imx290_probe() takes an initial runtime PM reference with
pm_runtime_get_noresume(). Historically, the probe error path balanced
that reference with pm_runtime_put_noidle().

The change that moved the successful-path pm_runtime_put_autosuspend()
into imx290_subdev_init() made the initial runtime PM reference get
dropped once imx290_subdev_init() is called.

The longest probe error path, however, still falls through to err_pm
and calls pm_runtime_put_noidle(). Failures from imx290_subdev_init()
or v4l2_async_register_subdev() therefore decrement the runtime PM
usage count a second time.

Move pm_runtime_put_noidle() to the imx290_stop_streaming() failure
path, which is the only error path taken before imx290_subdev_init()
drops the initial runtime PM reference.

This issue was found by manual code inspection.

Fixes: a92651b8e288 ("media: i2c: imx290: Avoid communication during probe()")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
---
 drivers/media/i2c/imx290.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/media/i2c/imx290.c b/drivers/media/i2c/imx290.c
index 21cbc81cb2ed..c2cdb1557dea 100644
--- a/drivers/media/i2c/imx290.c
+++ b/drivers/media/i2c/imx290.c
@@ -1634,6 +1634,7 @@ static int imx290_probe(struct i2c_client *client)
 	ret = imx290_stop_streaming(imx290);
 	if (ret) {
 		ret = dev_err_probe(dev, ret, "Could not initialize device\n");
+		pm_runtime_put_noidle(dev);
 		goto err_pm;
 	}
 
@@ -1662,7 +1663,6 @@ static int imx290_probe(struct i2c_client *client)
 	imx290_subdev_cleanup(imx290);
 err_pm:
 	pm_runtime_disable(dev);
-	pm_runtime_put_noidle(dev);
 	imx290_power_off(imx290);
 	return ret;
 }
-- 
2.43.0

Hi Guangshuo,

On Tue, Sep 15, 2026 at 04:22:29PM +0800, Guangshuo Li wrote:
> imx290_probe() takes an initial runtime PM reference with
> pm_runtime_get_noresume(). Historically, the probe error path balanced
> that reference with pm_runtime_put_noidle().
> 
> The change that moved the successful-path pm_runtime_put_autosuspend()
> into imx290_subdev_init() made the initial runtime PM reference get
> dropped once imx290_subdev_init() is called.
> 
> The longest probe error path, however, still falls through to err_pm
> and calls pm_runtime_put_noidle(). Failures from imx290_subdev_init()
> or v4l2_async_register_subdev() therefore decrement the runtime PM
> usage count a second time.
> 
> Move pm_runtime_put_noidle() to the imx290_stop_streaming() failure
> path, which is the only error path taken before imx290_subdev_init()
> drops the initial runtime PM reference.
> 
> This issue was found by manual code inspection.
> 
> Fixes: a92651b8e288 ("media: i2c: imx290: Avoid communication during probe()")
> Cc: stable@vger.kernel.org
> Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
> ---
>  drivers/media/i2c/imx290.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/media/i2c/imx290.c b/drivers/media/i2c/imx290.c
> index 21cbc81cb2ed..c2cdb1557dea 100644
> --- a/drivers/media/i2c/imx290.c
> +++ b/drivers/media/i2c/imx290.c
> @@ -1634,6 +1634,7 @@ static int imx290_probe(struct i2c_client *client)
>  	ret = imx290_stop_streaming(imx290);
>  	if (ret) {
>  		ret = dev_err_probe(dev, ret, "Could not initialize device\n");
> +		pm_runtime_put_noidle(dev);

Don't add extra error handling here.

Please do the same as for gc0308: drop getting and putting references
altogether, and call pm_runtime_idle() at the end of probe().

>  		goto err_pm;
>  	}
>  
> @@ -1662,7 +1663,6 @@ static int imx290_probe(struct i2c_client *client)
>  	imx290_subdev_cleanup(imx290);
>  err_pm:
>  	pm_runtime_disable(dev);
> -	pm_runtime_put_noidle(dev);
>  	imx290_power_off(imx290);
>  	return ret;
>  }

-- 
Regards,

Sakari Ailus