Re: [RFC PATCH v2 1/2] mmc: dw_mmc: drain bh_work on host removal

[Shawn Lin <shawn.lin@rock-chips.com>]

在 2026/11/02 星期一 10:29, BeaCox 写道:
> dw_mci_remove() does not drain bh_work before the driver core releases
> the devm-managed host.  The interrupt handler, the fault-injection timer
> and the DMA completion path can queue that work, and its callback
> accesses the host and MMC request state.  A work item that is still
> pending or running after remove returns dereferences freed memory.
> 
> This is not a regression from the tasklet-to-BH-workqueue conversion.
> The tasklet that bh_work replaced was never killed in dw_mci_remove()
> either, going back to the original driver.  Commit 921c87ba3893
> ("mmc: Convert from tasklet to BH workqueue") only replaced
> tasklet_schedule() with queue_work().
> 
> After removing the MMC host and masking controller interrupts, drain
> the interrupt handler and disable the work synchronously.  Disabling
> the work also rejects later queue attempts, unlike cancellation alone.
> Stop the fault-injection timer after the work callback has finished so
> that it cannot rearm the timer after teardown has cancelled it.
> 

Reviewed-by: Shawn Lin <shawn.lin@rock-chips.com>

> Fixes: f95f3850f7a9 ("mmc: dw_mmc: Add Synopsys DesignWare mmc host driver")
> Cc: stable@vger.kernel.org # 6.11+
> Signed-off-by: BeaCox <0xbeac@gmail.com>
> ---
>   drivers/mmc/host/dw_mmc.c | 5 +++++
>   1 file changed, 5 insertions(+)
> 
> diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c
> index ff0b25d..5b47643 100644
> --- a/drivers/mmc/host/dw_mmc.c
> +++ b/drivers/mmc/host/dw_mmc.c
> @@ -3406,6 +3406,11 @@ void dw_mci_remove(struct dw_mci *host)
>   	mci_writel(host, RINTSTS, 0xFFFFFFFF);
>   	mci_writel(host, INTMASK, 0); /* disable all mmc interrupt first */
>   
> +	synchronize_irq(host->irq);
> +	/* Stop the work before the timer that it can rearm. */
> +	disable_work_sync(&host->bh_work);
> +	dw_mci_stop_fault_timer(host);
> +
>   	/* disable clock to CIU */
>   	mci_writel(host, CLKENA, 0);
>   	mci_writel(host, CLKSRC, 0);