[RFC PATCH v2 1/2] mmc: dw_mmc: drain bh_work on host removal

[BeaCox <0xbeac@gmail.com>]

dw_mci_remove() does not drain bh_work before the driver core releases
the devm-managed host.  The interrupt handler, the fault-injection timer
and the DMA completion path can queue that work, and its callback
accesses the host and MMC request state.  A work item that is still
pending or running after remove returns dereferences freed memory.

This is not a regression from the tasklet-to-BH-workqueue conversion.
The tasklet that bh_work replaced was never killed in dw_mci_remove()
either, going back to the original driver.  Commit 921c87ba3893
("mmc: Convert from tasklet to BH workqueue") only replaced
tasklet_schedule() with queue_work().

After removing the MMC host and masking controller interrupts, drain
the interrupt handler and disable the work synchronously.  Disabling
the work also rejects later queue attempts, unlike cancellation alone.
Stop the fault-injection timer after the work callback has finished so
that it cannot rearm the timer after teardown has cancelled it.

Fixes: f95f3850f7a9 ("mmc: dw_mmc: Add Synopsys DesignWare mmc host driver")
Cc: stable@vger.kernel.org # 6.11+
Signed-off-by: BeaCox <0xbeac@gmail.com>
---
 drivers/mmc/host/dw_mmc.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c
index ff0b25d..5b47643 100644
--- a/drivers/mmc/host/dw_mmc.c
+++ b/drivers/mmc/host/dw_mmc.c
@@ -3406,6 +3406,11 @@ void dw_mci_remove(struct dw_mci *host)
 	mci_writel(host, RINTSTS, 0xFFFFFFFF);
 	mci_writel(host, INTMASK, 0); /* disable all mmc interrupt first */
 
+	synchronize_irq(host->irq);
+	/* Stop the work before the timer that it can rearm. */
+	disable_work_sync(&host->bh_work);
+	dw_mci_stop_fault_timer(host);
+
 	/* disable clock to CIU */
 	mci_writel(host, CLKENA, 0);
 	mci_writel(host, CLKSRC, 0);
-- 
2.43.0