[PATCH] media: i2c: ov02c10: Fix race condition in remove and relax reset timings

[Saikiran <bjsaikiran@gmail.com>]

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain; charset=y, Size: 2187 bytes --]

The ov02c10_remove() function has a race condition where v4l2_ctrl_handler
and media_entity resources are freed before the device is powered off.
If userspace (e.g., PipeWire/WirePlumber) accesses the device during
removal, this causes a Use-After-Free leading to kernel oops with
"Execute from non-executable memory" errors.

Fix by reordering cleanup: disable runtime PM and power off the device
BEFORE freeing v4l2_ctrl_handler and media_entity resources.

Additionally, relax reset timings to prevent CCI I2C timeout errors.
The sensor microcontroller occasionally fails to boot within the
original timing windows, causing "master 1 queue 0 timeout" errors:
- Assert reset delay: 2ms → 5ms
- Post-reset boot delay: 5ms → 20ms

These two fixes address different but related stability issues that
manifest during camera initialization and removal.

Tested-on: Lenovo Yoga Slim 7x (Snapdragon X Elite)
Signed-off-by: Saikiran <bjsaikiran@gmail.com>
---
 drivers/media/i2c/ov02c10.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/media/i2c/ov02c10.c b/drivers/media/i2c/ov02c10.c
index cf93d36032e1..b86cae3d2b74 100644
--- a/drivers/media/i2c/ov02c10.c
+++ b/drivers/media/i2c/ov02c10.c
@@ -692,9 +692,9 @@ static int ov02c10_power_on(struct device *dev)
 
 	if (ov02c10->reset) {
 		/* Assert reset for at least 2ms on back to back off-on */
-		usleep_range(2000, 2200);
+		usleep_range(5000, 5500);
 		gpiod_set_value_cansleep(ov02c10->reset, 0);
-		usleep_range(5000, 5100);
+		usleep_range(20000, 21000);
 	}
 
 	return 0;
@@ -864,14 +864,14 @@ static void ov02c10_remove(struct i2c_client *client)
 	struct ov02c10 *ov02c10 = to_ov02c10(sd);
 
 	v4l2_async_unregister_subdev(sd);
-	v4l2_subdev_cleanup(sd);
-	media_entity_cleanup(&sd->entity);
-	v4l2_ctrl_handler_free(sd->ctrl_handler);
 	pm_runtime_disable(ov02c10->dev);
 	if (!pm_runtime_status_suspended(ov02c10->dev)) {
 		ov02c10_power_off(ov02c10->dev);
 		pm_runtime_set_suspended(ov02c10->dev);
 	}
+	v4l2_subdev_cleanup(sd);
+	media_entity_cleanup(&sd->entity);
+	v4l2_ctrl_handler_free(sd->ctrl_handler);
 }
 
 static int ov02c10_probe(struct i2c_client *client)
-- 
2.51.0