[PATCH] media: ipu6: Fix ISYS runtime PM race during probe

[PATCH] media: ipu6: Fix ISYS runtime PM race during probe

[Marek Konrád]

ISYS and PSYS are auxiliary devices and PSYS is a child of ISYS.  In
ipu6_pci_probe(), resuming PSYS to initialise the MMU and authenticate the
firmware also resumes the ISYS parent.  However, ISYS probe has been
deferred until bus_ready_to_probe is set, so ISYS is marked RPM_ACTIVE
without its runtime_resume callback having run.

The driver then drops the PSYS reference using pm_runtime_put(), which only
schedules the idle transition asynchronously.  When PSYS finally suspends,
the runtime PM core queues an idle request for ISYS as well.  This request
can run after the deferred ISYS probe has published dev->driver but before
isys_probe() has called dev_set_drvdata(), making isys_runtime_pm_suspend()
dereference a NULL isys pointer:

  BUG: kernel NULL pointer dereference, address: 000000000000031c
  ...
  isys_runtime_pm_suspend
  bus_pm_runtime_suspend
  rpm_callback
  rpm_suspend
  pm_runtime_work

Make both runtime PM transitions synchronous and complete them before
bus_ready_to_probe is set.  pm_runtime_put_sync() waits for PSYS to be
suspended, dropping the active child count of ISYS.  pm_runtime_suspend()
then suspends ISYS while its driver is still unbound, so no suspend
callback can run during the probe.  The first real runtime resume happens
later, when the driver data is available.

Signed-off-by: Marek Konrád <konrad.marek@seznam.cz>
---
 drivers/media/pci/intel/ipu6/ipu6.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/media/pci/intel/ipu6/ipu6.c b/drivers/media/pci/intel/ipu6/ipu6.c
index cdf812c02960..905b03b7e76d 100644
--- a/drivers/media/pci/intel/ipu6/ipu6.c
+++ b/drivers/media/pci/intel/ipu6/ipu6.c
@@ -827,7 +827,8 @@ static int ipu6_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 	}
 
 	ipu6_mmu_hw_cleanup(isp->psys->mmu);
-	pm_runtime_put(&isp->psys->auxdev.dev);
+	pm_runtime_put_sync(&isp->psys->auxdev.dev);
+	pm_runtime_suspend(&isp->isys->auxdev.dev);
 
 	/* Configure the arbitration mechanisms for VC requests */
 	ipu6_configure_vc_mechanism(isp);
-- 
2.56.0

Re: [PATCH] media: ipu6: Fix ISYS runtime PM race during probe

[Sakari Ailus]

Hi Marek,

On Thu, Nov 05, 2026 at 01:43:09PM +0200, Marek Konrád wrote:
> ISYS and PSYS are auxiliary devices and PSYS is a child of ISYS.  In
> ipu6_pci_probe(), resuming PSYS to initialise the MMU and authenticate the
> firmware also resumes the ISYS parent.  However, ISYS probe has been
> deferred until bus_ready_to_probe is set, so ISYS is marked RPM_ACTIVE
> without its runtime_resume callback having run.
> 
> The driver then drops the PSYS reference using pm_runtime_put(), which only
> schedules the idle transition asynchronously.  When PSYS finally suspends,
> the runtime PM core queues an idle request for ISYS as well.  This request
> can run after the deferred ISYS probe has published dev->driver but before
> isys_probe() has called dev_set_drvdata(), making isys_runtime_pm_suspend()
> dereference a NULL isys pointer:
> 
>   BUG: kernel NULL pointer dereference, address: 000000000000031c
>   ...
>   isys_runtime_pm_suspend
>   bus_pm_runtime_suspend
>   rpm_callback
>   rpm_suspend
>   pm_runtime_work
> 
> Make both runtime PM transitions synchronous and complete them before
> bus_ready_to_probe is set.  pm_runtime_put_sync() waits for PSYS to be
> suspended, dropping the active child count of ISYS.  pm_runtime_suspend()
> then suspends ISYS while its driver is still unbound, so no suspend
> callback can run during the probe.  The first real runtime resume happens
> later, when the driver data is available.
> 
> Signed-off-by: Marek Konrád <konrad.marek@seznam.cz>

Thanks for the patch.

Does this patch
<URL:https://lore.kernel.org/linux-media/20261103163814.96980-1-arpith99@gmail.com/T/#u>
address your problem as well?

> ---
>  drivers/media/pci/intel/ipu6/ipu6.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/media/pci/intel/ipu6/ipu6.c b/drivers/media/pci/intel/ipu6/ipu6.c
> index cdf812c02960..905b03b7e76d 100644
> --- a/drivers/media/pci/intel/ipu6/ipu6.c
> +++ b/drivers/media/pci/intel/ipu6/ipu6.c
> @@ -827,7 +827,8 @@ static int ipu6_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
>  	}
>  
>  	ipu6_mmu_hw_cleanup(isp->psys->mmu);
> -	pm_runtime_put(&isp->psys->auxdev.dev);
> +	pm_runtime_put_sync(&isp->psys->auxdev.dev);
> +	pm_runtime_suspend(&isp->isys->auxdev.dev);
>  
>  	/* Configure the arbitration mechanisms for VC requests */
>  	ipu6_configure_vc_mechanism(isp);

-- 
Regards,

Sakari Ailus