The buttress interrupt handler calls the isys and psys ISRs through
adev->auxdrv_data. The isys and psys drivers set it at probe, and
nothing clears it when they go away. Two paths lead from that to calls
into an unloaded module:

 - Patch 1: after "rmmod intel_ipu6_isys", "rmmod intel_ipu6" can oops
   in ipu6_buttress_isr() when free_irq() runs the handler (shared IRQ,
   CONFIG_DEBUG_SHIRQ) with an interrupt status bit pending. It clears
   the isys hooks on remove and on the probe error path.

 - Patch 2: the buttress ISR calls both ISRs before checking whose
   interrupt it is. After the out-of-tree psys driver is unloaded, every
   isys interrupt goes through the stale psys hooks. A user reported a
   hard lockup with no trace on the first stream after
   "rmmod intel-ipu6-psys" [1]. It checks the status bit first.

To test both, backported to v7.2.6 on a Samsung Galaxy Book3 Ultra
(Raptor Lake, IPU6EP), I added a module notifier that records a hook
left pointing into a module going away, plus an ISR check that skips
such a hook and logs it instead of calling it:

 - rmmod intel_ipu6_psys, then 60 frames: at least ten calls through the
   stale psys hook without patch 2, none with it, all frames captured.
 - rmmod intel_ipu6_isys: the isys hook still pointed into the module
   without patch 1, and was NULL with it.

The psys driver in intel/ipu6-drivers has the same missing cleanup in
its remove path. Patch 2 keeps isys interrupts away from it, but that
driver should clear its own hooks too.

[1] https://lore.kernel.org/linux-media/20260922063507.690-1-tmorolias@gmail.com/

Felipe Calliari (2):
  media: ipu6: Clear the isys ISR hooks when the isys driver goes away
  media: ipu6: Only call the isys and psys ISRs for their own interrupts

 drivers/media/pci/intel/ipu6/ipu6-buttress.c | 19 +++++++++++-----
 drivers/media/pci/intel/ipu6/ipu6-isys.c     | 23 +++++++++++++++++---
 2 files changed, 33 insertions(+), 9 deletions(-)


base-commit: 2dcdfb625c3b8fe87454e19dfbc54b3e3f0ad70e
-- 
2.55.0