[PATCH] gpu: host1x: fix runtime PM reference leak on remove

[PATCH] gpu: host1x: fix runtime PM reference leak on remove

[Guangshuo Li]

host1x_probe() calls pm_runtime_resume_and_get() and intentionally keeps
the runtime PM usage reference for the lifetime of the driver because
host1x is not yet ready for dynamic runtime PM.

The probe error path drops this reference with
pm_runtime_put_sync_suspend(), but the remove path only calls
pm_runtime_force_suspend().

pm_runtime_force_suspend() disables runtime PM and invokes the runtime
suspend callback when necessary, but it does not decrement the runtime
PM usage counter. As a result, the reference acquired by
pm_runtime_resume_and_get() remains held after the driver is unbound.
Repeated bind and unbind cycles can therefore leave the runtime PM
usage counter increasingly unbalanced.

Drop the usage reference with pm_runtime_put_sync_suspend() before
forcing the device into suspend during removal.

This issue was found by manual code inspection.

Fixes: 6b6776e2ab8a ("gpu: host1x: Add initial runtime PM and OPP support")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
 drivers/gpu/host1x/dev.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/gpu/host1x/dev.c b/drivers/gpu/host1x/dev.c
index d2c64728f804..bb6a1647e4db 100644
--- a/drivers/gpu/host1x/dev.c
+++ b/drivers/gpu/host1x/dev.c
@@ -729,6 +729,7 @@ static void host1x_remove(struct platform_device *pdev)
 	host1x_unregister(host);
 	host1x_debug_deinit(host);
 
+	pm_runtime_put_sync_suspend(&pdev->dev);
 	pm_runtime_force_suspend(&pdev->dev);
 
 	host1x_intr_deinit(host);
-- 
2.43.0

Re: [PATCH] gpu: host1x: fix runtime PM reference leak on remove

[Mikko Perttunen]

On Sunday, September 13, 2026 9:02 PM Guangshuo Li wrote:
> host1x_probe() calls pm_runtime_resume_and_get() and intentionally keeps
> the runtime PM usage reference for the lifetime of the driver because
> host1x is not yet ready for dynamic runtime PM.
> 
> The probe error path drops this reference with
> pm_runtime_put_sync_suspend(), but the remove path only calls
> pm_runtime_force_suspend().
> 
> pm_runtime_force_suspend() disables runtime PM and invokes the runtime
> suspend callback when necessary, but it does not decrement the runtime
> PM usage counter. As a result, the reference acquired by
> pm_runtime_resume_and_get() remains held after the driver is unbound.
> Repeated bind and unbind cycles can therefore leave the runtime PM
> usage counter increasingly unbalanced.
> 
> Drop the usage reference with pm_runtime_put_sync_suspend() before
> forcing the device into suspend during removal.
> 
> This issue was found by manual code inspection.
> 
> Fixes: 6b6776e2ab8a ("gpu: host1x: Add initial runtime PM and OPP support")
> Cc: stable@vger.kernel.org
> Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
> ---
>  drivers/gpu/host1x/dev.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/gpu/host1x/dev.c b/drivers/gpu/host1x/dev.c
> index d2c64728f804..bb6a1647e4db 100644
> --- a/drivers/gpu/host1x/dev.c
> +++ b/drivers/gpu/host1x/dev.c
> @@ -729,6 +729,7 @@ static void host1x_remove(struct platform_device *pdev)
>  	host1x_unregister(host);
>  	host1x_debug_deinit(host);
>  
> +	pm_runtime_put_sync_suspend(&pdev->dev);
>  	pm_runtime_force_suspend(&pdev->dev);

After the pm_runtime_put_sync_suspend, the device should always be 
suspended, so I think we should also replace the call to 
pm_runtime_force_suspend with a pm_runtime_disable.

Thank you!
Mikko

>  
>  	host1x_intr_deinit(host);
> -- 
> 2.43.0
> 
>