Re: [PATCH v1 1/4] iio: accel: kxsd9: fix runtime PM imbalance on write_raw() error

[Jonathan Cameron]

On Sun, 14 Jun 2026 12:45:46 +0530
Biren Pandya <birenpandya@xxxxxxxxx> wrote:

> kxsd9_write_raw() takes a runtime PM reference with pm_runtime_get_sync()
> but returns -EINVAL directly when a scale with a non-zero integer part is
> requested, skipping the matching pm_runtime_put_autosuspend(). This leaks
> a runtime PM usage-counter reference on every such write, after which the
> device can no longer autosuspend.
> 
> Set the error code and fall through to the existing put instead of
> returning early.
> 
> Signed-off-by: Biren Pandya <birenpandya@xxxxxxxxx>
> Assisted-by: Claude:claude-opus-4-8 coccinelle
Good find.  This one is nasty as it is easily triggered from userspace.
So I'm going to pick this up as it stands.  However, if you are interested
in a doing a follow up series that cleans things up further:

- The pm_runtime_get_sync() return value is not checked anywhere in this driver.
  So good to do that.
- The various places in this driver (including this one) where runtime_pm
  is involved would be nicer handled using the relatively new
  PM_RUNTIME_ACQUIRE_AUTOSUSPEND() / PM_RUNTIME_ACQUIRE_ERR()

Probably makes sense to do both of those in one go given they'll be touching
the same code.

Applied to the fixes-togreg branch of iio.git and marked for stable.
Note I'll be rebasing that branch on rc1 before doing a pull request.

Thanks,

Jonathan


> ---
>  drivers/iio/accel/kxsd9.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/iio/accel/kxsd9.c b/drivers/iio/accel/kxsd9.c
> index 4717d80fc24a..7ac885d94d7f 100644
> --- a/drivers/iio/accel/kxsd9.c
> +++ b/drivers/iio/accel/kxsd9.c
> @@ -147,8 +147,9 @@ static int kxsd9_write_raw(struct iio_dev *indio_dev,
>  	if (mask == IIO_CHAN_INFO_SCALE) {
>  		/* Check no integer component */
>  		if (val)
> -			return -EINVAL;
> -		ret = kxsd9_write_scale(indio_dev, val2);
> +			ret = -EINVAL;
> +		else
> +			ret = kxsd9_write_scale(indio_dev, val2);
>  	}
>  
>  	pm_runtime_put_autosuspend(st->dev);