ov2735_probe() explicitly powers on the sensor before enabling runtime PM. The probe failure paths call ov2735_power_off(), but the remove path does not perform the corresponding power-off operation. The managed runtime PM helpers only clean up the runtime PM state. devm_pm_runtime_set_active_enabled() disables runtime PM and restores the suspended state during device resource release, while devm_pm_runtime_get_noresume() drops the runtime PM usage reference. Neither helper invokes ov2735_power_off(). As a result, removing the driver after a successful probe can leave the sensor clock and regulators enabled and the GPIOs in the powered state. Call ov2735_power_off() from ov2735_remove() to match the successful ov2735_power_on() performed during probe. This issue was found by manual code inspection. Fixes: fa9e6df636fb ("media: i2c: add ov2735 image sensor driver") Cc: stable@vger.kernel.org Signed-off-by: Guangshuo Li --- drivers/media/i2c/ov2735.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/media/i2c/ov2735.c b/drivers/media/i2c/ov2735.c index dcb1add1fd9f..2defcaa8b795 100644 --- a/drivers/media/i2c/ov2735.c +++ b/drivers/media/i2c/ov2735.c @@ -1081,6 +1081,7 @@ static void ov2735_remove(struct i2c_client *client) v4l2_subdev_cleanup(&ov2735->sd); media_entity_cleanup(&sd->entity); v4l2_ctrl_handler_free(ov2735->sd.ctrl_handler); + ov2735_power_off(ov2735->dev); } static DEFINE_RUNTIME_DEV_PM_OPS(ov2735_pm_ops, -- 2.43.0