[PATCH] media: ipu6: Fix ISYS runtime PM race during probe

[Marek Konrád]

ISYS and PSYS are auxiliary devices and PSYS is a child of ISYS.  In
ipu6_pci_probe(), resuming PSYS to initialise the MMU and authenticate the
firmware also resumes the ISYS parent.  However, ISYS probe has been
deferred until bus_ready_to_probe is set, so ISYS is marked RPM_ACTIVE
without its runtime_resume callback having run.

The driver then drops the PSYS reference using pm_runtime_put(), which only
schedules the idle transition asynchronously.  When PSYS finally suspends,
the runtime PM core queues an idle request for ISYS as well.  This request
can run after the deferred ISYS probe has published dev->driver but before
isys_probe() has called dev_set_drvdata(), making isys_runtime_pm_suspend()
dereference a NULL isys pointer:

  BUG: kernel NULL pointer dereference, address: 000000000000031c
  ...
  isys_runtime_pm_suspend
  bus_pm_runtime_suspend
  rpm_callback
  rpm_suspend
  pm_runtime_work

Make both runtime PM transitions synchronous and complete them before
bus_ready_to_probe is set.  pm_runtime_put_sync() waits for PSYS to be
suspended, dropping the active child count of ISYS.  pm_runtime_suspend()
then suspends ISYS while its driver is still unbound, so no suspend
callback can run during the probe.  The first real runtime resume happens
later, when the driver data is available.

Signed-off-by: Marek Konrád <konrad.marek@xxxxxxxxx>
---
 drivers/media/pci/intel/ipu6/ipu6.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/media/pci/intel/ipu6/ipu6.c b/drivers/media/pci/intel/ipu6/ipu6.c
index cdf812c02960..905b03b7e76d 100644
--- a/drivers/media/pci/intel/ipu6/ipu6.c
+++ b/drivers/media/pci/intel/ipu6/ipu6.c
@@ -827,7 +827,8 @@ static int ipu6_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 	}
 
 	ipu6_mmu_hw_cleanup(isp->psys->mmu);
-	pm_runtime_put(&isp->psys->auxdev.dev);
+	pm_runtime_put_sync(&isp->psys->auxdev.dev);
+	pm_runtime_suspend(&isp->isys->auxdev.dev);
 
 	/* Configure the arbitration mechanisms for VC requests */
 	ipu6_configure_vc_mechanism(isp);
-- 
2.56.0