| From 3200144a2fa4209dc084a19941b9b203b43580f0 Mon Sep 17 00:00:00 2001 |
| From: Jorge Ramirez-Ortiz <jorge.ramirez@oss.qualcomm.com> |
| Date: Fri, 6 Jun 2025 17:25:22 +0200 |
| Subject: media: venus: protect against spurious interrupts during probe |
| |
| From: Jorge Ramirez-Ortiz <jorge.ramirez@oss.qualcomm.com> |
| |
| commit 3200144a2fa4209dc084a19941b9b203b43580f0 upstream. |
| |
| Make sure the interrupt handler is initialized before the interrupt is |
| registered. |
| |
| If the IRQ is registered before hfi_create(), it's possible that an |
| interrupt fires before the handler setup is complete, leading to a NULL |
| dereference. |
| |
| This error condition has been observed during system boot on Rb3Gen2. |
| |
| Fixes: af2c3834c8ca ("[media] media: venus: adding core part and helper functions") |
| Cc: stable@vger.kernel.org |
| Signed-off-by: Jorge Ramirez-Ortiz <jorge.ramirez@oss.qualcomm.com> |
| Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> |
| Reviewed-by: Vikash Garodia <quic_vgarodia@quicinc.com> |
| Reviewed-by: Dikshita Agarwal <quic_dikshita@quicinc.com> |
| Tested-by: Dikshita Agarwal <quic_dikshita@quicinc.com> # RB5 |
| Signed-off-by: Bryan O'Donoghue <bod@kernel.org> |
| Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| drivers/media/platform/qcom/venus/core.c | 8 ++++---- |
| 1 file changed, 4 insertions(+), 4 deletions(-) |
| |
| --- a/drivers/media/platform/qcom/venus/core.c |
| +++ b/drivers/media/platform/qcom/venus/core.c |
| @@ -424,13 +424,13 @@ static int venus_probe(struct platform_d |
| INIT_DELAYED_WORK(&core->work, venus_sys_error_handler); |
| init_waitqueue_head(&core->sys_err_done); |
| |
| - ret = devm_request_threaded_irq(dev, core->irq, hfi_isr, venus_isr_thread, |
| - IRQF_TRIGGER_HIGH | IRQF_ONESHOT, |
| - "venus", core); |
| + ret = hfi_create(core, &venus_core_ops); |
| if (ret) |
| goto err_core_put; |
| |
| - ret = hfi_create(core, &venus_core_ops); |
| + ret = devm_request_threaded_irq(dev, core->irq, hfi_isr, venus_isr_thread, |
| + IRQF_TRIGGER_HIGH | IRQF_ONESHOT, |
| + "venus", core); |
| if (ret) |
| goto err_core_put; |
| |
