[PATCH 05/10] media: microchip-isc: clean up histogram on the start_streaming error path

[Balakrishnan Sambath]

isc_configure() enables the histogram, its ISC_INT_HISDONE interrupt and
a HISREQ before calling isc_update_profile(), which can time out and
fail. When it does, isc_start_streaming() jumps to err_configure and
drops the runtime PM reference without disabling the histogram or
cancelling awb_work. A pending HISDONE can then schedule isc_awb_work(),
which reads the histogram registers after the clocks are gone, causing
an external abort.

Disable the histogram, synchronize the IRQ and flush the work before
dropping the PM reference, mirroring isc_stop_streaming(): the
synchronize_irq() has to precede cancel_work_sync() so a handler that is
still in flight cannot re-queue awb_work after it has been cancelled.

Fixes: 91b4e487b0c6 ("media: microchip: add ISC driver as Microchip ISC")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Balakrishnan Sambath <balakrishnan.s@xxxxxxxxxxxxx>
---
 drivers/media/platform/microchip/microchip-isc-base.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/media/platform/microchip/microchip-isc-base.c b/drivers/media/platform/microchip/microchip-isc-base.c
index 8f255a4c4e7a..f7fbd3cd8edc 100644
--- a/drivers/media/platform/microchip/microchip-isc-base.c
+++ b/drivers/media/platform/microchip/microchip-isc-base.c
@@ -382,6 +382,13 @@ static int isc_start_streaming(struct vb2_queue *vq, unsigned int count)
 	return 0;
 
 err_configure:
+	isc_set_histogram(isc, false);
+
+	/* let a running IRQ handler finish before the clock is disabled */
+	synchronize_irq(isc->irq);
+
+	cancel_work_sync(&isc->awb_work);
+
 	pm_runtime_put_sync(isc->dev);
 err_pm_get:
 	v4l2_subdev_call(isc->current_subdev->sd, video, s_stream, 0);

-- 
2.34.1