[PATCH] mailbox: mtk-cmdq: Fix runtime PM leak in cmdq_mbox_flush()

[Jassi Brar]

On Thu, Sep 17, 2026 at 4:39 AM Wentao Liang <vulab at iscas.ac.cn> wrote:
>
> pm_runtime_get_sync() leaves the runtime PM usage counter incremented
> even when it fails, but cmdq_mbox_flush() returns the error without
> dropping it.  The same happens when the GCE thread does not drain in
> time and the function bails out with -EFAULT.
>
> Undo the reference on both error paths.
>
> Fixes: b0524f7c9635 ("mailbox: mediatek: implement flush function")
> Cc: stable at vger.kernel.org
> Signed-off-by: Wentao Liang <vulab at iscas.ac.cn>
> ---
>  drivers/mailbox/mtk-cmdq-mailbox.c | 7 ++++++-
>  1 file changed, 6 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/mailbox/mtk-cmdq-mailbox.c b/drivers/mailbox/mtk-cmdq-mailbox.c
> index eadd340f8fee..07a8c2382c93 100644
> --- a/drivers/mailbox/mtk-cmdq-mailbox.c
> +++ b/drivers/mailbox/mtk-cmdq-mailbox.c
> @@ -565,8 +565,10 @@ static int cmdq_mbox_flush(struct mbox_chan *chan, unsigned long timeout)
>         int ret;
>
>         ret = pm_runtime_get_sync(cmdq->mbox.dev);
> -       if (ret < 0)
> +       if (ret < 0) {
> +               pm_runtime_put_noidle(cmdq->mbox.dev);
>                 return ret;
> +       }
>
>         spin_lock_irqsave(&thread->chan->lock, flags);
>         if (list_empty(&thread->task_busy_list))
> @@ -603,6 +605,9 @@ static int cmdq_mbox_flush(struct mbox_chan *chan, unsigned long timeout)
>                 dev_err(cmdq->mbox.dev, "Fail to wait GCE thread 0x%x done\n",
>                         (u32)(thread->base - cmdq->base));
>
> +               pm_runtime_mark_last_busy(cmdq->mbox.dev);
> +               pm_runtime_put_autosuspend(cmdq->mbox.dev);
> +
>                 return -EFAULT;
>         }
>         pm_runtime_mark_last_busy(cmdq->mbox.dev);
> --
> 2.34.1
>
Applied to mailbox/for-next

Thanks
Jassi