CVE-2026-89875: media: ti: vpe: quiesce overflow recovery before freeing streams

In the Linux kernel, the following vulnerability has been resolved:

media: ti: vpe: quiesce overflow recovery before freeing streams

The VIP overflow recovery worker is armed from the hardirq handler when a FIFO overflow is detected, and the list-complete path looks the stream up through the VPDMA list private pointer. Both keep touching stream, port and device state; the recovery worker also resets the parser and VPDMA, repopulates the descriptor list, and re-enables the per-list IRQs.

vipstopstreaming() masks and clears the per-list IRQs, but it neither synchronizes the hardirq handler nor disables recoverywork. An overflow IRQ that has already queued recoverywork, or a list-complete IRQ in flight when the stream is torn down, can therefore still dereference the stream after its resources are released: the descriptor list is freed by vipreleasestream() on file release, and the stream itself by freestream() on unbind/remove.

Drain the recovery worker and the IRQ handler at both teardown points through a shared vipquiescestream() helper, before any stream-owned resource is released. disableworksync() cancels pending recoverywork, drains a running instance, and raises its disable depth, so a subsequent schedulework() issued by a racing IRQ handler is rejected at the workqueue scheduler: recoverywork cannot be requeued after disableworksync() takes effect. The worker may still re-enable the per-list IRQs before disableworksync() returns; disableirqs() then masks those sources and synchronizeirq() waits for any in-flight handler that still dereferences stream state. In vipstopstreaming() the helper runs before the parser is stopped, since a worker drained by disableworksync() may re-enable the parser before exiting and would otherwise undo the stop. recoverywork is created disabled and enabled in vipstartstreaming() before IRQs, pairing the enable with the teardown disable across the streaming lifecycle.

This issue was found by an in-house static analysis tool and confirmed by manual code review.