[PATCH v3] media: rkvdec: Handle interrupts without a current context

[Alex Kazinsky <a.kazinsky@ideco.ru>]

The watchdog can finish the current job before the threaded IRQ handler
retrieves its context. In that case, v4l2_m2m_get_curr_priv() returns NULL,
but the variant IRQ handlers unconditionally dereference ctx->dev.

Pass only the device pointer to the variant IRQ handlers, so they can
acknowledge interrupts without accessing the current context. Retrieve
the context inside rkvdec_job_finish() instead. In the IRQ path, this
happens only after successfully cancelling the watchdog, while the job
is still active.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: f9c7b7deeffd ("media: rkvdec: Support per-variant interrupt handler")
Signed-off-by: Alex Kazinsky <a.kazinsky@ideco.ru>
---
Changes in v3:
- Pass only rkvdec_dev to the variant IRQ handlers.
- Retrieve the current context inside rkvdec_job_finish().
- Remove the NULL-context checks from the variant IRQ handlers, as
  suggested by Nicolas Dufresne.

Changes in v2:
- Fix continuation-line alignment in the IRQ handler declarations.
- Clarify that the issue has not been reproduced on hardware and
  describe a possible test.

v2: https://lore.kernel.org/all/20261026124808.642373-1-a.kazinsky@ideco.ru/
v1: https://lore.kernel.org/all/20261023131124.94116-1-a.kazinsky@ideco.ru/

The issue has not been reproduced on hardware. The watchdog/IRQ race
is based on code analysis.

 .../media/platform/rockchip/rkvdec/rkvdec.c   | 26 ++++++++-----------
 .../media/platform/rockchip/rkvdec/rkvdec.h   |  3 ++-
 2 files changed, 13 insertions(+), 16 deletions(-)

diff --git a/drivers/media/platform/rockchip/rkvdec/rkvdec.c b/drivers/media/platform/rockchip/rkvdec/rkvdec.c
index 5250dd59df2e..1b43f05b0299 100644
--- a/drivers/media/platform/rockchip/rkvdec/rkvdec.c
+++ b/drivers/media/platform/rockchip/rkvdec/rkvdec.c
@@ -1089,10 +1089,10 @@ static void rkvdec_job_finish_no_pm(struct rkvdec_ctx *ctx,
 					 result);
 }
 
-static void rkvdec_job_finish(struct rkvdec_ctx *ctx,
+static void rkvdec_job_finish(struct rkvdec_dev *rkvdec,
 			      enum vb2_buffer_state result)
 {
-	struct rkvdec_dev *rkvdec = ctx->dev;
+	struct rkvdec_ctx *ctx = v4l2_m2m_get_curr_priv(rkvdec->m2m_dev);
 
 	pm_runtime_put_autosuspend(rkvdec->dev);
 	rkvdec_job_finish_no_pm(ctx, result);
@@ -1176,7 +1176,7 @@ static void rkvdec_device_run(void *priv)
 
 	ret = desc->ops->run(ctx);
 	if (ret)
-		rkvdec_job_finish(ctx, VB2_BUF_STATE_ERROR);
+		rkvdec_job_finish(rkvdec, VB2_BUF_STATE_ERROR);
 }
 
 static const struct v4l2_m2m_ops rkvdec_m2m_ops = {
@@ -1434,9 +1434,8 @@ static void rkvdec_iommu_restore(struct rkvdec_dev *rkvdec)
 	}
 }
 
-static irqreturn_t rk3399_irq_handler(struct rkvdec_ctx *ctx)
+static irqreturn_t rk3399_irq_handler(struct rkvdec_dev *rkvdec)
 {
-	struct rkvdec_dev *rkvdec = ctx->dev;
 	enum vb2_buffer_state state;
 	u32 status;
 
@@ -1452,14 +1451,13 @@ static irqreturn_t rk3399_irq_handler(struct rkvdec_ctx *ctx)
 	}
 
 	if (cancel_delayed_work(&rkvdec->watchdog_work))
-		rkvdec_job_finish(ctx, state);
+		rkvdec_job_finish(rkvdec, state);
 
 	return IRQ_HANDLED;
 }
 
-static irqreturn_t vdpu381_irq_handler(struct rkvdec_ctx *ctx)
+static irqreturn_t vdpu381_irq_handler(struct rkvdec_dev *rkvdec)
 {
-	struct rkvdec_dev *rkvdec = ctx->dev;
 	enum vb2_buffer_state state;
 	bool need_reset = 0;
 	u32 status;
@@ -1481,14 +1479,13 @@ static irqreturn_t vdpu381_irq_handler(struct rkvdec_ctx *ctx)
 		rkvdec_iommu_restore(rkvdec);
 
 	if (cancel_delayed_work(&rkvdec->watchdog_work))
-		rkvdec_job_finish(ctx, state);
+		rkvdec_job_finish(rkvdec, state);
 
 	return IRQ_HANDLED;
 }
 
-static irqreturn_t vdpu383_irq_handler(struct rkvdec_ctx *ctx)
+static irqreturn_t vdpu383_irq_handler(struct rkvdec_dev *rkvdec)
 {
-	struct rkvdec_dev *rkvdec = ctx->dev;
 	enum vb2_buffer_state state;
 	bool need_reset = 0;
 	u32 status;
@@ -1510,7 +1507,7 @@ static irqreturn_t vdpu383_irq_handler(struct rkvdec_ctx *ctx)
 		rkvdec_iommu_restore(rkvdec);
 
 	if (cancel_delayed_work(&rkvdec->watchdog_work))
-		rkvdec_job_finish(ctx, state);
+		rkvdec_job_finish(rkvdec, state);
 
 	return IRQ_HANDLED;
 }
@@ -1518,10 +1515,9 @@ static irqreturn_t vdpu383_irq_handler(struct rkvdec_ctx *ctx)
 static irqreturn_t rkvdec_irq_handler(int irq, void *priv)
 {
 	struct rkvdec_dev *rkvdec = priv;
-	struct rkvdec_ctx *ctx = v4l2_m2m_get_curr_priv(rkvdec->m2m_dev);
 	const struct rkvdec_variant *variant = rkvdec->variant;
 
-	return variant->ops->irq_handler(ctx);
+	return variant->ops->irq_handler(rkvdec);
 }
 
 /*
@@ -1607,7 +1603,7 @@ static void rkvdec_watchdog_func(struct work_struct *work)
 	if (ctx) {
 		dev_err(rkvdec->dev, "Frame processing timed out!\n");
 		writel(RKVDEC_IRQ_DIS, rkvdec->regs + RKVDEC_REG_INTERRUPT);
-		rkvdec_job_finish(ctx, VB2_BUF_STATE_ERROR);
+		rkvdec_job_finish(rkvdec, VB2_BUF_STATE_ERROR);
 	}
 }
 
diff --git a/drivers/media/platform/rockchip/rkvdec/rkvdec.h b/drivers/media/platform/rockchip/rkvdec/rkvdec.h
index a24be6638b6b..894c18eeb795 100644
--- a/drivers/media/platform/rockchip/rkvdec/rkvdec.h
+++ b/drivers/media/platform/rockchip/rkvdec/rkvdec.h
@@ -30,6 +30,7 @@
 #define RKVDEC_8K_PIXELS		(7680 * 4320)
 
 struct rkvdec_ctx;
+struct rkvdec_dev;
 struct rkvdec_rcb_config;
 
 struct rkvdec_ctrl_desc {
@@ -72,7 +73,7 @@ vb2_to_rkvdec_decoded_buf(struct vb2_buffer *buf)
 }
 
 struct rkvdec_variant_ops {
-	irqreturn_t (*irq_handler)(struct rkvdec_ctx *ctx);
+	irqreturn_t (*irq_handler)(struct rkvdec_dev *rkvdec);
 	u32 (*colmv_size)(u16 width, u16 height);
 	void (*flatten_matrices)(u8 *output, const u8 *input, int matrices, int row_length);
 };
-- 
2.56.0