media: chips-media: wave5: Avoid race condition in the interrupt handler

In case of multiple active instances, new interrupts can occur as soon
as the current interrupt is cleared. If the driver reads the
instance_info after clearing the interrupt, then there is no guarantee,
that the instance_info is still valid for the current interrupt.

Read the instance_info register for each interrupt before clearing the
interrupt.

Fixes: ed7276ed2fd0 ("media: chips-media: wave5: Add hrtimer based polling support")
Cc: stable@vger.kernel.org
Signed-off-by: Jackson.lee <jackson.lee@chipsnmedia.com>
Signed-off-by: Nas Chung <nas.chung@chipsnmedia.com>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Sebastian Fricke <sebastian.fricke@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>

diff --git a/drivers/media/platform/chips-media/wave5/wave5-vpu.c b/drivers/media/platform/chips-media/wave5/wave5-vpu.c
index d1320298a0f7670ebf3978047ada32f8ffb7ce46..5948a18958d11e358e1ed463e3ba6a4ecfe22c52 100644 (file)
--- a/drivers/media/platform/chips-media/wave5/wave5-vpu.c
+++ b/drivers/media/platform/chips-media/wave5/wave5-vpu.c
@@ -55,12 +55,12 @@ static void wave5_vpu_handle_irq(void *dev_id)
        struct vpu_device *dev = dev_id;
 
        irq_reason = wave5_vdi_read_register(dev, W5_VPU_VINT_REASON);
+       seq_done = wave5_vdi_read_register(dev, W5_RET_SEQ_DONE_INSTANCE_INFO);
+       cmd_done = wave5_vdi_read_register(dev, W5_RET_QUEUE_CMD_DONE_INST);
        wave5_vdi_write_register(dev, W5_VPU_VINT_REASON_CLR, irq_reason);
        wave5_vdi_write_register(dev, W5_VPU_VINT_CLEAR, 0x1);
 
        list_for_each_entry(inst, &dev->instances, list) {
-               seq_done = wave5_vdi_read_register(dev, W5_RET_SEQ_DONE_INSTANCE_INFO);
-               cmd_done = wave5_vdi_read_register(dev, W5_RET_QUEUE_CMD_DONE_INST);
 
                if (irq_reason & BIT(INT_WAVE5_INIT_SEQ) ||
                    irq_reason & BIT(INT_WAVE5_ENC_SET_PARAM)) {