[PATCH v2] mmc: wmt-sdmmc: release DMA descriptors after stopping the host

[Guanxin Li <bruceli20040604@gmail.com>]

wmt_mci_remove() currently frees the DMA descriptor buffer before
calling mmc_remove_host() and freeing the controller IRQs. The
controller may still be using the descriptors, and an interrupt
handler may still access them during this window.

Stop the MMC host and free both IRQs before releasing the DMA
buffer to prevent DMA or interrupt accesses to the freed memory
during device removal.

Signed-off-by: Guanxin Li <bruceli20040604@gmail.com>
---
Changes in v2:
- Wrapped commit message lines to comply with the 72-column limit.
- Moved the DMA buffer comment next to dma_free_coherent().

 drivers/mmc/host/wmt-sdmmc.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/mmc/host/wmt-sdmmc.c b/drivers/mmc/host/wmt-sdmmc.c
index 489daee4f4fc..55675aa8d08a 100644
--- a/drivers/mmc/host/wmt-sdmmc.c
+++ b/drivers/mmc/host/wmt-sdmmc.c
@@ -895,15 +895,15 @@ static void wmt_mci_remove(struct platform_device *pdev)
 	writeb(0xFF, priv->sdmmc_base + SDMMC_STS0);
 	writeb(0xFF, priv->sdmmc_base + SDMMC_STS1);
 
-	/* release the dma buffers */
-	dma_free_coherent(&pdev->dev, priv->mmc->max_blk_count * 16,
-			  priv->dma_desc_buffer, priv->dma_desc_device_addr);
-
 	mmc_remove_host(mmc);
 
 	free_irq(priv->irq_regular, priv);
 	free_irq(priv->irq_dma, priv);
 
+	/* release the dma buffers */
+	dma_free_coherent(&pdev->dev, priv->mmc->max_blk_count * 16,
+			  priv->dma_desc_buffer, priv->dma_desc_device_addr);
+
 	iounmap(priv->sdmmc_base);
 
 	clk_disable_unprepare(priv->clk_sdmmc);
-- 
2.43.0