Re: [PATCH] slimbus: messaging: fix leaked PM vote on tid allocation failure

[Zongmin Zhou]

在 2026/9/18 06:10, Srinivas Kandagatla 写道:
> On 8/27/26 3:14 AM, Zongmin Zhou wrote:
> > From: Zongmin Zhou <zhouzongmin@xxxxxxxxxx>
> >
> > In slim_do_transfer(), when a transaction needs a tid and
> > slim_alloc_txn_tid() fails, the function returns directly instead of
> > jumping to slim_xfer_err. The runtime PM vote taken earlier with
> > pm_runtime_get_sync() is then never released, leaving the controller
> > permanently powered up.
> >
> > As txn->tid is still 0 at that point, jumping to slim_xfer_err drops
> > the vote exactly like it is done for other failed transactions.
Hi Srinivas,
Thanks for the review.
> Patch itself looks fine, was this bug hit on real hardware or is this
> generated from some AI.
Found during code review while porting patches, not on real hardware.
The trigger requires an exhausted tid space, which is unlikely to occur
naturally.
> How are you testing this patch?
Tested in a VM with a stub controller that exhausts the tid space
(255 allocations, SLIM_MAX_TIDS is 256) and then issues a need_tid
transfer, so slim_alloc_txn_tid() fails with -ENOSPC inside
slim_do_transfer():
  unpatched: slim_do_transfer() returns -ENOSPC, usage_count stays 1,
             device never suspends
  patched:   same return value, usage_count 0, device autosuspends
> > Fixes: d3062a2109309 ("slimbus: messaging: add slim_alloc/free_txn_tid()")
> Missing CC stable
Will add in v2, thanks.
> > Signed-off-by: Zongmin Zhou <zhouzongmin@xxxxxxxxxx>
> > ---
> >   drivers/slimbus/messaging.c | 2 +-
> >   1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/drivers/slimbus/messaging.c b/drivers/slimbus/messaging.c
> > index e2dbe4a..ee127ef 100644
> > --- a/drivers/slimbus/messaging.c
> > +++ b/drivers/slimbus/messaging.c
> > @@ -139,7 +139,7 @@ int slim_do_transfer(struct slim_controller *ctrl, struct slim_msg_txn *txn)
> >   	if (need_tid) {
> >   		ret = slim_alloc_txn_tid(ctrl, txn);
> >   		if (ret)
> > -			return ret;
> > +			goto slim_xfer_err;
> >   
> >   		if (!txn->msg->comp)
> >   			txn->comp = &done;