Re: [PATCH] slimbus: messaging: fix leaked PM vote on tid allocation failure

[Zongmin Zhou <min_halo@163.com>]

在 2026/9/18 06:10, Srinivas Kandagatla 写道:
>
> On 8/27/26 3:14 AM, Zongmin Zhou wrote:
>> From: Zongmin Zhou <zhouzongmin@kylinos.cn>
>>
>> In slim_do_transfer(), when a transaction needs a tid and
>> slim_alloc_txn_tid() fails, the function returns directly instead of
>> jumping to slim_xfer_err. The runtime PM vote taken earlier with
>> pm_runtime_get_sync() is then never released, leaving the controller
>> permanently powered up.
>>
>> As txn->tid is still 0 at that point, jumping to slim_xfer_err drops
>> the vote exactly like it is done for other failed transactions.
>>
Hi Srinivas,
Thanks for the review.
> Patch itself looks fine, was this bug hit on real hardware or is this
> generated from some AI.
Found during code review while porting patches, not on real hardware.
The trigger requires an exhausted tid space, which is unlikely to occur
naturally.
>
> How are you testing this patch?
Tested in a VM with a stub controller that exhausts the tid space
(255 allocations, SLIM_MAX_TIDS is 256) and then issues a need_tid
transfer, so slim_alloc_txn_tid() fails with -ENOSPC inside
slim_do_transfer():
   unpatched: slim_do_transfer() returns -ENOSPC, usage_count stays 1,
              device never suspends
   patched:   same return value, usage_count 0, device autosuspends
>
>> Fixes: d3062a2109309 ("slimbus: messaging: add slim_alloc/free_txn_tid()")
> Missing CC stable
Will add in v2, thanks.
>> Signed-off-by: Zongmin Zhou <zhouzongmin@kylinos.cn>
>> ---
>>   drivers/slimbus/messaging.c | 2 +-
>>   1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/drivers/slimbus/messaging.c b/drivers/slimbus/messaging.c
>> index e2dbe4a..ee127ef 100644
>> --- a/drivers/slimbus/messaging.c
>> +++ b/drivers/slimbus/messaging.c
>> @@ -139,7 +139,7 @@ int slim_do_transfer(struct slim_controller *ctrl, struct slim_msg_txn *txn)
>>   	if (need_tid) {
>>   		ret = slim_alloc_txn_tid(ctrl, txn);
>>   		if (ret)
>> -			return ret;
>> +			goto slim_xfer_err;
>>   
>>   		if (!txn->msg->comp)
>>   			txn->comp = &done;