From: Qinglang Miao <miaoqinglang@huawei.com> mainline inclusion from mainline-v5.13-rc1 commit a85c5c7a3aa8041777ff691400b4046e56149fd3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I94JCX CVE: CVE-2020-36778 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id... -------------------------------- The PM reference count is not expected to be incremented on return in xiic_xfer and xiic_i2c_remove. However, pm_runtime_get_sync will increment the PM reference count even failed. Forgetting to putting operation will result in a reference leak here. Replace it with pm_runtime_resume_and_get to keep usage counter balanced. Fixes: 10b17004a74c ("i2c: xiic: Fix the clocking across bind unbind") Reported-by: Hulk Robot <hulkci@huawei.com> Signed-off-by: Qinglang Miao <miaoqinglang@huawei.com> Signed-off-by: Wolfram Sang <wsa@kernel.org> Conflicts: drivers/i2c/busses/i2c-xiic.c Signed-off-by: Yang Yingliang <yangyingliang@huawei.com> --- drivers/i2c/busses/i2c-xiic.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/i2c/busses/i2c-xiic.c b/drivers/i2c/busses/i2c-xiic.c index 8d6b6eeef71c..f686a45801e6 100644 --- a/drivers/i2c/busses/i2c-xiic.c +++ b/drivers/i2c/busses/i2c-xiic.c @@ -678,7 +678,7 @@ static int xiic_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num) dev_dbg(adap->dev.parent, "%s entry SR: 0x%x\n", __func__, xiic_getreg8(i2c, XIIC_SR_REG_OFFSET)); - err = pm_runtime_get_sync(i2c->dev); + err = pm_runtime_resume_and_get(i2c->dev); if (err < 0) return err; -- 2.25.1