Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative

h5_btrtl_open() calls pm_runtime_use_autosuspend(), but
h5_btrtl_close() does not call the matching
pm_runtime_dont_use_autosuspend() when tearing down runtime PM.

If the autosuspend delay is set to a negative value while autosuspend
is enabled, the runtime PM core increments usage_count to prevent
runtime suspend. Without calling pm_runtime_dont_use_autosuspend()
during driver teardown, this reference is not dropped and usage_count
remains unbalanced.

Add the missing pm_runtime_dont_use_autosuspend() call before disabling
runtime PM.

This issue was found by manual code inspection.

Fixes: d9dd833cf6d2 ("Bluetooth: hci_h5: Add runtime suspend")
Cc: stable@vger.kernel.org
Signed-off-by: Guangshuo Li <lgs201920130244@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>

diff --git a/drivers/bluetooth/hci_h5.c b/drivers/bluetooth/hci_h5.c
index 60b90f1..b1999e1 100644 (file)
--- a/drivers/bluetooth/hci_h5.c
+++ b/drivers/bluetooth/hci_h5.c
@@ -1023,8 +1023,10 @@ static void h5_btrtl_open(struct h5 *h5)
 
 static void h5_btrtl_close(struct h5 *h5)
 {
-       if (!test_bit(H5_WAKEUP_DISABLE, &h5->flags))
+       if (!test_bit(H5_WAKEUP_DISABLE, &h5->flags)) {
+               pm_runtime_dont_use_autosuspend(&h5->hu->serdev->dev);
                pm_runtime_disable(&h5->hu->serdev->dev);
+       }
 
        gpiod_set_value_cansleep(h5->device_wake_gpio, 0);
        gpiod_set_value_cansleep(h5->enable_gpio, 0);