From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 76EC125F7B3; Sun, 1 Jun 2025 23:25:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1748820339; cv=none; b=Sjhp9F3JhwNLoCD2EudguN4JGxQHXaf25asEAXQyR1EhgU4LB1mT/VlOF+IX5KqYMtWWixOCZw1uai6AcrpHlRf+wsfTP0neMElMjsrYXxdh67C4ytZlrV38fBwHJKqqR+Is5RsKk7Q88hOkiXjsBJUZuPTyQ3SSz9sgjeovvjw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1748820339; c=relaxed/simple; bh=iFtuyAwbz+GsTdsY9gBdkxZEz7gIkMicr6z563Tlceo=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version:Content-Type; b=hB3bfMOd/f5VxtPs/H6I0nqzOW5VPy5LsPi7cCDqkDoIUtuIQ9vxDAkIbn4thMAzErIeTpNuyjUC8sYoIUyZfy796wlx7cbr/fyiPM+88maHwWarNq6P+XuIConVJfRxPU8R+tAr+6yqhXEXadJtojVPvkWFVcSGzpWZFTmJpiY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=lTwVNMid; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="lTwVNMid" Received: by smtp.kernel.org (Postfix) with ESMTPSA id EF520C4CEF2; Sun, 1 Jun 2025 23:25:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1748820339; bh=iFtuyAwbz+GsTdsY9gBdkxZEz7gIkMicr6z563Tlceo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=lTwVNMidVMO5psTFFEqdb0JFk2RwECrobjV1720w8tLcfEsCHgV1ggdtoDsQb2EKM qlmHe368XR0syESMl/Yk/M8Q83Tf1ppQpYRpoEAUrUZqtghAQVqYYkGDDf22Y48WOu K7Lm68tzCdfTSFgacxvMPiEA2OT0UTZ45JF15eylKqNKWLyJVg5zEHVadUbvD+zqsk lPDh/u82iiV/AyGUd3C6zXmgOHiwZEZtlQUNUzbxxXaqOw3dSBwjXeyTvnM1xKTVjF CGA7onrx8+PnqH7lef204ADkdKQpa4ViX3lhAqIY1V3ISZimeViZEWLCrA4crTr5dD QPB2jBiLVS56w== From: Sasha Levin To: patches@lists.linux.dev, stable@vger.kernel.org Cc: Tarang Raval , Sakari Ailus , Hans Verkuil , Sasha Levin , mchehab@kernel.org, linux-media@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH AUTOSEL 6.15 024/110] media: i2c: imx334: Enable runtime PM before sub-device registration Date: Sun, 1 Jun 2025 19:23:06 -0400 Message-Id: <20250601232435.3507697-24-sashal@kernel.org> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20250601232435.3507697-1-sashal@kernel.org> References: <20250601232435.3507697-1-sashal@kernel.org> Precedence: bulk X-Mailing-List: linux-media@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore X-stable-base: Linux 6.15 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit From: Tarang Raval [ Upstream commit 01dfdf6a80c57151af0589af0db7adbbdd1361c7 ] Runtime PM is fully initialized before calling v4l2_async_register_subdev_sensor(). Moving the runtime PM initialization earlier prevents potential access to an uninitialized or powered-down device. Signed-off-by: Tarang Raval Signed-off-by: Sakari Ailus Signed-off-by: Hans Verkuil Signed-off-by: Sasha Levin --- **YES** This commit should be backported to stable kernel trees. **Analysis:** **1. Pattern Recognition from Similar Commits:** The provided historical commits show a clear pattern: - **Similar commits marked YES**: imx355 and smiapp drivers with identical runtime PM ordering fixes - **Similar commits marked NO**: imx319, ov4689, ov2740 commits that appear to be more general cleanup/improvement rather than bug fixes **2. Code Analysis:** The imx334 commit makes the exact same critical fix as the accepted imx355 commit: **Before (problematic):** ```c ret = v4l2_async_register_subdev_sensor(&imx334->sd); // Device becomes accessible /bin /bin.usr-is-merged /boot /dev /etc /home /init /lib /lib.usr-is-merged /lib64 /lost+found /media /mnt /opt /proc /root /run /sbin /sbin.usr-is-merged /snap /srv /sys /tmp /usr /var ... model/ prompt/ src/ target/ pm_runtime_set_active(imx334->dev); // Runtime PM enabled AFTER pm_runtime_enable(imx334->dev); ``` **After (fixed):** ```c pm_runtime_set_active(imx334->dev); // Runtime PM enabled BEFORE pm_runtime_enable(imx334->dev); ret = v4l2_async_register_subdev_sensor(&imx334->sd); // Device becomes accessible ``` **3. Bug Significance:** The commit message explicitly states this prevents "potential access to an uninitialized or powered- down device." This is a **race condition bug** where: - The sensor device becomes accessible via v4l2_async_register_subdev_sensor() - Other components (like ipu-bridge) may immediately try to access the device via runtime PM - If runtime PM isn't initialized yet, these accesses will fail **4. Backport Criteria Assessment:** ✓ **Fixes a user-affecting bug**: Race condition causing device access failures ✓ **Small and contained**: Only reorders initialization, no logic changes ✓ **No architectural changes**: Pure initialization ordering fix ✓ **Minimal regression risk**: The change aligns with established patterns ✓ **Follows stable tree rules**: Important bugfix with minimal risk **5. Consistency with Accepted Patterns:** The imx355 commit (marked YES) has an identical issue and fix pattern. The key difference from rejected commits is that imx355 and imx334 explicitly mention preventing device access failures, while others were general improvements. **6. Error Handling Analysis:** The commit properly adds runtime PM cleanup in error paths: ```c error_media_entity: pm_runtime_disable(imx334->dev); pm_runtime_set_suspended(imx334->dev); ``` This is a critical race condition fix that prevents real-world device access failures, follows established successful backport patterns, and has minimal risk - making it an excellent stable backport candidate. drivers/media/i2c/imx334.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/media/i2c/imx334.c b/drivers/media/i2c/imx334.c index a544fc3df39c2..b51721c01e1d6 100644 --- a/drivers/media/i2c/imx334.c +++ b/drivers/media/i2c/imx334.c @@ -1391,6 +1391,9 @@ static int imx334_probe(struct i2c_client *client) goto error_handler_free; } + pm_runtime_set_active(imx334->dev); + pm_runtime_enable(imx334->dev); + ret = v4l2_async_register_subdev_sensor(&imx334->sd); if (ret < 0) { dev_err(imx334->dev, @@ -1398,13 +1401,13 @@ static int imx334_probe(struct i2c_client *client) goto error_media_entity; } - pm_runtime_set_active(imx334->dev); - pm_runtime_enable(imx334->dev); pm_runtime_idle(imx334->dev); return 0; error_media_entity: + pm_runtime_disable(imx334->dev); + pm_runtime_set_suspended(imx334->dev); media_entity_cleanup(&imx334->sd.entity); error_handler_free: v4l2_ctrl_handler_free(imx334->sd.ctrl_handler); -- 2.39.5