[PATCH] media: bdisp: cancel timeout work before teardown

[Hongyan Xu]

bdisp_device_run() queues timeout_work with a non-zero delay. During
remove, bdisp_unregister_device() releases the V4L2 mem2mem device before
the private workqueue is destroyed. A pending timeout can therefore run
after v4l2_m2m_release() and pass the freed m2m_dev to
v4l2_m2m_get_curr_priv().

Pause the mem2mem scheduler first so the current job finishes and no new
job can rearm timeout_work. Then cancel the work synchronously before
unregistering the device. This guarantees that the callback has finished
using the driver data before the remaining resources are torn down.

This issue was found by a static analysis tool.

Fixes: 28ffeebbb7bd ("[media] bdisp: 2D blitter driver using v4l2 mem2mem framework")
Signed-off-by: Hongyan Xu <getshell@xxxxxxxxxx>
---
 drivers/media/platform/st/sti/bdisp/bdisp-v4l2.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/media/platform/st/sti/bdisp/bdisp-v4l2.c b/drivers/media/platform/st/sti/bdisp/bdisp-v4l2.c
index ee6d686cb..5c92777cd 100644
--- a/drivers/media/platform/st/sti/bdisp/bdisp-v4l2.c
+++ b/drivers/media/platform/st/sti/bdisp/bdisp-v4l2.c
@@ -1261,6 +1261,9 @@ static void bdisp_remove(struct platform_device *pdev)
 {
 	struct bdisp_dev *bdisp = platform_get_drvdata(pdev);
 
+	v4l2_m2m_suspend(bdisp->m2m.m2m_dev);
+	cancel_delayed_work_sync(&bdisp->timeout_work);
+
 	bdisp_unregister_device(bdisp);
 
 	bdisp_hw_free_filters(bdisp->dev);
-- 
2.50.1.windows.1