[PATCH 2/4] accel/rocket: fix runtime PM refcount leak in rocket_job_run()

[Wentao Liang]

rocket_job_run() powers the NPU core up with pm_runtime_get_sync(),
which increments the runtime PM usage counter even when it fails, and
then returns the fence without dropping the reference on both the
pm_runtime_get_sync() and the iommu_attach_group() failure paths.

At that point core->in_flight_job is still unset, so neither
rocket_job_handle_irq() nor rocket_reset() will balance the counter
later, and the core can never runtime suspend again.

Use pm_runtime_resume_and_get() instead, which does not bump the usage
counter on failure, and drop the reference with
pm_runtime_put_autosuspend() if iommu_attach_group() fails.

Fixes: 0810d5ad88a1 ("accel/rocket: Add job submission IOCTL")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Wentao Liang <vulab@xxxxxxxxxxx>
---
 drivers/accel/rocket/rocket_job.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/accel/rocket/rocket_job.c b/drivers/accel/rocket/rocket_job.c
index ac51bff39833..ce7acf728367 100644
--- a/drivers/accel/rocket/rocket_job.c
+++ b/drivers/accel/rocket/rocket_job.c
@@ -310,13 +310,15 @@ static struct dma_fence *rocket_job_run(struct drm_sched_job *sched_job)
 		dma_fence_put(job->done_fence);
 	job->done_fence = dma_fence_get(fence);
 
-	ret = pm_runtime_get_sync(core->dev);
+	ret = pm_runtime_resume_and_get(core->dev);
 	if (ret < 0)
 		return fence;
 
 	ret = iommu_attach_group(job->domain->domain, core->iommu_group);
-	if (ret < 0)
+	if (ret < 0) {
+		pm_runtime_put_autosuspend(core->dev);
 		return fence;
+	}
 
 	scoped_guard(mutex, &core->job_lock) {
 		core->in_flight_job = job;
-- 
2.34.1