From: Qinglang Miao miaoqinglang@huawei.com

mainline inclusion from mainline-v5.13-rc1 commit a85c5c7a3aa8041777ff691400b4046e56149fd3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I94JCX CVE: CVE-2020-36778

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?id...

--------------------------------

The PM reference count is not expected to be incremented on return in xiic_xfer and xiic_i2c_remove.

However, pm_runtime_get_sync will increment the PM reference count even failed. Forgetting to putting operation will result in a reference leak here.

Replace it with pm_runtime_resume_and_get to keep usage counter balanced.

Fixes: 10b17004a74c ("i2c: xiic: Fix the clocking across bind unbind") Reported-by: Hulk Robot hulkci@huawei.com Signed-off-by: Qinglang Miao miaoqinglang@huawei.com Signed-off-by: Wolfram Sang wsa@kernel.org Conflicts: drivers/i2c/busses/i2c-xiic.c Signed-off-by: Yang Yingliang yangyingliang@huawei.com --- drivers/i2c/busses/i2c-xiic.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/i2c/busses/i2c-xiic.c b/drivers/i2c/busses/i2c-xiic.c index 8d6b6eeef71c..f686a45801e6 100644 --- a/drivers/i2c/busses/i2c-xiic.c +++ b/drivers/i2c/busses/i2c-xiic.c @@ -678,7 +678,7 @@ static int xiic_xfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num) dev_dbg(adap->dev.parent, "%s entry SR: 0x%x\n", __func__, xiic_getreg8(i2c, XIIC_SR_REG_OFFSET));

- err = pm_runtime_get_sync(i2c->dev); + err = pm_runtime_resume_and_get(i2c->dev); if (err < 0) return err;