Claude review: media: meson: vdec: Fix NULL pointer dereference in ISR handlers

[Claude Code Review Bot <claude-review@example.com>]

Patch Review

**Incomplete fix — READ_ONCE without WRITE_ONCE:** The patch uses `READ_ONCE()` on the read side:
```c
sess = READ_ONCE(core->cur_sess);
```
But the writes to `core->cur_sess` in patches 2 and 5 are plain stores protected by a mutex:
```c
core->cur_sess = sess;   /* in start_streaming */
core->cur_sess = NULL;   /* in stop_streaming */
```
For `READ_ONCE()` to be meaningful, the matching writes should use `WRITE_ONCE()`. Without it, the compiler could still tear the write, though in practice pointer writes on ARM64 are atomic. Still, for correctness, `WRITE_ONCE()` should be added to the write side.

**Insufficient fix — TOCTOU on session fields:** Even with the NULL check, there's a race:
```c
sess = READ_ONCE(core->cur_sess);
if (!sess)
    return IRQ_NONE;
/* sess could be freed right here by stop_streaming */
sess->last_irq_jiffies = get_jiffies_64();
```
After the NULL check, `stop_streaming` can still run, clear `cur_sess`, and proceed to free session resources. The session pointer obtained by READ_ONCE is not pinned. This requires either:
- Disabling interrupts during teardown (`disable_irq()` before clearing `cur_sess`), or
- Using RCU to protect the session pointer, or
- Some other synchronization.

The IRQ is registered with `IRQF_ONESHOT` and uses a threaded handler, so `disable_irq_nosync()` / `synchronize_irq()` before clearing `cur_sess` would be the typical kernel pattern.

**Unnecessary variable:** The `ret` variable in `vdec_isr`:
```c
irqreturn_t ret = IRQ_HANDLED;
...
ret = sess->fmt_out->codec_ops->isr(sess);
return ret;
```
The initial assignment `ret = IRQ_HANDLED` is dead code since `ret` is unconditionally overwritten. Just return the call result directly.

---
Generated by Claude Code Patch Reviewer