Claude review: media: meson: vdec: Handle kthread failure and free codec state

[Claude Code Review Bot <claude-review@example.com>]

Patch Review

**Bug — double free of `sess->priv`:**
```c
err_cleanup:
	vdec_free_canvas(sess);
	vdec_poweroff(sess);
	if (codec_ops && codec_ops->stop && sess->priv) {
		codec_ops->stop(sess);
		kfree(sess->priv);
		sess->priv = NULL;
	}
```

`vdec_poweroff()` calls `vdec_ops->stop(sess)` (i.e., `vdec_1_stop` or `vdec_hevc_stop`). Looking at the existing code in `vdec_1.c:160-162`:
```c
if (sess->priv)
    codec_ops->stop(sess);
```
So `vdec_poweroff()` → `vdec_ops->stop()` already calls `codec_ops->stop()`. Then the error path calls `codec_ops->stop(sess)` again. The codec stop functions (e.g., `codec_h264_stop`, `codec_vp9_stop`) free internal DMA allocations tracked in `sess->priv` — calling it twice leads to double-free of those DMA buffers. After that, the explicit `kfree(sess->priv)` is yet another issue: the codec's own stop function does NOT free `sess->priv` itself (the normal teardown path in `vdec_stop_streaming` does `kfree(sess->priv)`), but this second `codec_ops->stop()` will operate on already-freed internal state.

**The fix should be:** remove the `codec_ops->stop()` call from `err_cleanup` since `vdec_poweroff()` already handles it, and just do:
```c
err_cleanup:
	vdec_poweroff(sess);
	vdec_free_canvas(sess);
	kfree(sess->priv);
	sess->priv = NULL;
```

**Also note:** `vdec_free_canvas()` is called before `vdec_poweroff()`, but in `vdec_stop_streaming()` the order is `vdec_poweroff()` then `vdec_free_canvas()`. The ordering should be consistent — power off first, then free resources.

**Good:** Adding `IS_ERR()` check for `kthread_run()` is a genuine fix.

**Good:** The `sess->vififo_vaddr = NULL` guard and the `vififo_vaddr` check in `vdec_stop_streaming` are defensive but reasonable.

---
Generated by Claude Code Patch Reviewer