Message-ID: <sashiko-outbox-208540@kernel.org>
From: sashiko-bot@kernel.org
Subject: Re: [PATCH] hwrng: mtk - use pm_runtime_resume_and_get() in
 mtk_rng_read()
Reply-To: sashiko-reviews@lists.linux.dev
To: "Gu Bin" <gubin@cmss.chinamobile.com>, sean.wang@mediatek.com, olivia@selenic.com, herbert@gondor.apana.org.au
Cc: matthias.bgg@gmail.com, angelogioacchino.delregno@collabora.com, linux-crypto@vger.kernel.org
In-Reply-To: <20261111073237.1647-1-gubin@cmss.chinamobile.com>
References: <20261111073237.1647-1-gubin@cmss.chinamobile.com>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Date: Wed, 11 Nov 2026 07:44:00 +0000
Precedence: list

Thank you for your contribution! Sashiko AI review found no new issues
in this patch, but noticed 1 related pre-existing issue it does not
introduce:
- [High] hwrng: mtk - premature hwrng registration and unchecked runtime
  PM in mtk_rng_read() [1]
--

commit dfb825399ed095d750b85ef745a6c83b7ac41f98
Author: Gu Bin <gubin@cmss.chinamobile.com>

hwrng: mtk - use pm_runtime_resume_and_get() in mtk_rng_read()

This commit replaces pm_runtime_get_sync() with pm_runtime_resume_and_get()
in mtk_rng_read() and returns early if resuming the device fails.

> diff --git a/drivers/char/hw_random/mtk-rng.c b/drivers/char/hw_random/mt=
k-rng.c
> index 127b82d979e8e..1e8e458dab25c 100644
> --- a/drivers/char/hw_random/mtk-rng.c
> +++ b/drivers/char/hw_random/mtk-rng.c
> @@ -95,7 +95,9 @@ static int mtk_rng_read(struct hwrng *rng, void *buf, s=
ize_t max, bool wait)
>  	struct mtk_rng *priv =3D to_mtk_rng(rng);
>  	int retval =3D 0;
> =20
> -	pm_runtime_get_sync(priv->dev);
> +	retval =3D pm_runtime_resume_and_get(priv->dev);
> +	if (retval < 0)
> +		return retval;
> =20
>  	while (max >=3D sizeof(u32)) {
>  		if (!mtk_rng_wait_ready(rng, wait))

[Severity: High]
This problem wasn't introduced by this patch, but can mtk_rng_read() be
called while runtime PM is disabled [1]?

In mtk_rng_probe(), devm_hwrng_register() is called before dev_set_drvdata()
and devm_pm_runtime_enable():

drivers/char/hw_random/mtk-rng.c:mtk_rng_probe() {
	...
	ret =3D devm_hwrng_register(&pdev->dev, &priv->rng);
	if (ret) {
		dev_err(&pdev->dev, "failed to register rng device: %d\n",
			ret);
		return ret;
	}

	if (!(priv->flags & MTK_RNG_SMC)) {
		dev_set_drvdata(&pdev->dev, priv);
		pm_runtime_set_autosuspend_delay(&pdev->dev,
						 RNG_AUTOSUSPEND_TIMEOUT);
		pm_runtime_use_autosuspend(&pdev->dev);
		ret =3D devm_pm_runtime_enable(&pdev->dev);
	...
}

Because devm_hwrng_register() immediately exposes the RNG and starts
hwrng_fillfn(), and because reverse-order devres teardown on unbind disables
runtime PM before unregistering the RNG, mtk_rng_read() can run while
runtime PM is disabled, causing pm_runtime_resume_and_get() to fail with
-EACCES (or previously causing unclocked MMIO reads when CONFIG_PM is
enabled).  Enabling runtime PM and setting drvdata before calling
devm_hwrng_register() would avoid this window during both probe and unbind.

[1] https://sashiko.dev/#/bug/linux-371c6254-7dda-4dcc-bf98-1919a85f9f5b

--=20
Sashiko AI review =C2=B7 https://sashiko.dev/#/patchset/20261111073237.1647=
-1-gubin@cmss.chinamobile.com?part=3D1