[PATCH 0/2] mmc: core: Avoid export of mmc_alloc|free_host()

[PATCH 0/2] mmc: core: Avoid export of mmc_alloc|free_host()

[Ulf Hansson]

From: Ulf Hansson <ulfh@kernel.org>

The only remaining user of mmc_alloc|free_host() is the greybus sdio driver.
Let's convert it into using the resource managed variant so we can drop the
export of mmc_alloc|free_host().

Ulf Hansson (2):
  staging: greybus: sdio: Convert to devm_mmc_alloc_host()
  mmc: core: Turn mmc_alloc|free_host() into static functions

 drivers/mmc/core/host.c        | 35 +++++++++-------------------------
 drivers/staging/greybus/sdio.c | 11 +++--------
 include/linux/mmc/host.h       |  2 --
 3 files changed, 12 insertions(+), 36 deletions(-)

-- 
2.43.0

[PATCH 1/2] staging: greybus: sdio: Convert to devm_mmc_alloc_host()

[Ulf Hansson]

From: Ulf Hansson <ulfh@kernel.org>

Simplify the code by converting from mmc_alloc_host() to the resource
managed devm_mmc_alloc_host().

Signed-off-by: Ulf Hansson <ulfh@kernel.org>
---
 drivers/staging/greybus/sdio.c | 11 +++--------
 1 file changed, 3 insertions(+), 8 deletions(-)

diff --git a/drivers/staging/greybus/sdio.c b/drivers/staging/greybus/sdio.c
index 3952f3d225db..642d785fe918 100644
--- a/drivers/staging/greybus/sdio.c
+++ b/drivers/staging/greybus/sdio.c
@@ -767,17 +767,15 @@ static int gb_sdio_probe(struct gbphy_device *gbphy_dev,
 	struct gb_sdio_host *host;
 	int ret = 0;
 
-	mmc = mmc_alloc_host(sizeof(*host), &gbphy_dev->dev);
+	mmc = devm_mmc_alloc_host(&gbphy_dev->dev, sizeof(*host));
 	if (!mmc)
 		return -ENOMEM;
 
 	connection = gb_connection_create(gbphy_dev->bundle,
 					  le16_to_cpu(gbphy_dev->cport_desc->id),
 					  gb_sdio_request_handler);
-	if (IS_ERR(connection)) {
-		ret = PTR_ERR(connection);
-		goto exit_mmc_free;
-	}
+	if (IS_ERR(connection))
+		return PTR_ERR(connection);
 
 	host = mmc_priv(mmc);
 	host->mmc = mmc;
@@ -835,8 +833,6 @@ static int gb_sdio_probe(struct gbphy_device *gbphy_dev,
 	gb_connection_disable(connection);
 exit_connection_destroy:
 	gb_connection_destroy(connection);
-exit_mmc_free:
-	mmc_free_host(mmc);
 
 	return ret;
 }
@@ -863,7 +859,6 @@ static void gb_sdio_remove(struct gbphy_device *gbphy_dev)
 	mmc_remove_host(mmc);
 	gb_connection_disable(connection);
 	gb_connection_destroy(connection);
-	mmc_free_host(mmc);
 }
 
 static const struct gbphy_device_id gb_sdio_id_table[] = {
-- 
2.43.0

[PATCH 2/2] mmc: core: Turn mmc_alloc|free_host() into static functions

[Ulf Hansson]

From: Ulf Hansson <ulfh@kernel.org>

As there are no longer any users of these functions, let's make them
internal to the mmc core. While at it, let's also flip the order of the
in-parameters to mmc_alloc_host() to be consistent with devm_alloc_host().

Signed-off-by: Ulf Hansson <ulfh@kernel.org>
---
 drivers/mmc/core/host.c  | 35 +++++++++--------------------------
 include/linux/mmc/host.h |  2 --
 2 files changed, 9 insertions(+), 28 deletions(-)

diff --git a/drivers/mmc/core/host.c b/drivers/mmc/core/host.c
index 1bcf0e917b59..8e9e61839198 100644
--- a/drivers/mmc/core/host.c
+++ b/drivers/mmc/core/host.c
@@ -505,14 +505,7 @@ static int mmc_first_nonreserved_index(void)
 	return max + 1;
 }
 
-/**
- *	mmc_alloc_host - initialise the per-host structure.
- *	@extra: sizeof private data structure
- *	@dev: pointer to host device model structure
- *
- *	Initialise the per-host structure.
- */
-struct mmc_host *mmc_alloc_host(int extra, struct device *dev)
+static struct mmc_host *mmc_alloc_host(struct device *dev, int extra)
 {
 	int index;
 	struct mmc_host *host;
@@ -583,7 +576,13 @@ struct mmc_host *mmc_alloc_host(int extra, struct device *dev)
 	return host;
 }
 
-EXPORT_SYMBOL(mmc_alloc_host);
+static void mmc_free_host(struct mmc_host *host)
+{
+	cancel_delayed_work_sync(&host->detect);
+	cancel_work_sync(&host->sdio_irq_work);
+	mmc_pwrseq_free(host);
+	put_device(&host->class_dev);
+}
 
 static void devm_mmc_host_release(struct device *dev, void *res)
 {
@@ -598,7 +597,7 @@ struct mmc_host *devm_mmc_alloc_host(struct device *dev, int extra)
 	if (!dr)
 		return NULL;
 
-	host = mmc_alloc_host(extra, dev);
+	host = mmc_alloc_host(dev, extra);
 	if (!host) {
 		devres_free(dr);
 		return NULL;
@@ -692,19 +691,3 @@ void mmc_remove_host(struct mmc_host *host)
 }
 
 EXPORT_SYMBOL(mmc_remove_host);
-
-/**
- *	mmc_free_host - free the host structure
- *	@host: mmc host
- *
- *	Free the host once all references to it have been dropped.
- */
-void mmc_free_host(struct mmc_host *host)
-{
-	cancel_delayed_work_sync(&host->detect);
-	cancel_work_sync(&host->sdio_irq_work);
-	mmc_pwrseq_free(host);
-	put_device(&host->class_dev);
-}
-
-EXPORT_SYMBOL(mmc_free_host);
diff --git a/include/linux/mmc/host.h b/include/linux/mmc/host.h
index ddb32bc2946f..198554e48346 100644
--- a/include/linux/mmc/host.h
+++ b/include/linux/mmc/host.h
@@ -585,11 +585,9 @@ struct mmc_host {
 
 struct device_node;
 
-struct mmc_host *mmc_alloc_host(int extra, struct device *);
 struct mmc_host *devm_mmc_alloc_host(struct device *dev, int extra);
 int mmc_add_host(struct mmc_host *);
 void mmc_remove_host(struct mmc_host *);
-void mmc_free_host(struct mmc_host *);
 void mmc_of_parse_clk_phase(struct device *dev,
 			    struct mmc_clk_phase_map *map);
 int mmc_of_parse(struct mmc_host *host);
-- 
2.43.0

Re: [PATCH 1/2] staging: greybus: sdio: Convert to devm_mmc_alloc_host()

[Rui Miguel Silva]

Hey Ulf,
Thanks for the patch.

On Tue Sep 15, 2026 at 2:20 PM WEST, Ulf Hansson wrote:

> From: Ulf Hansson <ulfh@kernel.org>
>
> Simplify the code by converting from mmc_alloc_host() to the resource
> managed devm_mmc_alloc_host().
>
> Signed-off-by: Ulf Hansson <ulfh@kernel.org>

LGTM,

Acked-by: Rui Miguel Silva <rui.silva@linaro.org>

Cheers,
    Rui
> ---
>  drivers/staging/greybus/sdio.c | 11 +++--------
>  1 file changed, 3 insertions(+), 8 deletions(-)
>
> diff --git a/drivers/staging/greybus/sdio.c b/drivers/staging/greybus/sdio.c
> index 3952f3d225db..642d785fe918 100644
> --- a/drivers/staging/greybus/sdio.c
> +++ b/drivers/staging/greybus/sdio.c
> @@ -767,17 +767,15 @@ static int gb_sdio_probe(struct gbphy_device *gbphy_dev,
>  	struct gb_sdio_host *host;
>  	int ret = 0;
>  
> -	mmc = mmc_alloc_host(sizeof(*host), &gbphy_dev->dev);
> +	mmc = devm_mmc_alloc_host(&gbphy_dev->dev, sizeof(*host));
>  	if (!mmc)
>  		return -ENOMEM;
>  
>  	connection = gb_connection_create(gbphy_dev->bundle,
>  					  le16_to_cpu(gbphy_dev->cport_desc->id),
>  					  gb_sdio_request_handler);
> -	if (IS_ERR(connection)) {
> -		ret = PTR_ERR(connection);
> -		goto exit_mmc_free;
> -	}
> +	if (IS_ERR(connection))
> +		return PTR_ERR(connection);
>  
>  	host = mmc_priv(mmc);
>  	host->mmc = mmc;
> @@ -835,8 +833,6 @@ static int gb_sdio_probe(struct gbphy_device *gbphy_dev,
>  	gb_connection_disable(connection);
>  exit_connection_destroy:
>  	gb_connection_destroy(connection);
> -exit_mmc_free:
> -	mmc_free_host(mmc);
>  
>  	return ret;
>  }
> @@ -863,7 +859,6 @@ static void gb_sdio_remove(struct gbphy_device *gbphy_dev)
>  	mmc_remove_host(mmc);
>  	gb_connection_disable(connection);
>  	gb_connection_destroy(connection);
> -	mmc_free_host(mmc);
>  }
>  
>  static const struct gbphy_device_id gb_sdio_id_table[] = {
> -- 
> 2.43.0

Re: [PATCH 2/2] mmc: core: Turn mmc_alloc|free_host() into static functions

[Shawn Lin]

在 2026/09/15 星期二 21:20, Ulf Hansson 写道:
> From: Ulf Hansson <ulfh@kernel.org>
> 
> As there are no longer any users of these functions, let's make them
> internal to the mmc core. While at it, let's also flip the order of the
> in-parameters to mmc_alloc_host() to be consistent with devm_alloc_host().
> 

Nice move when vub300 was gone,

Reviewed-by: Shawn Lin <shawn.lin@linux.dev>

> Signed-off-by: Ulf Hansson <ulfh@kernel.org>
> ---
>   drivers/mmc/core/host.c  | 35 +++++++++--------------------------
>   include/linux/mmc/host.h |  2 --
>   2 files changed, 9 insertions(+), 28 deletions(-)
> 
> diff --git a/drivers/mmc/core/host.c b/drivers/mmc/core/host.c
> index 1bcf0e917b59..8e9e61839198 100644
> --- a/drivers/mmc/core/host.c
> +++ b/drivers/mmc/core/host.c
> @@ -505,14 +505,7 @@ static int mmc_first_nonreserved_index(void)
>   	return max + 1;
>   }
>   
> -/**
> - *	mmc_alloc_host - initialise the per-host structure.
> - *	@extra: sizeof private data structure
> - *	@dev: pointer to host device model structure
> - *
> - *	Initialise the per-host structure.
> - */
> -struct mmc_host *mmc_alloc_host(int extra, struct device *dev)
> +static struct mmc_host *mmc_alloc_host(struct device *dev, int extra)
>   {
>   	int index;
>   	struct mmc_host *host;
> @@ -583,7 +576,13 @@ struct mmc_host *mmc_alloc_host(int extra, struct device *dev)
>   	return host;
>   }
>   
> -EXPORT_SYMBOL(mmc_alloc_host);
> +static void mmc_free_host(struct mmc_host *host)
> +{
> +	cancel_delayed_work_sync(&host->detect);
> +	cancel_work_sync(&host->sdio_irq_work);
> +	mmc_pwrseq_free(host);
> +	put_device(&host->class_dev);
> +}
>   
>   static void devm_mmc_host_release(struct device *dev, void *res)
>   {
> @@ -598,7 +597,7 @@ struct mmc_host *devm_mmc_alloc_host(struct device *dev, int extra)
>   	if (!dr)
>   		return NULL;
>   
> -	host = mmc_alloc_host(extra, dev);
> +	host = mmc_alloc_host(dev, extra);
>   	if (!host) {
>   		devres_free(dr);
>   		return NULL;
> @@ -692,19 +691,3 @@ void mmc_remove_host(struct mmc_host *host)
>   }
>   
>   EXPORT_SYMBOL(mmc_remove_host);
> -
> -/**
> - *	mmc_free_host - free the host structure
> - *	@host: mmc host
> - *
> - *	Free the host once all references to it have been dropped.
> - */
> -void mmc_free_host(struct mmc_host *host)
> -{
> -	cancel_delayed_work_sync(&host->detect);
> -	cancel_work_sync(&host->sdio_irq_work);
> -	mmc_pwrseq_free(host);
> -	put_device(&host->class_dev);
> -}
> -
> -EXPORT_SYMBOL(mmc_free_host);
> diff --git a/include/linux/mmc/host.h b/include/linux/mmc/host.h
> index ddb32bc2946f..198554e48346 100644
> --- a/include/linux/mmc/host.h
> +++ b/include/linux/mmc/host.h
> @@ -585,11 +585,9 @@ struct mmc_host {
>   
>   struct device_node;
>   
> -struct mmc_host *mmc_alloc_host(int extra, struct device *);
>   struct mmc_host *devm_mmc_alloc_host(struct device *dev, int extra);
>   int mmc_add_host(struct mmc_host *);
>   void mmc_remove_host(struct mmc_host *);
> -void mmc_free_host(struct mmc_host *);
>   void mmc_of_parse_clk_phase(struct device *dev,
>   			    struct mmc_clk_phase_map *map);
>   int mmc_of_parse(struct mmc_host *host);

Re: [PATCH 1/2] staging: greybus: sdio: Convert to devm_mmc_alloc_host()

[Greg Kroah-Hartman]

On Tue, Sep 15, 2026 at 03:20:45PM +0200, Ulf Hansson wrote:
> From: Ulf Hansson <ulfh@kernel.org>
> 
> Simplify the code by converting from mmc_alloc_host() to the resource
> managed devm_mmc_alloc_host().
> 
> Signed-off-by: Ulf Hansson <ulfh@kernel.org>
> ---
>  drivers/staging/greybus/sdio.c | 11 +++--------
>  1 file changed, 3 insertions(+), 8 deletions(-)

Acked-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Re: [PATCH 2/2] mmc: core: Turn mmc_alloc|free_host() into static functions

[Johan Hovold]

On Tue, Sep 15, 2026 at 03:20:46PM +0200, Ulf Hansson wrote:
> From: Ulf Hansson <ulfh@kernel.org>
> 
> As there are no longer any users of these functions, let's make them
> internal to the mmc core. 

Why would you want to do that? The devres helpers should just be simple
wrappers around these and sometimes devres just isn't a good fit.

Especially with the work cancellations present in mmc_free_host() (which
I have pointed out elsewhere should not be there), a driver may need to
free the host before tearing down other non-devres managed resources
during unbind.

This may even be needed for greybus which currently destroys the
connection before freeing the host.

I suggest you just keep the non-devres interface around (after updating
the prototype).

> While at it, let's also flip the order of the
> in-parameters to mmc_alloc_host() to be consistent with devm_alloc_host().

Johan

Re: [PATCH 2/2] mmc: core: Turn mmc_alloc|free_host() into static functions

[Ulf Hansson]

On Wed, Sep 16, 2026 at 9:43 AM Johan Hovold <johan@kernel.org> wrote:
>
> On Tue, Sep 15, 2026 at 03:20:46PM +0200, Ulf Hansson wrote:
> > From: Ulf Hansson <ulfh@kernel.org>
> >
> > As there are no longer any users of these functions, let's make them
> > internal to the mmc core.
>
> Why would you want to do that? The devres helpers should just be simple
> wrappers around these and sometimes devres just isn't a good fit.

At the moment there seems to be no need for them. I would rather keep
API/interfaces as simple as possible, so I prefer to remove them at
this point.

If we see a need for them, we can always add them back.

>
> Especially with the work cancellations present in mmc_free_host() (which
> I have pointed out elsewhere should not be there), a driver may need to
> free the host before tearing down other non-devres managed resources
> during unbind.

Can you please point me to such an example so I can try to understand better?

>
> This may even be needed for greybus which currently destroys the
> connection before freeing the host.

I looked closer at gb_sdio_remove() (the greybus sdio driver's
->remove() callback) and I think the problem isn't about freeing the
host.

Instead it seems like the call to mmc_remove_host() is done too late.
To me it looks like when the mmc core tries to power off the card
gracefully, through mmc_remove_host() the driver has already moved
into a state where it no longer accepts any requests.

>
> I suggest you just keep the non-devres interface around (after updating
> the prototype).
>
> > While at it, let's also flip the order of the
> > in-parameters to mmc_alloc_host() to be consistent with devm_alloc_host().
>
> Johan

Kind regards
Uffe

Re: [PATCH 2/2] mmc: core: Turn mmc_alloc|free_host() into static functions

[Johan Hovold]

On Wed, Sep 16, 2026 at 11:36:25AM +0200, Ulf Hansson wrote:
> On Wed, Sep 16, 2026 at 9:43 AM Johan Hovold <johan@kernel.org> wrote:
> >
> > On Tue, Sep 15, 2026 at 03:20:46PM +0200, Ulf Hansson wrote:
> > > From: Ulf Hansson <ulfh@kernel.org>
> > >
> > > As there are no longer any users of these functions, let's make them
> > > internal to the mmc core.
> >
> > Why would you want to do that? The devres helpers should just be simple
> > wrappers around these and sometimes devres just isn't a good fit.
> 
> At the moment there seems to be no need for them. I would rather keep
> API/interfaces as simple as possible, so I prefer to remove them at
> this point.
> 
> If we see a need for them, we can always add them back.

Devres generally only works when all resources are device managed.
Therefore you should always provide the underlying non-devres manages
interface as well so that you don't force devres on drivers where it
could cause trouble.
 
> > Especially with the work cancellations present in mmc_free_host() (which
> > I have pointed out elsewhere should not be there), a driver may need to
> > free the host before tearing down other non-devres managed resources
> > during unbind.
> 
> Can you please point me to such an example so I can try to understand better?

We just discussed the renesas driver which can schedule rescan work
before registering the host controller. [1]

If such a driver also has non-devres managed resources that are freed
before the work is cancelled you have a use-after-free.

> > This may even be needed for greybus which currently destroys the
> > connection before freeing the host.
> 
> I looked closer at gb_sdio_remove() (the greybus sdio driver's
> ->remove() callback) and I think the problem isn't about freeing the
> host.
> 
> Instead it seems like the call to mmc_remove_host() is done too late.
> To me it looks like when the mmc core tries to power off the card
> gracefully, through mmc_remove_host() the driver has already moved
> into a state where it no longer accepts any requests.

Yes, that looks wrong, but that's a separate issue.

I only pointed at greybus as an example of a driver which has non-devres
managed resources. If there is (rescan) work still scheduled after
probe() or remove() returns, there's a potential use-after-free.

Johan


[1] https://lore.kernel.org/lkml/ap7CaVj82BJZgjf6@hovoldconsulting.com/