[PATCH] media: saa7164: drain IRQ work before freeing the device

[PATCH] media: saa7164: drain IRQ work before freeing the device

[Hongyan Xu]

The saa7164 interrupt handler queues command, encoder, and VBI work
embedded in the device and port objects. free_irq() waits for active
interrupt handlers, but it does not cancel work they queued. Teardown
can therefore free those objects while a worker still references them.

Free the interrupt after shutting down the hardware, then cancel each
work item that was initialized for the board before unregistering the
ports.

Fixes: 443c1228d505 ("V4L/DVB (12923): SAA7164: Add support for the NXP SAA7164 silicon")
Signed-off-by: Hongyan Xu <getshell@seu.edu.cn>
---
 drivers/media/pci/saa7164/saa7164-core.c | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/drivers/media/pci/saa7164/saa7164-core.c b/drivers/media/pci/saa7164/saa7164-core.c
index ac5eb6b923e2..157f380f0df9 100644
--- a/drivers/media/pci/saa7164/saa7164-core.c
+++ b/drivers/media/pci/saa7164/saa7164-core.c
@@ -1492,6 +1492,20 @@ static void saa7164_finidev(struct pci_dev *pci_dev)
 		&dev->ports[SAA7164_PORT_VBI2].poll_interval);
 
 	saa7164_shutdown(dev);
+	free_irq(pci_dev->irq, dev);
+	cancel_work_sync(&dev->workcmd);
+
+	if (saa7164_boards[dev->board].portc == SAA7164_MPEG_ENCODER)
+		cancel_work_sync(&dev->ports[SAA7164_PORT_ENC1].workenc);
+
+	if (saa7164_boards[dev->board].portd == SAA7164_MPEG_ENCODER)
+		cancel_work_sync(&dev->ports[SAA7164_PORT_ENC2].workenc);
+
+	if (saa7164_boards[dev->board].porte == SAA7164_MPEG_VBI)
+		cancel_work_sync(&dev->ports[SAA7164_PORT_VBI1].workenc);
+
+	if (saa7164_boards[dev->board].portf == SAA7164_MPEG_VBI)
+		cancel_work_sync(&dev->ports[SAA7164_PORT_VBI2].workenc);
 
 	if (saa7164_boards[dev->board].porta == SAA7164_MPEG_DVB)
 		saa7164_dvb_unregister(&dev->ports[SAA7164_PORT_TS1]);
@@ -1515,9 +1529,6 @@ static void saa7164_finidev(struct pci_dev *pci_dev)
 	saa7164_i2c_unregister(&dev->i2c_bus[1]);
 	saa7164_i2c_unregister(&dev->i2c_bus[2]);
 
-	/* unregister stuff */
-	free_irq(pci_dev->irq, dev);
-
 	if (dev->msi) {
 		pci_disable_msi(pci_dev);
 		dev->msi = false;
-- 
2.50.1.windows.1