Unverified Commit 59e1be12 authored by Emanuele Ghidoli's avatar Emanuele Ghidoli Committed by Mark Brown
Browse files

spi: cadence-qspi: Fix exec_mem_op error handling 



cqspi_exec_mem_op() increments the runtime PM usage counter before all
refcount checks are performed. If one of these checks fails, the function
returns without dropping the PM reference.

Move the pm_runtime_resume_and_get() call after the refcount checks so
that runtime PM is only acquired when the operation can proceed and
drop the inflight_ops refcount if the PM resume fails.

Cc: stable@vger.kernel.org
Fixes: 74462840 ("spi: cadence-quadspi: Implement refcount to handle unbind during busy")
Signed-off-by: default avatarEmanuele Ghidoli <emanuele.ghidoli@toradex.com>
Link: https://patch.msgid.link/20260313135236.46642-1-ghidoliemanuele@gmail.com


Signed-off-by: default avatarMark Brown <broonie@kernel.org>
parent b0dc7e7c

drivers/spi/spi-cadence-quadspi.c

+9 −8
Original line number Diff line number Diff line
@@ -1483,14 +1483,6 @@ static int cqspi_exec_mem_op(struct spi_mem *mem, const struct spi_mem_op *op) 
	if (refcount_read(&cqspi->inflight_ops) == 0)

		return -ENODEV;



	if (!(ddata && (ddata->quirks & CQSPI_DISABLE_RUNTIME_PM))) {

		ret = pm_runtime_resume_and_get(dev);

		if (ret) {

			dev_err(&mem->spi->dev, "resume failed with %d\n", ret);

			return ret;

		}

	}



	if (!refcount_read(&cqspi->refcount))

		return -EBUSY;
@@ -1502,6 +1494,14 @@ static int cqspi_exec_mem_op(struct spi_mem *mem, const struct spi_mem_op *op) 
		return -EBUSY;

	}



	if (!(ddata && (ddata->quirks & CQSPI_DISABLE_RUNTIME_PM))) {

		ret = pm_runtime_resume_and_get(dev);

		if (ret) {

			dev_err(&mem->spi->dev, "resume failed with %d\n", ret);

			goto dec_inflight_refcount;

		}

	}



	ret = cqspi_mem_process(mem, op);



	if (!(ddata && (ddata->quirks & CQSPI_DISABLE_RUNTIME_PM)))
@@ -1510,6 +1510,7 @@ static int cqspi_exec_mem_op(struct spi_mem *mem, const struct spi_mem_op *op) 
	if (ret)

		dev_err(&mem->spi->dev, "operation failed with %d\n", ret);



dec_inflight_refcount:

	if (refcount_read(&cqspi->inflight_ops) > 1)

		refcount_dec(&cqspi->inflight_ops);