[PATCH v2] hwrng: stm32: fix usage_count leak when autosuspend_delay is negative

[PATCH v2] hwrng: stm32: fix usage_count leak when autosuspend_delay is negative

[Guangshuo Li]

stm32_rng_probe() calls pm_runtime_use_autosuspend(), but runtime PM is
enabled with pm_runtime_enable() and the matching
pm_runtime_dont_use_autosuspend() is not called on driver teardown.

If the autosuspend delay is set to a negative value while autosuspend
is enabled, the runtime PM core increments usage_count to prevent
runtime suspend. Without calling pm_runtime_dont_use_autosuspend()
during teardown, this reference is not dropped and usage_count remains
unbalanced.

Use devm_pm_runtime_enable() so that pm_runtime_dont_use_autosuspend()
and pm_runtime_disable() are automatically called on probe failure and
driver teardown. With runtime PM cleanup handled by devres,
stm32_rng_remove() is no longer needed.

This issue was found by manual code inspection.

Fixes: c6a97c42e399 ("hwrng: stm32 - add support for STM32 HW RNG")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
v2:
  - Replace pm_runtime_enable() with devm_pm_runtime_enable() to handle
    runtime PM cleanup through devres.
  - Remove stm32_rng_remove() and the manual cleanup on the probe failure
    path.

 drivers/char/hw_random/stm32-rng.c | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/drivers/char/hw_random/stm32-rng.c b/drivers/char/hw_random/stm32-rng.c
index 9a8c00586ab0..f5bfe54c01dc 100644
--- a/drivers/char/hw_random/stm32-rng.c
+++ b/drivers/char/hw_random/stm32-rng.c
@@ -368,11 +368,6 @@ static int stm32_rng_init(struct hwrng *rng)
 	return 0;
 }
 
-static void stm32_rng_remove(struct platform_device *ofdev)
-{
-	pm_runtime_disable(&ofdev->dev);
-}
-
 static int __maybe_unused stm32_rng_runtime_suspend(struct device *dev)
 {
 	struct stm32_rng_private *priv = dev_get_drvdata(dev);
@@ -590,7 +585,9 @@ static int stm32_rng_probe(struct platform_device *ofdev)
 
 	pm_runtime_set_autosuspend_delay(dev, 100);
 	pm_runtime_use_autosuspend(dev);
-	pm_runtime_enable(dev);
+	ret = devm_pm_runtime_enable(dev);
+	if (ret)
+		return ret;
 
 	return devm_hwrng_register(dev, &priv->rng);
 }
@@ -602,7 +599,6 @@ static struct platform_driver stm32_rng_driver = {
 		.of_match_table = stm32_rng_match,
 	},
 	.probe = stm32_rng_probe,
-	.remove = stm32_rng_remove,
 };
 
 module_platform_driver(stm32_rng_driver);
-- 
2.43.0

Re: [PATCH v2] hwrng: stm32: fix usage_count leak when autosuspend_delay is negative

[Linus Walleij]

On Tue, Aug 11, 2026 at 8:35 AM Guangshuo Li <lgs201920130244@gmail.com> wrote:

> stm32_rng_probe() calls pm_runtime_use_autosuspend(), but runtime PM is
> enabled with pm_runtime_enable() and the matching
> pm_runtime_dont_use_autosuspend() is not called on driver teardown.
>
> If the autosuspend delay is set to a negative value while autosuspend
> is enabled, the runtime PM core increments usage_count to prevent
> runtime suspend. Without calling pm_runtime_dont_use_autosuspend()
> during teardown, this reference is not dropped and usage_count remains
> unbalanced.
>
> Use devm_pm_runtime_enable() so that pm_runtime_dont_use_autosuspend()
> and pm_runtime_disable() are automatically called on probe failure and
> driver teardown. With runtime PM cleanup handled by devres,
> stm32_rng_remove() is no longer needed.
>
> This issue was found by manual code inspection.
>
> Fixes: c6a97c42e399 ("hwrng: stm32 - add support for STM32 HW RNG")
> Cc: stable@vger.kernel.org
> Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>

Reviewed-by: Linus Walleij <linusw@kernel.org>

Yours,
Linus Walleij

Re: [PATCH v2] hwrng: stm32: fix usage_count leak when autosuspend_delay is negative

[Daniel Thompson]

On Tue, Aug 11, 2026 at 02:34:42PM +0800, Guangshuo Li wrote:
> stm32_rng_probe() calls pm_runtime_use_autosuspend(), but runtime PM is
> enabled with pm_runtime_enable() and the matching
> pm_runtime_dont_use_autosuspend() is not called on driver teardown.
>
> If the autosuspend delay is set to a negative value while autosuspend
> is enabled, the runtime PM core increments usage_count to prevent
> runtime suspend. Without calling pm_runtime_dont_use_autosuspend()
> during teardown, this reference is not dropped and usage_count remains
> unbalanced.
>
> Use devm_pm_runtime_enable() so that pm_runtime_dont_use_autosuspend()
> and pm_runtime_disable() are automatically called on probe failure and
> driver teardown. With runtime PM cleanup handled by devres,
> stm32_rng_remove() is no longer needed.
>
> This issue was found by manual code inspection.
>
> Fixes: c6a97c42e399 ("hwrng: stm32 - add support for STM32 HW RNG")
> Cc: stable@vger.kernel.org
> Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
> ---
> v2:
>   - Replace pm_runtime_enable() with devm_pm_runtime_enable() to handle
>     runtime PM cleanup through devres.
>   - Remove stm32_rng_remove() and the manual cleanup on the probe failure
>     path.

devres changes look great!

Reviewed-by: Daniel Thompson (RISCstar) <danielt@kernel.org>


Daniel.

Re: [PATCH v2] hwrng: stm32: fix usage_count leak when autosuspend_delay is negative

[Maxime MERE]

On 8/11/26 08:34, Guangshuo Li wrote:
> stm32_rng_probe() calls pm_runtime_use_autosuspend(), but runtime PM is
> enabled with pm_runtime_enable() and the matching
> pm_runtime_dont_use_autosuspend() is not called on driver teardown.
> 
> If the autosuspend delay is set to a negative value while autosuspend
> is enabled, the runtime PM core increments usage_count to prevent
> runtime suspend. Without calling pm_runtime_dont_use_autosuspend()
> during teardown, this reference is not dropped and usage_count remains
> unbalanced.
> 
> Use devm_pm_runtime_enable() so that pm_runtime_dont_use_autosuspend()
> and pm_runtime_disable() are automatically called on probe failure and
> driver teardown. With runtime PM cleanup handled by devres,
> stm32_rng_remove() is no longer needed.
> 
> This issue was found by manual code inspection.
> 
> Fixes: c6a97c42e399 ("hwrng: stm32 - add support for STM32 HW RNG")
> Cc: stable@vger.kernel.org
> Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>

Hi Guangshuo,

Thanks for your investigation. You've found one problem, but I think 
you've solved three issues with your patch, and the one you describe is 
the most minor of them.

The usage_count imbalance is real, but the driver never sets a negative 
autosuspend_delay_ms itself, and the count is rebalanced on the next 
probe anyway.

For the two others: when stm32_rng_read() arms a 100 ms autosuspend 
timer, if we unbind within this 100 ms window, stm32_rng_remove() 
cancels the pending suspend and leaves the device RPM_ACTIVE: 
stm32_rng_runtime_suspend() never runs, so the RNG is left enabled with 
its clocks prepared and its power domain held forever. Moreover, the 
remove operation runs before devres released the hwrng registration, so 
reads could still land on a device whose runtime PM was already disabled 
and fail with -EACCES.

Your patch fixes both, because devm_pm_runtime_enable() registered 
before devm_hwrng_register() unwinds in the right order and 
pm_runtime_dont_use_autosuspend() forces a synchronous suspend before 
the disable.

So I recommend adapting your commit message around those points, as I 
think the Cc: stable is justified by those two.

Reviewed-by: Maxime Méré <maxime.mere@foss.st.com>

Cheers,

Maxime