slim_do_transfer() takes a runtime PM reference with
pm_runtime_get_sync() before allocating a transaction id.  The
slim_alloc_txn_tid() failure path returns directly, skipping the
slim_xfer_err cleanup that drops this reference.

Jump to slim_xfer_err so the reference is always released.

Fixes: d3062a210930 ("slimbus: messaging: add slim_alloc/free_txn_tid()")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/slimbus/messaging.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/slimbus/messaging.c b/drivers/slimbus/messaging.c
index e2dbe4a66b70..ee127ef42046 100644
--- a/drivers/slimbus/messaging.c
+++ b/drivers/slimbus/messaging.c
@@ -139,7 +139,7 @@ int slim_do_transfer(struct slim_controller *ctrl, struct slim_msg_txn *txn)
 	if (need_tid) {
 		ret = slim_alloc_txn_tid(ctrl, txn);
 		if (ret)
-			return ret;
+			goto slim_xfer_err;
 
 		if (!txn->msg->comp)
 			txn->comp = &done;
-- 
2.34.1

On 9/17/26 4:22 PM, Wentao Liang wrote:
> slim_do_transfer() takes a runtime PM reference with
> pm_runtime_get_sync() before allocating a transaction id.  The
> slim_alloc_txn_tid() failure path returns directly, skipping the
> slim_xfer_err cleanup that drops this reference.
> 
> Jump to slim_xfer_err so the reference is always released.
> 
Same question as your other patch,

BTW, please check the list before sending duplicate patch, there is
already an identical patch on the list.

--srini
> Fixes: d3062a210930 ("slimbus: messaging: add slim_alloc/free_txn_tid()")
> Cc: stable@vger.kernel.org
> Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
> ---
>  drivers/slimbus/messaging.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/slimbus/messaging.c b/drivers/slimbus/messaging.c
> index e2dbe4a66b70..ee127ef42046 100644
> --- a/drivers/slimbus/messaging.c
> +++ b/drivers/slimbus/messaging.c
> @@ -139,7 +139,7 @@ int slim_do_transfer(struct slim_controller *ctrl, struct slim_msg_txn *txn)
>  	if (need_tid) {
>  		ret = slim_alloc_txn_tid(ctrl, txn);
>  		if (ret)
> -			return ret;
> +			goto slim_xfer_err;
>  
>  		if (!txn->msg->comp)
>  			txn->comp = &done;