From nobody Thu Sep 24 13:42:25 2026 Received: from fraori-sdnproxy-3.icoremail.net (fraori-sdnproxy-3.icoremail.net [132.226.202.154]) by smtp.subspace.kernel.org (Postfix) with ESMTP id AB9FF44780D; Wed, 23 Sep 2026 09:00:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=132.226.202.154 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790154028; cv=none; b=V9sauNNS+Y6I5bjHnr2pAWlwoaXJ8fNR6IwTKH/7xlHLrB+/XCWRWTNYuNoJHmvSbpv72pETdoGdoJsZuJFkB5Mr+jRuzHPl6vKEZq8s2yaslyCH1NfRZRoHCRCXJiqF9vQTtJp8eCtlb/eVQyBiq3Fzav7INFBbsix8CYk8xcM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790154028; c=relaxed/simple; bh=STUYC7n0BZKIPyHery0gssByxhR0+hlp8CbmBx/FWTk=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=emsQ4yyJeubBS4w8gMI2yWCXVoD4LIfLQfaGjY3LyV7UyyZHmgfk1B7cxOdAWiAPCuJJJAtgGcdxhL9iqxGR2uB9FggabzcgTHuX8/EHbhdZZrqjdtyDRy32xoNSuZRJUGiYkZOAkCQz1cV9RqMByFCByw9mVkD7fnpzZacev3M= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=zju.edu.cn; spf=pass smtp.mailfrom=zju.edu.cn; arc=none smtp.client-ip=132.226.202.154 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=zju.edu.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=zju.edu.cn Received: from zju.edu.cn (unknown [10.98.66.117]) by mtasvr (Coremail) with SMTP id _____wCnLzQhlbNqKS4xAQ--.6797S3; Wed, 23 Sep 2026 17:00:17 +0800 (CST) Received: from localhost.localdomain (unknown [10.98.66.117]) by mail-app2 (Coremail) with SMTP id zC_KCgBHt8whlbNq02CWBA--.45849S2; Wed, 23 Sep 2026 17:00:17 +0800 (CST) From: Fan Wu To: Tiffany Lin , Andrew-CT Chen , Yunfei Dong , Minghsiu Tsai , Houlong Wei , Mauro Carvalho Chehab Cc: Matthias Brugger , AngeloGioacchino Del Regno , linux-media@vger.kernel.org, linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org, linux-mediatek@lists.infradead.org, stable@vger.kernel.org, Fan Wu , Song Li Subject: [PATCH] media: mediatek: vpu: free IRQ before destroying watchdog workqueue Date: Wed, 23 Sep 2026 08:59:21 +0000 Message-Id: <20260923085921.496767-1-fanwu01@zju.edu.cn> X-Mailer: git-send-email 2.34.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-CM-TRANSID: zC_KCgBHt8whlbNq02CWBA--.45849S2 X-CM-SenderInfo: qrstjiaswqq6lmxovvfxof0/ X-CM-DELIVERINFO: =?B?SW2ZXAXKKxbFmtjJiESix3B1w3vZ3A9ovKVTomAyoQazvoRs/NHSP8GI2EvgeEEW7R sfncGSG+szpQCInt5Y8rbJUI2Rv7UHILkiL+vVQcy0p0DsKJ3OEr1dpUAe2S/uPJ3WWKA1 XoHu+JNxgo1UfABGDN6p9E6mavGmQbzmcFsnzP86 X-Coremail-Antispam: 1Uk129KBj93XoW7Zw1xXr4ktrWxCr1UJr45CFX_yoW8XF1kpr s5Kayjyry8Ga1UXw47Aw1UWF15AF1fWFW7uw13uw1fZwnIvFs8XryFyayqyrZ3ArykZa4a yF90g343CFZ0vFcCm3ZEXasCq-sJn29KB7ZKAUJUUUUU529EdanIXcx71UUUUU7KY7ZEXa sCq-sGcSsGvfJ3Ic02F40EFcxC0VAKzVAqx4xG6I80ebIjqfuFe4nvWSU5nxnvy29KBjDU 0xBIdaVrnRJUUUP0b4IE77IF4wAFF20E14v26r4j6ryUM7CY07I20VC2zVCF04k26cxKx2 IYs7xG6rWj6s0DM7CIcVAFz4kK6r1j6r18M28lY4IEw2IIxxk0rwA2F7IY1VAKz4vEj48v e4kI8wA2z4x0Y4vE2Ix0cI8IcVAFwI0_tr0E3s1l84ACjcxK6xIIjxv20xvEc7CjxVAFwI 0_Gr1j6F4UJwA2z4x0Y4vEx4A2jsIE14v26rxl6s0DM28EF7xvwVC2z280aVCY1x0267AK xVW0oVCq3wAac4AC62xK8xCEY4vEwIxC4wAS0I0E0xvYzxvE52x082IY62kv0487Mc804V CY07AIYIkI8VC2zVCFFI0UMc02F40EFcxC0VAKzVAqx4xG6I80ewAv7VC0I7IYx2IY67AK xVWUXVWUAwAv7VC2z280aVAFwI0_Gr0_Cr1lOx8S6xCaFVCjc4AY6r1j6r4UM4x0Y48Icx kI7VAKI48JM4x0Y48IcxkI7VAKI48G6xCjnVAKz4kxM4IIrI8v6xkF7I0E8cxan2IY04v7 MxAIw28IcxkI7VAKI48JMxC20s026xCaFVCjc4AY6r1j6r4UMI8I3I0E5I8CrVAFwI0_Jr 0_Jr4lx2IqxVCjr7xvwVAFwI0_JrI_JrWlx4CE17CEb7AF67AKxVWUtVW8ZwCIc40Y0x0E wIxGrwCI42IY6xIIjxv20xvE14v26r1j6r1xMIIF0xvE2Ix0cI8IcVCY1x0267AKxVW8JV WxJwCI42IY6xAIw20EY4v20xvaj40_Jr0_JF4lIxAIcVC2z280aVAFwI0_Gr0_Cr1lIxAI cVC2z280aVCY1x0267AKxVW8JVW8JrUvcSsGvfC2KfnxnUUI43ZEXa7IU8aQ6JUUUUU== Content-Type: text/plain; charset="utf-8" mtk_vpu_remove() destroys the watchdog workqueue while the interrupt handler requested with devm_request_irq() is still registered: the devres core frees the interrupt only after remove() has returned. If the VPU watchdog fires in that window, vpu_irq_handler() queues vpu->wdt.ws on the already destroyed vpu->wdt.wq. Fix this by calling devm_free_irq() before destroy_workqueue(), which releases the interrupt and waits for a running handler, so no new work can be queued while the workqueue is drained and freed. This issue was found by an in-house static analysis tool. Fixes: 3003a180ef6b ("[media] VPU: mediatek: support Mediatek VPU") Cc: stable@vger.kernel.org Co-developed-by: Song Li Signed-off-by: Song Li Signed-off-by: Fan Wu --- drivers/media/platform/mediatek/vpu/mtk_vpu.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/media/platform/mediatek/vpu/mtk_vpu.c b/drivers/media/= platform/mediatek/vpu/mtk_vpu.c index 8d8319f..b6bd80b 100644 --- a/drivers/media/platform/mediatek/vpu/mtk_vpu.c +++ b/drivers/media/platform/mediatek/vpu/mtk_vpu.c @@ -962,6 +962,7 @@ static void mtk_vpu_remove(struct platform_device *pdev) #ifdef CONFIG_DEBUG_FS debugfs_remove(vpu_debugfs); #endif + devm_free_irq(&pdev->dev, vpu->reg.irq, vpu); if (vpu->wdt.wq) destroy_workqueue(vpu->wdt.wq); vpu_free_ext_mem(vpu, P_FW);