[PATCH] mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition

[Ulf Hansson]

On Mon, Aug 3, 2026 at 11:48 AM Pei Xiao <xiaopei01 at kylinos.cn> wrote:
>
> In atmci_probe, &host->bh_work is bound with atmci_work_func, and
> atmci_interrupt, atmci_timeout_timer and atmci_dma_complete can all
> queue this work on system_bh_wq.
>
> If we remove the module, atmci_remove makes cleanup and the memory
> allocated for host with devm_kzalloc() is released after the remove
> callback returns, while the work mentioned above may still be pending
> or running. The sequence of operations that may lead to a UAF bug is
> as follows:
>
> CPU0                                      CPU1
>
>                                           | atmci_interrupt
>                                           | queue_work(system_bh_wq,
>                                           |            &host->bh_work)
> atmci_remove                              |
> atmci_cleanup_slot(...)                   |
> atmci_writel(host, ATMCI_IDR, ~0UL)       |
> timer_delete_sync(&host->timer)           |
> dma_release_channel(host->dma.chan)       |
> free_irq(platform_get_irq(pdev, 0), host) |
>                                           | atmci_work_func
>                                           | // use host
> // devm resources released after          |
> // remove returns, host is freed          |
>                                           | // use host (use-after-free)
>
> Fix it by canceling the work after all the sources that can schedule
> it (IRQ handler, timeout timer and DMA completion callback) have been
> stopped, and before proceeding with the remaining cleanup in
> atmci_remove.
>
> Fixes: 7d2be0749a59 ("atmel-mci: Driver for Atmel on-chip MMC controllers")
> Assisted-by: Codex:deepseek-v4-flash
> Signed-off-by: Pei Xiao <xiaopei01 at kylinos.cn>

Applied for fixes and by adding a stable tag, thanks!

Kind regards
Uffe


> ---
>  drivers/mmc/host/atmel-mci.c | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/drivers/mmc/host/atmel-mci.c b/drivers/mmc/host/atmel-mci.c
> index 3b4928f5b9b2..8f4df250a77a 100644
> --- a/drivers/mmc/host/atmel-mci.c
> +++ b/drivers/mmc/host/atmel-mci.c
> @@ -2610,6 +2610,8 @@ static void atmci_remove(struct platform_device *pdev)
>
>         free_irq(platform_get_irq(pdev, 0), host);
>
> +       cancel_work_sync(&host->bh_work);
> +
>         clk_disable_unprepare(host->mck);
>
>         pm_runtime_disable(dev);
> --
> 2.25.1
>