[PATCH] mmc: atmel-mci: fix PDC bounce buffer use-after-free

[PATCH] mmc: atmel-mci: fix PDC bounce buffer use-after-free

[Guanxin Li]

atmci_remove() currently frees the coherent PDC buffer immediately
after pm_runtime_get_sync(), before the controller and its interrupt
handler have been quiesced.

A pending RXBUFF or TXBUFE interrupt can enter atmci_interrupt() after
the buffer has been freed. For a completed receive transfer,
atmci_pdc_complete() accesses host->buffer while copying received data
to the request scatterlist. When data remains, the interrupt handler
can instead call atmci_pdc_set_both_buf(), which may program
host->buf_phys_addr back into the PDC and make the PDC access a freed
coherent allocation.

The buffer must also remain valid while atmci_cleanup_slot() calls
mmc_remove_host(), since an in-flight request may complete during host
removal and take the same interrupt paths.

Move dma_free_coherent() after the controller is disabled, the timer
and IRQ handler are synchronized, and bh_work is canceled. Keep the
remaining teardown order unchanged so that in-flight requests can
finish before the buffer is released.

Signed-off-by: Guanxin Li <bruceli20040604@gmail.com>
---
 drivers/mmc/host/atmel-mci.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/mmc/host/atmel-mci.c b/drivers/mmc/host/atmel-mci.c
index 8f4df250a77a..7f1a5864da96 100644
--- a/drivers/mmc/host/atmel-mci.c
+++ b/drivers/mmc/host/atmel-mci.c
@@ -2592,9 +2592,6 @@ static void atmci_remove(struct platform_device *pdev)
 
 	pm_runtime_get_sync(dev);
 
-	if (host->buffer)
-		dma_free_coherent(dev, host->buf_size, host->buffer, host->buf_phys_addr);
-
 	for (i = 0; i < ATMCI_MAX_NR_SLOTS; i++) {
 		if (host->slot[i])
 			atmci_cleanup_slot(host->slot[i], i);
@@ -2612,6 +2609,9 @@ static void atmci_remove(struct platform_device *pdev)
 
 	cancel_work_sync(&host->bh_work);
 
+	if (host->buffer)
+		dma_free_coherent(dev, host->buf_size, host->buffer, host->buf_phys_addr);
+
 	clk_disable_unprepare(host->mck);
 
 	pm_runtime_disable(dev);
-- 
2.43.0