CHROMIUM: media: platform: mediatek: isp: Fix imgsys crash issue

Once the user receives the done event, they immediately initialize and
use the media request. However, on the other hand, the kernel has not
released all resources after sending the event. When the user resets
the media request and returns to the kernel to continue with the
incomplete release flow, it leads to accessing released resources,
which causes a crash.

BUG=b:359451218
TEST=emerge-geralt sys-kernel/chromeos-kernel-6_1
UPSTREAM-TASK=b:297128621

Change-Id: Ib694be808ddddba58a30eb53dfe6d0d5a82cff4e
Signed-off-by: Olivia Wen <olivia.wen@mediatek.corp-partner.google.com>
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/third_party/kernel/+/6034177
Reviewed-by: Yunke Cao <yunkec@chromium.org>
Commit-Queue: Harvey Yang <chenghaoyang@chromium.org>
Reviewed-by: Harvey Yang <chenghaoyang@chromium.org>
diff --git a/drivers/media/platform/mediatek/isp/isp_7x/imgsys/mtk_imgsys-sys.c b/drivers/media/platform/mediatek/isp/isp_7x/imgsys/mtk_imgsys-sys.c
index 3b0b00b..334270b 100644
--- a/drivers/media/platform/mediatek/isp/isp_7x/imgsys/mtk_imgsys-sys.c
+++ b/drivers/media/platform/mediatek/isp/isp_7x/imgsys/mtk_imgsys-sys.c
@@ -168,9 +168,9 @@ static void mtk_imgsys_notify(struct mtk_imgsys_request *req, uint64_t frm_owner
 
 	mtk_imgsys_hw_working_buf_free(imgsys_dev, req->working_buf);
 	req->working_buf = NULL;
+	mtk_imgsys_pipe_remove_job(req);
 	if (vbf_state == VB2_BUF_STATE_DONE)
 		mtk_imgsys_pipe_job_finish(req, vbf_state);
-	mtk_imgsys_pipe_remove_job(req);
 
 	wake_up(&imgsys_dev->flushing_waitq);
 	dev_dbg(imgsys_dev->dev,