linux-kernel - [PATCH v1] PM: sleep: core: Fix runtime PM enabling in device_resume

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <5940388.DvuYhMxLoT@rafael.j.wysocki>
Date: Mon, 17 Nov 2025 19:57:24 +0100
From: "Rafael J. Wysocki" <rafael@...nel.org>
To: Rose Wu <ya-jou.wu@...iatek.com>, linux-pm@...r.kernel.org
Cc: rafael.j.wysocki@...el.com, regressions@...ts.linux.dev,
 linux-kernel@...r.kernel.org, wsd_upstream <wsd_upstream@...iatek.com>,
 linux-mediatek@...ts.infradead.org,
 士顏 邱 <artis.chiu@...iatek.com>,
 靖智 高 <Johnny-cc.Kao@...iatek.com>,
 Ulf Hansson <ulf.hansson@...aro.org>
Subject:
 [PATCH v1] PM: sleep: core: Fix runtime PM enabling in device_resume_early()

On Monday, November 17, 2025 5:59:05 PM CET Rafael J. Wysocki wrote:
> Hi,
> 
> On Mon, Nov 17, 2025 at 10:31 AM Rose Wu <ya-jou.wu@...iatek.com> wrote:
> >
> > Hi Rafael and All,
> >
> > I am reporting a regression introduced by the commit
> > 443046d1ad66607f324c604b9fbdf11266fa8aad (PM: sleep: Make suspend of
> > devices more asynchronous), which can lead to a kernel panic (data
> > abort) if a late suspend aborts.
> > The commit modifies list handling during suspend. When a device suspend
> > aborts at the "late" stage, `dpm_suspended_list` is spliced into
> > `dpm_late_early_list`.
> > This creates an imbalance. Devices on this list that had not yet
> > executed `pm_runtime_disable()` in `device_suspend_late()` are now
> > incorrectly subjected to `pm_runtime_enable()` during the subsequent
> > `device_resume_early()` sequence.
> 
> Ah, obviously.
> 
> Does the attached patch (that should apply on top of 6.18-rc6) help?
> 
> If this patch doesn't apply to your kernel, making an analogous change
> to it should be straightforward enough.

That patch was incomplete because it was missing a complementary change
in device_suspend_late() to ensure that power.is_suspended will be set
for all devices with disabled runtime PM.

Please try the one below instead.

Thanks!

---
From: Rafael J. Wysocki <rafael.j.wysocki@...el.com>

Runtime PM should only be enabled in device_resume_early() if it has
been disabled for the given device by device_suspend_late().  Otherwise,
it may cause runtime PM callbacks to run prematurely in some cases
or cause runtime PM to be enabled for devices without runtime PM
support.  That leads to further functional issues.

Make two changes to address this problem.

First, reorder device_suspend_late() to only disable runtime PM for a
device if the power.is_late_suspended flag is going to be set for it.
In all of the other cases, disabling runtime PM for the device is not
in fact necessary.

Second, make device_resume_early() only enable runtime PM for the
devices with the power.is_late_suspended flag set.

Fixes: 443046d1ad66 ("PM: sleep: Make suspend of devices more asynchronous")
Reported-by: Rose Wu <ya-jou.wu@...iatek.com>
Closes: https://lore.kernel.org/linux-pm/70b25dca6f8c2756d78f076f4a7dee7edaaffc33.camel@mediatek.com/
Cc: 6.16+ <stable@...r.kernel.org> # 6.16+
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@...el.com>
---
 drivers/base/power/main.c |   14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

--- a/drivers/base/power/main.c
+++ b/drivers/base/power/main.c
@@ -941,11 +941,11 @@ Run:

 Skip:
 	dev->power.is_late_suspended = false;
+	pm_runtime_enable(dev);

 Out:
 	TRACE_RESUME(error);

-	pm_runtime_enable(dev);
 	complete_all(&dev->power.completion);

 	if (error) {
@@ -1630,12 +1630,6 @@ static void device_suspend_late(struct d
 	TRACE_DEVICE(dev);
 	TRACE_SUSPEND(0);

-	/*
-	 * Disable runtime PM for the device without checking if there is a
-	 * pending resume request for it.
-	 */
-	__pm_runtime_disable(dev, false);
-
 	dpm_wait_for_subordinate(dev, async);

 	if (READ_ONCE(async_error))
@@ -1649,6 +1643,12 @@ static void device_suspend_late(struct d
 	if (dev->power.syscore || dev->power.direct_complete)
 		goto Complete;

+	/*
+	 * Disable runtime PM for the device without checking if there is a
+	 * pending resume request for it.
+	 */
+	__pm_runtime_disable(dev, false);
+
 	if (dev->pm_domain) {
 		info = "late power domain ";
 		callback = pm_late_early_op(&dev->pm_domain->ops, state);