[PATCH v2] media: rockchip: rga: quiesce IRQ before releasing m2m state

[Nicolas Dufresne]

Hi,

Le samedi 04 juillet 2026 à 08:46 +0000, Fan Wu a écrit :
> rga_remove() releases the m2m state before the IRQ is freed. The IRQ is
> devm-managed and is only released once rga_remove() returns, so rga_isr()
> can still run while the m2m device state is being torn down.
> 
> Store the IRQ number in struct rockchip_rga, unregister the video device
> first, and free the IRQ before releasing the m2m state so the handler
> cannot run against the freed state.
> 
> Fixes: f7e7b48e6d79 ("[media] rockchip/rga: v4l2 m2m support")
> Cc: stable at vger.kernel.org
> Signed-off-by: Fan Wu <fanwu01 at zju.edu.cn>

Again, I don't know if this is a real issue, but seems fair.

Reviewed-by: Nicolas Dufresne <nicolas.dufresne at collabora.com>

Picked, ty

> 
> ---
> Changes in v2:
> - Rebased onto media-committers/fixes (Linux 7.2-rc1) so the Media CI
>   valid-ancestor check passes. The rga driver was rewritten upstream
>   (rga3 support, external IOMMU, clk_bulk, cmdbuf moved to rga_ctx), so
>   this is a re-port rather than a pure rebase: the resource freed during
>   removal is now rga->m2m_dev.
> ---
>  drivers/media/platform/rockchip/rga/rga.c | 4 +++-
>  drivers/media/platform/rockchip/rga/rga.h | 1 +
>  2 files changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/media/platform/rockchip/rga/rga.c b/drivers/media/platform/rockchip/rga/rga.c
> index b3cb6bf8eb86..fbc99462dce2 100644
> --- a/drivers/media/platform/rockchip/rga/rga.c
> +++ b/drivers/media/platform/rockchip/rga/rga.c
> @@ -797,6 +797,7 @@ static int rga_probe(struct platform_device *pdev)
>  		ret = irq;
>  		goto err_put_clk;
>  	}
> +	rga->irq = irq;
>  
>  	ret = devm_request_irq(rga->dev, irq, rga_isr,
>  			       rga_has_internal_iommu(rga) ? 0 : IRQF_SHARED,
> @@ -876,8 +877,9 @@ static void rga_remove(struct platform_device *pdev)
>  
>  	v4l2_info(&rga->v4l2_dev, "Removing\n");
>  
> -	v4l2_m2m_release(rga->m2m_dev);
>  	video_unregister_device(rga->vfd);
> +	devm_free_irq(rga->dev, rga->irq, rga);
> +	v4l2_m2m_release(rga->m2m_dev);
>  	v4l2_device_unregister(&rga->v4l2_dev);
>  
>  	pm_runtime_disable(rga->dev);
> diff --git a/drivers/media/platform/rockchip/rga/rga.h b/drivers/media/platform/rockchip/rga/rga.h
> index bd431534d0d3..7bcdf36c11b4 100644
> --- a/drivers/media/platform/rockchip/rga/rga.h
> +++ b/drivers/media/platform/rockchip/rga/rga.h
> @@ -73,6 +73,7 @@ struct rockchip_rga {
>  	struct device *dev;
>  	struct regmap *grf;
>  	void __iomem *regs;
> +	int irq;
>  	struct clk_bulk_data *clks;
>  	int num_clks;
>  	struct rockchip_rga_version version;
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 228 bytes
Desc: This is a digitally signed message part
URL: <http://lists.infradead.org/pipermail/linux-rockchip/attachments/20260928/d0f93b8f/attachment.sig>