[PATCH 4/4] dmaengine: rcar-dmac: Fix runtime PM leak in error path of channel alloc

[PATCH 4/4] dmaengine: rcar-dmac: Fix runtime PM leak in error path of channel alloc

[Wentao Liang]

rcar_dmac_alloc_chan_resources() ends with
"return pm_runtime_get_sync(chan->device->dev);".  Even when
pm_runtime_get_sync() fails, it leaves the device's runtime PM
usage count incremented, and the negative return value propagates
straight to the dmaengine core, which aborts the channel
allocation without ever calling device_free_chan_resources().  The
balanced pm_runtime_put() only happens later in
rcar_dmac_free_chan_resources(), so the reference is leaked
whenever resuming the device fails.

Use pm_runtime_resume_and_get() instead, which drops the reference
again on failure and returns 0 on success.

Fixes: 87244fe5abdf ("dmaengine: rcar-dmac: Add Renesas R-Car Gen2 DMA Controller (DMAC) driver")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/dma/sh/rcar-dmac.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/dma/sh/rcar-dmac.c b/drivers/dma/sh/rcar-dmac.c
index 44eab2d21d54..2d2baa36feea 100644
--- a/drivers/dma/sh/rcar-dmac.c
+++ b/drivers/dma/sh/rcar-dmac.c
@@ -1068,7 +1068,7 @@ static int rcar_dmac_alloc_chan_resources(struct dma_chan *chan)
 	if (ret < 0)
 		return -ENOMEM;
 
-	return pm_runtime_get_sync(chan->device->dev);
+	return pm_runtime_resume_and_get(chan->device->dev);
 }
 
 static void rcar_dmac_free_chan_resources(struct dma_chan *chan)
-- 
2.34.1

Re: [PATCH 4/4] dmaengine: rcar-dmac: Fix runtime PM leak in error path of channel alloc

[Wolfram Sang]

[-- Attachment #1: Type: text/plain, Size: 1188 bytes --]

On Tue, Sep 15, 2026 at 03:56:02AM +0000, Wentao Liang wrote:
> rcar_dmac_alloc_chan_resources() ends with
> "return pm_runtime_get_sync(chan->device->dev);".  Even when
> pm_runtime_get_sync() fails, it leaves the device's runtime PM
> usage count incremented, and the negative return value propagates
> straight to the dmaengine core, which aborts the channel
> allocation without ever calling device_free_chan_resources().  The
> balanced pm_runtime_put() only happens later in
> rcar_dmac_free_chan_resources(), so the reference is leaked
> whenever resuming the device fails.
> 
> Use pm_runtime_resume_and_get() instead, which drops the reference
> again on failure and returns 0 on success.
> 
> Fixes: 87244fe5abdf ("dmaengine: rcar-dmac: Add Renesas R-Car Gen2 DMA Controller (DMAC) driver")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>

Thanks for this patch. This is a duplicate of a previously sent patch
which seem to have fallen through the cracks[1]. I will resend the old
patch, but thank you for pointing out the issue again.

[1] https://lore.kernel.org/all/tencent_71CC9630D88A8792C2396A8844DCCD5C6D06@qq.com/


[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

Re: [PATCH 4/4] dmaengine: rcar-dmac: Fix runtime PM leak in error path of channel alloc

[Frank Li]

On Tue, Sep 15, 2026 at 03:56:02AM +0000, Wentao Liang wrote:
> [You don't often get email from vulab@iscas.ac.cn. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
>
> rcar_dmac_alloc_chan_resources() ends with
> "return pm_runtime_get_sync(chan->device->dev);".  Even when
> pm_runtime_get_sync() fails, it leaves the device's runtime PM
> usage count incremented, and the negative return value propagates
> straight to the dmaengine core, which aborts the channel
> allocation without ever calling device_free_chan_resources().  The
> balanced pm_runtime_put() only happens later in
> rcar_dmac_free_chan_resources(), so the reference is leaked
> whenever resuming the device fails.
>
> Use pm_runtime_resume_and_get() instead, which drops the reference
> again on failure and returns 0 on success.
>
> Fixes: 87244fe5abdf ("dmaengine: rcar-dmac: Add Renesas R-Car Gen2 DMA Controller (DMAC) driver")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---

Reviewed-by: Frank Li <Frank.Li@nxp.com>

>  drivers/dma/sh/rcar-dmac.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/dma/sh/rcar-dmac.c b/drivers/dma/sh/rcar-dmac.c
> index 44eab2d21d54..2d2baa36feea 100644
> --- a/drivers/dma/sh/rcar-dmac.c
> +++ b/drivers/dma/sh/rcar-dmac.c
> @@ -1068,7 +1068,7 @@ static int rcar_dmac_alloc_chan_resources(struct dma_chan *chan)
>         if (ret < 0)
>                 return -ENOMEM;
>
> -       return pm_runtime_get_sync(chan->device->dev);
> +       return pm_runtime_resume_and_get(chan->device->dev);
>  }
>
>  static void rcar_dmac_free_chan_resources(struct dma_chan *chan)
> --
> 2.34.1
>