From 18e3e979826795b62e8916743bec4de660e7cb22 Mon Sep 17 00:00:00 2001 From: Wentao Liang Date: Thu, 17 Sep 2026 09:39:23 +0000 Subject: [PATCH] mailbox: mtk-cmdq: Fix runtime PM leak in cmdq_mbox_flush() pm_runtime_get_sync() leaves the runtime PM usage counter incremented even when it fails, but cmdq_mbox_flush() returns the error without dropping it. The same happens when the GCE thread does not drain in time and the function bails out with -EFAULT. Undo the reference on both error paths. Fixes: b0524f7c9635 ("mailbox: mediatek: implement flush function") Cc: stable@vger.kernel.org Signed-off-by: Wentao Liang Signed-off-by: Jassi Brar --- drivers/mailbox/mtk-cmdq-mailbox.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/mailbox/mtk-cmdq-mailbox.c b/drivers/mailbox/mtk-cmdq-mailbox.c index e523c84b4808..96462ca84471 100644 --- a/drivers/mailbox/mtk-cmdq-mailbox.c +++ b/drivers/mailbox/mtk-cmdq-mailbox.c @@ -565,8 +565,10 @@ static int cmdq_mbox_flush(struct mbox_chan *chan, unsigned long timeout) int ret; ret = pm_runtime_get_sync(cmdq->mbox.dev); - if (ret < 0) + if (ret < 0) { + pm_runtime_put_noidle(cmdq->mbox.dev); return ret; + } spin_lock_irqsave(&thread->chan->lock, flags); if (list_empty(&thread->task_busy_list)) @@ -603,6 +605,9 @@ static int cmdq_mbox_flush(struct mbox_chan *chan, unsigned long timeout) dev_err(cmdq->mbox.dev, "Fail to wait GCE thread 0x%x done\n", (u32)(thread->base - cmdq->base)); + pm_runtime_mark_last_busy(cmdq->mbox.dev); + pm_runtime_put_autosuspend(cmdq->mbox.dev); + return -EFAULT; } pm_runtime_mark_last_busy(cmdq->mbox.dev);