From: Tarang Raval tarang.raval@siliconsignals.io
[ Upstream commit 01dfdf6a80c57151af0589af0db7adbbdd1361c7 ]
Runtime PM is fully initialized before calling v4l2_async_register_subdev_sensor(). Moving the runtime PM initialization earlier prevents potential access to an uninitialized or powered-down device.
Signed-off-by: Tarang Raval tarang.raval@siliconsignals.io Signed-off-by: Sakari Ailus sakari.ailus@linux.intel.com Signed-off-by: Hans Verkuil hverkuil@xs4all.nl Signed-off-by: Sasha Levin sashal@kernel.org ---
**YES** This commit should be backported to stable kernel trees. **Analysis:** **1. Pattern Recognition from Similar Commits:** The provided historical commits show a clear pattern: - **Similar commits marked YES**: imx355 and smiapp drivers with identical runtime PM ordering fixes - **Similar commits marked NO**: imx319, ov4689, ov2740 commits that appear to be more general cleanup/improvement rather than bug fixes **2. Code Analysis:** The imx334 commit makes the exact same critical fix as the accepted imx355 commit: **Before (problematic):** ```c ret = v4l2_async_register_subdev_sensor(&imx334->sd); // Device becomes accessible /bin /bin.usr-is-merged /boot /dev /etc /home /init /lib /lib.usr-is-merged /lib64 /lost+found /media /mnt /opt /proc /root /run /sbin /sbin.usr-is-merged /snap /srv /sys /tmp /usr /var ... model/ prompt/ src/ target/ pm_runtime_set_active(imx334->dev); // Runtime PM enabled AFTER pm_runtime_enable(imx334->dev); ``` **After (fixed):** ```c pm_runtime_set_active(imx334->dev); // Runtime PM enabled BEFORE pm_runtime_enable(imx334->dev); ret = v4l2_async_register_subdev_sensor(&imx334->sd); // Device becomes accessible ``` **3. Bug Significance:** The commit message explicitly states this prevents "potential access to an uninitialized or powered- down device." This is a **race condition bug** where: - The sensor device becomes accessible via v4l2_async_register_subdev_sensor() - Other components (like ipu-bridge) may immediately try to access the device via runtime PM - If runtime PM isn't initialized yet, these accesses will fail **4. Backport Criteria Assessment:** ✓ **Fixes a user-affecting bug**: Race condition causing device access failures ✓ **Small and contained**: Only reorders initialization, no logic changes ✓ **No architectural changes**: Pure initialization ordering fix ✓ **Minimal regression risk**: The change aligns with established patterns ✓ **Follows stable tree rules**: Important bugfix with minimal risk **5. Consistency with Accepted Patterns:** The imx355 commit (marked YES) has an identical issue and fix pattern. The key difference from rejected commits is that imx355 and imx334 explicitly mention preventing device access failures, while others were general improvements. **6. Error Handling Analysis:** The commit properly adds runtime PM cleanup in error paths: ```c error_media_entity: pm_runtime_disable(imx334->dev); pm_runtime_set_suspended(imx334->dev); ``` This is a critical race condition fix that prevents real-world device access failures, follows established successful backport patterns, and has minimal risk - making it an excellent stable backport candidate.
drivers/media/i2c/imx334.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/media/i2c/imx334.c b/drivers/media/i2c/imx334.c index d722c9b7cd31d..fccf474752797 100644 --- a/drivers/media/i2c/imx334.c +++ b/drivers/media/i2c/imx334.c @@ -1358,6 +1358,9 @@ static int imx334_probe(struct i2c_client *client) goto error_handler_free; }
+ pm_runtime_set_active(imx334->dev); + pm_runtime_enable(imx334->dev); + ret = v4l2_async_register_subdev_sensor(&imx334->sd); if (ret < 0) { dev_err(imx334->dev, @@ -1365,13 +1368,13 @@ static int imx334_probe(struct i2c_client *client) goto error_media_entity; }
- pm_runtime_set_active(imx334->dev); - pm_runtime_enable(imx334->dev); pm_runtime_idle(imx334->dev);
return 0;
error_media_entity: + pm_runtime_disable(imx334->dev); + pm_runtime_set_suspended(imx334->dev); media_entity_cleanup(&imx334->sd.entity); error_handler_free: v4l2_ctrl_handler_free(imx334->sd.ctrl_handler);