There are possibility that two 'stop' operation happen in parallel, then the rproc->power may be decreased to -1, that this reference count will be in wrong state. So check rproc->power to make sure it is larger than zero before decreasing it. Signed-off-by: Shengjiu Wang <shengjiu.wang@xxxxxxx> --- drivers/remoteproc/remoteproc_core.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/remoteproc/remoteproc_core.c b/drivers/remoteproc/remoteproc_core.c index c510125769b9..84e065ad8743 100644 --- a/drivers/remoteproc/remoteproc_core.c +++ b/drivers/remoteproc/remoteproc_core.c @@ -2075,6 +2075,9 @@ int rproc_shutdown(struct rproc *rproc) return ret; } + if (atomic_read(&rproc->power) <= 0) + goto out; + /* if the remote proc is still needed, bail out */ if (!atomic_dec_and_test(&rproc->power)) goto out; -- 2.17.1