cal_remove() unregisters the video devices but does not release their vb2 queues. An active stream can therefore keep WDMA IRQs enabled while the contexts are freed. The managed IRQ is released only after .remove() returns, so a handler already in flight can access a freed context through cal->ctx[i]. Use vb2_video_unregister_device() to release each queue and stop any active stream while the IRQ is still available for DMA stop completion. Then release the managed IRQ explicitly before destroying the contexts, which synchronizes any in-flight handler before the context memory is freed. Drain the IRQ on the probe error path before destroying partially created contexts too. Fixes: 343e89a792a5 ("[media] media: ti-vpe: Add CAL v4l2 camera capture driver") Cc: stable@vger.kernel.org Assisted-by: LLM Co-developed-by: Ijae Kim Signed-off-by: Ijae Kim Signed-off-by: Myeonghun Pak --- Changes in v3: - Resend the unchanged patch with intact diff headers. Changes in v2: - Rebuilt the mail-ready message; no code changes. drivers/media/platform/ti/cal/cal-video.c | 2 +- drivers/media/platform/ti/cal/cal.c | 11 +++++++---- 2 files changed, 8 insertions(+), 5 deletions(-) diff --git a/drivers/media/platform/ti/cal/cal-video.c b/drivers/media/platform/ti/cal/cal-video.c index d40e24ab1127..0310dba0c810 100644 --- a/drivers/media/platform/ti/cal/cal-video.c +++ b/drivers/media/platform/ti/cal/cal-video.c @@ -1036,7 +1036,7 @@ void cal_ctx_v4l2_unregister(struct cal_ctx *ctx) ctx_dbg(1, ctx, "unregistering %s\n", video_device_node_name(&ctx->vdev)); - video_unregister_device(&ctx->vdev); + vb2_video_unregister_device(&ctx->vdev); } int cal_ctx_v4l2_init(struct cal_ctx *ctx) diff --git a/drivers/media/platform/ti/cal/cal.c b/drivers/media/platform/ti/cal/cal.c index b7e77b6b8950..d332a05facce 100644 --- a/drivers/media/platform/ti/cal/cal.c +++ b/drivers/media/platform/ti/cal/cal.c @@ -1151,7 +1151,6 @@ static int cal_probe(struct platform_device *pdev) bool connected = false; unsigned int i; int ret; - int irq; cal = devm_kzalloc(&pdev->dev, sizeof(*cal), GFP_KERNEL); if (!cal) @@ -1186,9 +1185,9 @@ static int cal_probe(struct platform_device *pdev) cal_dbg(1, cal, "ioresource %s at %pa - %pa\n", cal->res->name, &cal->res->start, &cal->res->end); - irq = platform_get_irq(pdev, 0); - cal_dbg(1, cal, "got irq# %d\n", irq); - ret = devm_request_irq(&pdev->dev, irq, cal_irq, 0, CAL_MODULE_NAME, + cal->irq = platform_get_irq(pdev, 0); + cal_dbg(1, cal, "got irq# %d\n", cal->irq); + ret = devm_request_irq(&pdev->dev, cal->irq, cal_irq, 0, CAL_MODULE_NAME, cal); if (ret) return ret; @@ -1268,6 +1267,8 @@ static int cal_probe(struct platform_device *pdev) return 0; error_context: + devm_free_irq(&pdev->dev, cal->irq, cal); + for (i = 0; i < cal->num_contexts; i++) cal_ctx_destroy(cal->ctx[i]); @@ -1298,6 +1299,8 @@ static void cal_remove(struct platform_device *pdev) for (i = 0; i < cal->data->num_csi2_phy; i++) cal_camerarx_disable(cal->phy[i]); + devm_free_irq(&pdev->dev, cal->irq, cal); + for (i = 0; i < cal->num_contexts; i++) cal_ctx_destroy(cal->ctx[i]); -- 2.53.0