[PATCH 2/3] media: wave5: Fix kthread worker destruction in polling mode

[Xulin Sun <xulin.sun@windriver.com>]

Symptom:
  ------------[ cut here ]------------
  WARNING: CPU: 2 PID: 1034 at kernel/kthread.c:1430 kthread_destroy_worker+0x84/0x98
  Modules linked in: wave5(-) rpmsg_ctrl rpmsg_char ...
  Call trace:
   kthread_destroy_worker+0x84/0x98
   wave5_vpu_remove+0xc8/0xe0 [wave5]
   platform_remove+0x30/0x58
  ...
  ---[ end trace 0000000000000000 ]---

Root cause:
  In polling mode (irq < 0), the driver uses hrtimer to periodically
  trigger wave5_vpu_timer_callback() which queues work via
  kthread_queue_work(). The kthread_destroy_worker() function validates
  that both work queues are empty:
  * WARN_ON(!list_empty(&worker->work_list))
  * WARN_ON(!list_empty(&worker->delayed_work_list))

  The original code called kthread_destroy_worker() before hrtimer_cancel(),
  creating a race condition where the timer could fire during worker
  destruction and queue new work, triggering the WARN_ON.

Fix:
  Reorder cleanup sequence:
  1) Cancel hrtimer first - stops the timer from firing and prevents
     new work from being queued
  2) Cancel current work with kthread_cancel_work_sync() - ensures any
     in-flight work completes
  3) Destroy worker - now both work queues are guaranteed empty, so
     kthread_destroy_worker() won't trigger warnings

Signed-off-by: Xulin Sun <xulin.sun@windriver.com>
---
 drivers/media/platform/chips-media/wave5/wave5-vpu.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/media/platform/chips-media/wave5/wave5-vpu.c b/drivers/media/platform/chips-media/wave5/wave5-vpu.c
index 23aa3ab51a0e..0bcd48df49d0 100644
--- a/drivers/media/platform/chips-media/wave5/wave5-vpu.c
+++ b/drivers/media/platform/chips-media/wave5/wave5-vpu.c
@@ -352,8 +352,9 @@ static void wave5_vpu_remove(struct platform_device *pdev)
 	struct vpu_device *dev = dev_get_drvdata(&pdev->dev);
 
 	if (dev->irq < 0) {
-		kthread_destroy_worker(dev->worker);
 		hrtimer_cancel(&dev->hrtimer);
+		kthread_cancel_work_sync(&dev->work);
+		kthread_destroy_worker(dev->worker);
 	}
 
 	pm_runtime_dont_use_autosuspend(&pdev->dev);
-- 
2.49.1