[v2] watchdog: starfive-wdt: fix PM reference leak in probe error path

[PATCH v2] watchdog: starfive-wdt: fix PM reference leak in probe error path

Posted by Ivy Lopez 1 week, 3 days ago

pm_runtime_resume_and_get() increments the runtime PM usage counter
and, via starfive_wdt_runtime_resume(), enables the clocks. If a
later step in probe() fails (reset_init, clock rate check,
watchdog_start, or watchdog_register_device), control reaches
err_exit, which calls pm_runtime_disable() but never balances the
earlier get, leaking the PM usage count.

Track whether a PM reference is currently held (pm_ref_held) and
whether the clocks are currently enabled (clocks_on), and use them
in err_exit to release exactly what was acquired:

 - if a PM reference is held, put it via pm_runtime_put_sync();
   only fall back to a manual clock disable if the resulting
   suspend transition did not actually run (put failure), since
   the runtime_suspend callback already disables the clocks on a
   successful put and a redundant call would double-disable them
   and underflow the clock enable count.
 - if no PM reference is held but the clocks were enabled directly
   (runtime PM disabled case), disable them manually.

Also propagate this accounting to the existing pm_runtime_put_sync()
call at the end of a successful probe: its usage-count decrement
happens regardless of the call's return value, so pm_ref_held must
be cleared immediately after calling it to avoid a second,
unbalanced put_sync() call if a later step in that path fails and
falls through to err_exit.

Fixes: db728ea9c7be ("drivers: watchdog: Add StarFive Watchdog driver")
Signed-off-by: Ivy Lopez <skunkolee@gmail.com>
---
v2:
 - Fix double clock-disable / clock-enable-count underflow when a
   PM reference was already released via a successful
   pm_runtime_put_sync() in err_exit
 - Fix double pm_runtime_put_sync() / usage-count underflow when
   falling through from the tail put failure to err_unregister_wdt

 drivers/watchdog/starfive-wdt.c | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/drivers/watchdog/starfive-wdt.c b/drivers/watchdog/starfive-wdt.c
index af55adc4a3c6..4ad587732bda 100644
--- a/drivers/watchdog/starfive-wdt.c
+++ b/drivers/watchdog/starfive-wdt.c
@@ -429,6 +429,8 @@ static int starfive_wdt_probe(struct platform_device *pdev)
 {
 	struct starfive_wdt *wdt;
 	int ret;
+	bool pm_ref_held = false;
+	bool clocks_on = false;
 
 	wdt = devm_kzalloc(&pdev->dev, sizeof(*wdt), GFP_KERNEL);
 	if (!wdt)
@@ -449,11 +451,14 @@ static int starfive_wdt_probe(struct platform_device *pdev)
 		ret = pm_runtime_resume_and_get(&pdev->dev);
 		if (ret < 0)
 			return ret;
+		pm_ref_held = true;
+		clocks_on = true;
 	} else {
 		/* runtime PM is disabled but clocks need to be enabled */
 		ret = starfive_wdt_enable_clock(wdt);
 		if (ret)
 			return ret;
+		clocks_on = true;
 	}
 
 	ret = starfive_wdt_reset_init(&pdev->dev);
@@ -499,6 +504,9 @@ static int starfive_wdt_probe(struct platform_device *pdev)
 	if (!early_enable) {
 		if (pm_runtime_enabled(&pdev->dev)) {
 			ret = pm_runtime_put_sync(&pdev->dev);
+			pm_ref_held = false;
+			if (ret == 0)
+				clocks_on = false;
 			if (ret)
 				goto err_unregister_wdt;
 		}
@@ -509,7 +517,12 @@ static int starfive_wdt_probe(struct platform_device *pdev)
 err_unregister_wdt:
 	watchdog_unregister_device(&wdt->wdd);
 err_exit:
-	starfive_wdt_disable_clock(wdt);
+	if (pm_ref_held) {
+		if (pm_runtime_put_sync(&pdev->dev))
+			starfive_wdt_disable_clock(wdt);
+	} else if (clocks_on) {
+		starfive_wdt_disable_clock(wdt);
+	}
 	pm_runtime_disable(&pdev->dev);
 
 	return ret;
-- 
2.55.0

Re: [PATCH v2] watchdog: starfive-wdt: fix PM reference leak in probe error path

Posted by Guenter Roeck 1 week, 3 days ago

On 9/14/26 20:20, Ivy Lopez wrote:
> pm_runtime_resume_and_get() increments the runtime PM usage counter
> and, via starfive_wdt_runtime_resume(), enables the clocks. If a
> later step in probe() fails (reset_init, clock rate check,
> watchdog_start, or watchdog_register_device), control reaches
> err_exit, which calls pm_runtime_disable() but never balances the
> earlier get, leaking the PM usage count.
> 
> Track whether a PM reference is currently held (pm_ref_held) and
> whether the clocks are currently enabled (clocks_on), and use them
> in err_exit to release exactly what was acquired:
> 
>   - if a PM reference is held, put it via pm_runtime_put_sync();
>     only fall back to a manual clock disable if the resulting
>     suspend transition did not actually run (put failure), since
>     the runtime_suspend callback already disables the clocks on a
>     successful put and a redundant call would double-disable them
>     and underflow the clock enable count.
>   - if no PM reference is held but the clocks were enabled directly
>     (runtime PM disabled case), disable them manually.
> 
> Also propagate this accounting to the existing pm_runtime_put_sync()
> call at the end of a successful probe: its usage-count decrement
> happens regardless of the call's return value, so pm_ref_held must
> be cleared immediately after calling it to avoid a second,
> unbalanced put_sync() call if a later step in that path fails and
> falls through to err_exit.
> 
> Fixes: db728ea9c7be ("drivers: watchdog: Add StarFive Watchdog driver")
> Signed-off-by: Ivy Lopez <skunkolee@gmail.com>
> ---
> v2:
>   - Fix double clock-disable / clock-enable-count underflow when a
>     PM reference was already released via a successful
>     pm_runtime_put_sync() in err_exit
>   - Fix double pm_runtime_put_sync() / usage-count underflow when
>     falling through from the tail put failure to err_unregister_wdt
> 
>   drivers/watchdog/starfive-wdt.c | 15 ++++++++++++++-
>   1 file changed, 14 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/watchdog/starfive-wdt.c b/drivers/watchdog/starfive-wdt.c
> index af55adc4a3c6..4ad587732bda 100644
> --- a/drivers/watchdog/starfive-wdt.c
> +++ b/drivers/watchdog/starfive-wdt.c
> @@ -429,6 +429,8 @@ static int starfive_wdt_probe(struct platform_device *pdev)
>   {
>   	struct starfive_wdt *wdt;
>   	int ret;
> +	bool pm_ref_held = false;
> +	bool clocks_on = false;
>   
>   	wdt = devm_kzalloc(&pdev->dev, sizeof(*wdt), GFP_KERNEL);
>   	if (!wdt)
> @@ -449,11 +451,14 @@ static int starfive_wdt_probe(struct platform_device *pdev)
>   		ret = pm_runtime_resume_and_get(&pdev->dev);
>   		if (ret < 0)
>   			return ret;
> +		pm_ref_held = true;
> +		clocks_on = true;
>   	} else {
>   		/* runtime PM is disabled but clocks need to be enabled */
>   		ret = starfive_wdt_enable_clock(wdt);
>   		if (ret)
>   			return ret;
> +		clocks_on = true;
>   	}
>   
>   	ret = starfive_wdt_reset_init(&pdev->dev);
> @@ -499,6 +504,9 @@ static int starfive_wdt_probe(struct platform_device *pdev)
>   	if (!early_enable) {
>   		if (pm_runtime_enabled(&pdev->dev)) {
>   			ret = pm_runtime_put_sync(&pdev->dev);
> +			pm_ref_held = false;
> +			if (ret == 0)
> +				clocks_on = false;
>   			if (ret)
>   				goto err_unregister_wdt;
>   		}
> @@ -509,7 +517,12 @@ static int starfive_wdt_probe(struct platform_device *pdev)
>   err_unregister_wdt:
>   	watchdog_unregister_device(&wdt->wdd);
>   err_exit:
> -	starfive_wdt_disable_clock(wdt);
> +	if (pm_ref_held) {
> +		if (pm_runtime_put_sync(&pdev->dev))

The return value from pm_runtime_put_sync() is almost never checked.
I wonder if checking it creates more trouble than it is worth.

Guenter

> +			starfive_wdt_disable_clock(wdt);
> +	} else if (clocks_on) {
> +		starfive_wdt_disable_clock(wdt);
> +	}
>   	pm_runtime_disable(&pdev->dev);
>   
>   	return ret;

Re: [PATCH v2] watchdog: starfive-wdt: fix PM reference leak in probe error path

Posted by Guenter Roeck 1 week, 3 days ago

On 9/14/26 20:20, Ivy Lopez wrote:
> pm_runtime_resume_and_get() increments the runtime PM usage counter
> and, via starfive_wdt_runtime_resume(), enables the clocks. If a
> later step in probe() fails (reset_init, clock rate check,
> watchdog_start, or watchdog_register_device), control reaches
> err_exit, which calls pm_runtime_disable() but never balances the
> earlier get, leaking the PM usage count.
> 
> Track whether a PM reference is currently held (pm_ref_held) and
> whether the clocks are currently enabled (clocks_on), and use them
> in err_exit to release exactly what was acquired:
> 
>   - if a PM reference is held, put it via pm_runtime_put_sync();
>     only fall back to a manual clock disable if the resulting
>     suspend transition did not actually run (put failure), since
>     the runtime_suspend callback already disables the clocks on a
>     successful put and a redundant call would double-disable them
>     and underflow the clock enable count.
>   - if no PM reference is held but the clocks were enabled directly
>     (runtime PM disabled case), disable them manually.
> 
> Also propagate this accounting to the existing pm_runtime_put_sync()
> call at the end of a successful probe: its usage-count decrement
> happens regardless of the call's return value, so pm_ref_held must
> be cleared immediately after calling it to avoid a second,
> unbalanced put_sync() call if a later step in that path fails and
> falls through to err_exit.
> 
> Fixes: db728ea9c7be ("drivers: watchdog: Add StarFive Watchdog driver")
> Signed-off-by: Ivy Lopez <skunkolee@gmail.com>

I really don't get it. People keep sending new patch revisions as response
to previous patch revisions, even though that is discouraged, but no one
admits where they get the idea from.

I am going to just ignore such submissions in the future. Last warning.

Guenter