I reviewed the result myself before sending it.
> 
> What I got wrong is that the diff was prepared from an old snapshot
> (v7.1-rc4 based) and I did not check the current tree before posting, so
> I missed that the fix had already landed.  That is on me, and I am sorry
> for the review time it cost you.
> 
> I am going through the outstanding feedback on my patches by hand now,
> thread by thread, and will answer each one.
> 
> Thanks,
> Wentao