Re: [PATCH] media: ipu6: Fix ISYS runtime PM race during probe

[Sakari Ailus]

Hi Marek,

On Thu, Nov 05, 2026 at 01:43:09PM +0200, Marek Konrád wrote:
> ISYS and PSYS are auxiliary devices and PSYS is a child of ISYS.  In
> ipu6_pci_probe(), resuming PSYS to initialise the MMU and authenticate the
> firmware also resumes the ISYS parent.  However, ISYS probe has been
> deferred until bus_ready_to_probe is set, so ISYS is marked RPM_ACTIVE
> without its runtime_resume callback having run.
> 
> The driver then drops the PSYS reference using pm_runtime_put(), which only
> schedules the idle transition asynchronously.  When PSYS finally suspends,
> the runtime PM core queues an idle request for ISYS as well.  This request
> can run after the deferred ISYS probe has published dev->driver but before
> isys_probe() has called dev_set_drvdata(), making isys_runtime_pm_suspend()
> dereference a NULL isys pointer:
> 
>   BUG: kernel NULL pointer dereference, address: 000000000000031c
>   ...
>   isys_runtime_pm_suspend
>   bus_pm_runtime_suspend
>   rpm_callback
>   rpm_suspend
>   pm_runtime_work
> 
> Make both runtime PM transitions synchronous and complete them before
> bus_ready_to_probe is set.  pm_runtime_put_sync() waits for PSYS to be
> suspended, dropping the active child count of ISYS.  pm_runtime_suspend()
> then suspends ISYS while its driver is still unbound, so no suspend
> callback can run during the probe.  The first real runtime resume happens
> later, when the driver data is available.
> 
> Signed-off-by: Marek Konrád <konrad.marek@xxxxxxxxx>

Thanks for the patch.

Does this patch
<URL:https://lore.kernel.org/linux-media/20261103163814.96980-1-arpith99@xxxxxxxxx/T/#u>
address your problem as well?

> ---
>  drivers/media/pci/intel/ipu6/ipu6.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/media/pci/intel/ipu6/ipu6.c b/drivers/media/pci/intel/ipu6/ipu6.c
> index cdf812c02960..905b03b7e76d 100644
> --- a/drivers/media/pci/intel/ipu6/ipu6.c
> +++ b/drivers/media/pci/intel/ipu6/ipu6.c
> @@ -827,7 +827,8 @@ static int ipu6_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
>  	}
>  
>  	ipu6_mmu_hw_cleanup(isp->psys->mmu);
> -	pm_runtime_put(&isp->psys->auxdev.dev);
> +	pm_runtime_put_sync(&isp->psys->auxdev.dev);
> +	pm_runtime_suspend(&isp->isys->auxdev.dev);
>  
>  	/* Configure the arbitration mechanisms for VC requests */
>  	ipu6_configure_vc_mechanism(isp);

-- 
Regards,

Sakari Ailus