[PATCH 2/3] media: verisilicon: hantro: cancel watchdog work before m2m release

[Frank Li]

On Tue, Aug 25, 2026 at 03:34:31AM +0800, Shengzhuo Wei wrote:
> Each job arms vpu->watchdog_work, cancelled only by the
> job-completion path. If a job stalls, hantro_remove() drops the last
> reference to vpu->m2m_dev via v4l2_m2m_put() with the watchdog still
> pending, and hantro_watchdog() then dereferences the freed m2m_dev --
> a use-after-free.
>
> Drain the watchdog before the m2m device is released.
>
> Fixes: 775fec69008d ("media: add Rockchip VPU JPEG encoder driver")
> Cc: stable at vger.kernel.org
> Signed-off-by: Shengzhuo Wei <me at cherr.cc>
> Assisted-by: GLM:5.3
> ---

Reviewed-by: Frank Li <Frank.Li at nxp.com>

>  drivers/media/platform/verisilicon/hantro_drv.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/drivers/media/platform/verisilicon/hantro_drv.c b/drivers/media/platform/verisilicon/hantro_drv.c
> index 2e81877f640fb429b18d2f4fd64bc0c392cf600e..1b04b98371a48184f390a13791243fd00d6b80ef 100644
> --- a/drivers/media/platform/verisilicon/hantro_drv.c
> +++ b/drivers/media/platform/verisilicon/hantro_drv.c
> @@ -1284,6 +1284,7 @@ static void hantro_remove(struct platform_device *pdev)
>  	hantro_remove_dec_func(vpu);
>  	hantro_remove_enc_func(vpu);
>  	media_device_cleanup(&vpu->mdev);
> +	cancel_delayed_work_sync(&vpu->watchdog_work);
>  	v4l2_m2m_put(vpu->m2m_dev);
>  	v4l2_device_unregister(&vpu->v4l2_dev);
>  	clk_bulk_unprepare(vpu->variant->num_clocks, vpu->clocks);
>
> --
> 2.47.3