ipa_remove() takes a runtime PM reference with pm_runtime_get_sync() and
is supposed to release it at the out_power_put label. If the modem fails
to stop, the function returns early and never drops that reference, so
the device usage counter stays elevated forever. Release the reference
before returning.

Fixes: cdf2e9419dd9 ("soc: qcom: ipa: main code")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/net/ipa/ipa_main.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/net/ipa/ipa_main.c b/drivers/net/ipa/ipa_main.c
index 788dd99af2a4..aab38fea91c6 100644
--- a/drivers/net/ipa/ipa_main.c
+++ b/drivers/net/ipa/ipa_main.c
@@ -975,6 +975,7 @@ static void ipa_remove(struct platform_device *pdev)
 			 */
 			dev_err(dev, "Failed to stop modem (%pe), leaking resources\n",
 				ERR_PTR(ret));
+			pm_runtime_put_noidle(dev);
 			return;
 		}
 
-- 
2.34.1

On 9/17/26 6:51 AM, Wentao Liang wrote:
> ipa_remove() takes a runtime PM reference with pm_runtime_get_sync() and
> is supposed to release it at the out_power_put label. If the modem fails
> to stop, the function returns early and never drops that reference, so
> the device usage counter stays elevated forever. Release the reference
> before returning.
> 
> Fixes: cdf2e9419dd9 ("soc: qcom: ipa: main code")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>   drivers/net/ipa/ipa_main.c | 1 +
>   1 file changed, 1 insertion(+)
> 
> diff --git a/drivers/net/ipa/ipa_main.c b/drivers/net/ipa/ipa_main.c
> index 788dd99af2a4..aab38fea91c6 100644
> --- a/drivers/net/ipa/ipa_main.c
> +++ b/drivers/net/ipa/ipa_main.c
> @@ -975,6 +975,7 @@ static void ipa_remove(struct platform_device *pdev)
>   			 */
>   			dev_err(dev, "Failed to stop modem (%pe), leaking resources\n",
>   				ERR_PTR(ret));
> +			pm_runtime_put_noidle(dev);
>   			return;
>   		}
>   

This issue has already been fixed.  See:
   6b9eaa61ff2df net: ipa: balance runtime PM reference on remove error

How did you find this problem?  that commit indicates a static
analysis checker was used.  If you benefited from any tools like
that you should probably explain that.

Thanks.

					-Alex