[PATCH] mmc: wmt-sdmmc: release DMA descriptors after stopping the host

[PATCH] mmc: wmt-sdmmc: release DMA descriptors after stopping the host

[Guanxin Li]

wmt_mci_remove() currently frees the DMA descriptor buffer before calling
mmc_remove_host() and freeing the controller IRQs. The controller may still
be using the descriptors, and an interrupt handler may still access them
during this window.

Stop the MMC host and free both IRQs before releasing the DMA buffer to
prevent DMA or interrupt accesses to the freed memory during device removal.

Signed-off-by: Guanxin Li <bruceli20040604@gmail.com>
---
 drivers/mmc/host/wmt-sdmmc.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/mmc/host/wmt-sdmmc.c b/drivers/mmc/host/wmt-sdmmc.c
index 489daee4f4fc..c44befabc909 100644
--- a/drivers/mmc/host/wmt-sdmmc.c
+++ b/drivers/mmc/host/wmt-sdmmc.c
@@ -896,14 +896,14 @@ static void wmt_mci_remove(struct platform_device *pdev)
 	writeb(0xFF, priv->sdmmc_base + SDMMC_STS1);
 
 	/* release the dma buffers */
-	dma_free_coherent(&pdev->dev, priv->mmc->max_blk_count * 16,
-			  priv->dma_desc_buffer, priv->dma_desc_device_addr);
+
 
 	mmc_remove_host(mmc);
 
 	free_irq(priv->irq_regular, priv);
 	free_irq(priv->irq_dma, priv);
-
+	dma_free_coherent(&pdev->dev, priv->mmc->max_blk_count * 16,
+			  priv->dma_desc_buffer, priv->dma_desc_device_addr);
 	iounmap(priv->sdmmc_base);
 
 	clk_disable_unprepare(priv->clk_sdmmc);
-- 
2.43.0

Re: [PATCH] mmc: wmt-sdmmc: release DMA descriptors after stopping the host

[Alexey Charkov]

On Mon, Oct 19, 2026 at 5:53 PM Guanxin Li <bruceli20040604@gmail.com> wrote:
>
> wmt_mci_remove() currently frees the DMA descriptor buffer before calling
> mmc_remove_host() and freeing the controller IRQs. The controller may still
> be using the descriptors, and an interrupt handler may still access them
> during this window.
>
> Stop the MMC host and free both IRQs before releasing the DMA buffer to
> prevent DMA or interrupt accesses to the freed memory during device removal.
>
> Signed-off-by: Guanxin Li <bruceli20040604@gmail.com>
> ---
>  drivers/mmc/host/wmt-sdmmc.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/mmc/host/wmt-sdmmc.c b/drivers/mmc/host/wmt-sdmmc.c
> index 489daee4f4fc..c44befabc909 100644
> --- a/drivers/mmc/host/wmt-sdmmc.c
> +++ b/drivers/mmc/host/wmt-sdmmc.c
> @@ -896,14 +896,14 @@ static void wmt_mci_remove(struct platform_device *pdev)
>         writeb(0xFF, priv->sdmmc_base + SDMMC_STS1);
>
>         /* release the dma buffers */
> -       dma_free_coherent(&pdev->dev, priv->mmc->max_blk_count * 16,
> -                         priv->dma_desc_buffer, priv->dma_desc_device_addr);
> +

If you are moving the function call, please move the comment too (or
better yet delete it altogether, as it doesn't add much information).
And no double blank lines please.

>         mmc_remove_host(mmc);
>
>         free_irq(priv->irq_regular, priv);
>         free_irq(priv->irq_dma, priv);
> -
> +       dma_free_coherent(&pdev->dev, priv->mmc->max_blk_count * 16,
> +                         priv->dma_desc_buffer, priv->dma_desc_device_addr);
>         iounmap(priv->sdmmc_base);
>
>         clk_disable_unprepare(priv->clk_sdmmc);

Other than the above,

Reviewed-by: Alexey Charkov <alchark@gmail.com>

Best regards,
Alexey