host1x_probe() calls pm_runtime_resume_and_get() and intentionally keeps the runtime PM usage reference for the lifetime of the driver because host1x is not yet ready for dynamic runtime PM. The probe error path drops this reference with pm_runtime_put_sync_suspend(), but the remove path only calls pm_runtime_force_suspend(). pm_runtime_force_suspend() disables runtime PM and invokes the runtime suspend callback when necessary, but it does not decrement the runtime PM usage counter. As a result, the reference acquired by pm_runtime_resume_and_get() remains held after the driver is unbound. Repeated bind and unbind cycles can therefore leave the runtime PM usage counter increasingly unbalanced. Drop the usage reference with pm_runtime_put_sync_suspend() before forcing the device into suspend during removal. This issue was found by manual code inspection. Fixes: 6b6776e2ab8a ("gpu: host1x: Add initial runtime PM and OPP support") Cc: stable@vger.kernel.org Signed-off-by: Guangshuo Li --- drivers/gpu/host1x/dev.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/host1x/dev.c b/drivers/gpu/host1x/dev.c index d2c64728f804..bb6a1647e4db 100644 --- a/drivers/gpu/host1x/dev.c +++ b/drivers/gpu/host1x/dev.c @@ -729,6 +729,7 @@ static void host1x_remove(struct platform_device *pdev) host1x_unregister(host); host1x_debug_deinit(host); + pm_runtime_put_sync_suspend(&pdev->dev); pm_runtime_force_suspend(&pdev->dev); host1x_intr_deinit(host); -- 2.43.0