The error IRQ handler accesses MMIO while runtime suspend can disable its clocks without draining the handler. Request the IRQ with IRQF_NO_AUTOEN, enable it after successful runtime resume, and disable and drain it before runtime suspend gates clocks. This issue was identified during our ongoing static-analysis research while reviewing kernel code. Fixes: c85d3d5362a8 ("media: cadence: csi2rx: Support runtime PM") Assisted-by: LLM Cc: stable@vger.kernel.org Co-developed-by: Ijae Kim Signed-off-by: Ijae Kim Signed-off-by: Myeonghun Pak --- drivers/media/platform/cadence/cdns-csi2rx.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/drivers/media/platform/cadence/cdns-csi2rx.c b/drivers/media/platform/cadence/cdns-csi2rx.c index f8c626e19aa84569737aa785a31a0f8c94087613..9bb776b5a4c8248a65df733e3a8963a6393f0996 100644 --- a/drivers/media/platform/cadence/cdns-csi2rx.c +++ b/drivers/media/platform/cadence/cdns-csi2rx.c @@ -982,7 +982,7 @@ static int csi2rx_probe(struct platform_device *pdev) dev_dbg(csi2rx->dev, "Optional interrupt not defined, proceeding without it\n"); } else { ret = devm_request_irq(csi2rx->dev, csi2rx->error_irq, - csi2rx_irq_handler, 0, + csi2rx_irq_handler, IRQF_NO_AUTOEN, dev_name(&pdev->dev), csi2rx); if (ret) { dev_err(csi2rx->dev, @@ -1042,6 +1042,10 @@ static int csi2rx_runtime_suspend(struct device *dev) { struct csi2rx_priv *csi2rx = dev_get_drvdata(dev); + /* Drain the handler before disabling the clocks it needs. */ + if (csi2rx->error_irq >= 0) + disable_irq(csi2rx->error_irq); + reset_control_assert(csi2rx->sys_rst); clk_disable_unprepare(csi2rx->sys_clk); @@ -1082,6 +1086,9 @@ static int csi2rx_runtime_resume(struct device *dev) reset_control_deassert(csi2rx->sys_rst); + if (csi2rx->error_irq >= 0) + enable_irq(csi2rx->error_irq); + return 0; err_disable_pixclk: