Claude review: net: wwan: Hold runtime PM during active data path operations

[Claude Code Review Bot <claude-review@example.com>]

Patch Review

**Issue 1 - Inconsistent PM API usage between the two drivers in the same patch:**

`mhi_wwan_ctrl` uses `pm_runtime_resume_and_get` (synchronous, proper error returns) throughout:
```c
+	ret = pm_runtime_resume_and_get(&mhi_dev->dev);
+	if (ret) {
```

But `mhi_wwan_mbim` uses raw `pm_runtime_get` (async) in several places:
```c
+	err = pm_runtime_get(&mhi_dev->dev);
+	if (err < 0 && err != -EINPROGRESS) {
```

This inconsistency within a single patch is concerning. The `mhi_wwan_ctrl` approach is generally more correct for non-atomic contexts like probe, remove, and workqueues. The xmit path is the only place where async `pm_runtime_get` is justified (because xmit might be in atomic context).

**Issue 2 - mhi_wwan_mbim rx_refill_work missing error handling:**

```c
+	err = pm_runtime_get(&mdev->dev);
+	if (err < 0 && err != -EINPROGRESS)
+		dev_err(&mdev->dev, "pm_runtime_get Failed %d\n", err);
+
 	while (!mhi_queue_is_full(mdev, DMA_FROM_DEVICE)) {
```

On PM failure, it logs an error but **proceeds into the loop anyway**, queueing buffers on a potentially suspended device. Compare with `mhi_wwan_ctrl_refill_work` which properly returns on error. This is a bug.

**Issue 3 - mhi_mbim_remove unconditional pm_runtime_put:**

```c
+	err = pm_runtime_get(&mhi_dev->dev);
+	if (err < 0 && err != -EINPROGRESS)
+		dev_err(...);
     ...
+	pm_runtime_put(&mhi_dev->dev);
```

The `pm_runtime_put` is called unconditionally, even if `pm_runtime_get` failed. Compare with `mhi_wwan_ctrl_stop` which conditionally puts only on success. If `pm_runtime_get` returned an error other than `-EINPROGRESS`, calling `pm_runtime_put` would decrement the usage count below zero.

**Issue 4 - mhi_mbim_probe leaks `mbim` allocation on PM failure:**

```c
 	mbim = kzalloc(sizeof(*mbim), GFP_KERNEL);
 	if (!mbim)
 		return -ENOMEM;
 
+	pm_runtime_no_callbacks(&mhi_dev->dev);
+	err = devm_pm_runtime_set_active_enabled(&mhi_dev->dev);
+	if (err)
+		return err;
```

If `devm_pm_runtime_set_active_enabled` fails, `mbim` is leaked (no `kfree`). The `mhi_wwan_ctrl` side handles this correctly by calling `kfree(mhiwwan)` on failure.

---
Generated by Claude Code Patch Reviewer