Re: [PATCH v4 1/2] media: venus: hfi: disable IRQ before freeing HFI device

[Bryan O'Donoghue <bod@kernel.org>]

On 01/10/2026 18:55, Myeonghun Pak wrote:
> venus_hfi_destroy() releases the interface queues and frees hdev before
> calling disable_irq(). An IRQ handler that has already read core->priv
> can continue to access hdev and its queues after they are freed. Clearing
> core->priv does not revoke the handler's local pointer.
> 
> Commit 640803003cd9 ("media: venus: hfi: explicitly release IRQ during
> teardown") added disable_irq(), but placed it after kfree(hdev), too late
> to protect a handler already using hdev.
> 
> Disable the IRQ first so that both the hard IRQ and threaded handler have
> completed before clearing core->priv or releasing hdev.
> 
> Fixes: d96d3f30c0f2 ("[media] media: venus: hfi: add Venus HFI files")
> Reported-by: Sashiko <sashiko-bot@kernel.org>
> Closes: https://lore.kernel.org/all/20260612103333.5585D1F000E9@smtp.kernel.org/
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Co-developed-by: Ijae Kim <ae878000@gmail.com>
> Signed-off-by: Ijae Kim <ae878000@gmail.com>
> Signed-off-by: Myeonghun Pak <mhun512@gmail.com>
> ---
>   drivers/media/platform/qcom/venus/hfi_venus.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/media/platform/qcom/venus/hfi_venus.c b/drivers/media/platform/qcom/venus/hfi_venus.c
> index bd82066bb6e7..e7e4e78a186a 100644
> --- a/drivers/media/platform/qcom/venus/hfi_venus.c
> +++ b/drivers/media/platform/qcom/venus/hfi_venus.c
> @@ -1689,11 +1689,11 @@ void venus_hfi_destroy(struct venus_core *core)
>   {
>   	struct venus_hfi_device *hdev = to_hfi_priv(core);
> 
> +	disable_irq(core->irq);
>   	core->priv = NULL;
>   	venus_interface_queues_release(hdev);
>   	mutex_destroy(&hdev->lock);
>   	kfree(hdev);
> -	disable_irq(core->irq);
>   	core->ops = NULL;
>   }
> 
> --
> 2.53.0
> 
Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>