[PATCH v2] mmc: wmt-sdmmc: release DMA descriptors after stopping the host

[Ulf Hansson]

On Mon, Oct 19, 2026 at 4:33 PM Guanxin Li <bruceli20040604 at gmail.com> wrote:
>
> wmt_mci_remove() currently frees the DMA descriptor buffer before
> calling mmc_remove_host() and freeing the controller IRQs. The
> controller may still be using the descriptors, and an interrupt
> handler may still access them during this window.
>
> Stop the MMC host and free both IRQs before releasing the DMA
> buffer to prevent DMA or interrupt accesses to the freed memory
> during device removal.
>
> Signed-off-by: Guanxin Li <bruceli20040604 at gmail.com>

Applied for next, thanks!

Kind regards
Uffe


> ---
> Changes in v2:
> - Wrapped commit message lines to comply with the 72-column limit.
> - Moved the DMA buffer comment next to dma_free_coherent().
>
>  drivers/mmc/host/wmt-sdmmc.c | 8 ++++----
>  1 file changed, 4 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/mmc/host/wmt-sdmmc.c b/drivers/mmc/host/wmt-sdmmc.c
> index 489daee4f4fc..55675aa8d08a 100644
> --- a/drivers/mmc/host/wmt-sdmmc.c
> +++ b/drivers/mmc/host/wmt-sdmmc.c
> @@ -895,15 +895,15 @@ static void wmt_mci_remove(struct platform_device *pdev)
>         writeb(0xFF, priv->sdmmc_base + SDMMC_STS0);
>         writeb(0xFF, priv->sdmmc_base + SDMMC_STS1);
>
> -       /* release the dma buffers */
> -       dma_free_coherent(&pdev->dev, priv->mmc->max_blk_count * 16,
> -                         priv->dma_desc_buffer, priv->dma_desc_device_addr);
> -
>         mmc_remove_host(mmc);
>
>         free_irq(priv->irq_regular, priv);
>         free_irq(priv->irq_dma, priv);
>
> +       /* release the dma buffers */
> +       dma_free_coherent(&pdev->dev, priv->mmc->max_blk_count * 16,
> +                         priv->dma_desc_buffer, priv->dma_desc_device_addr);
> +
>         iounmap(priv->sdmmc_base);
>
>         clk_disable_unprepare(priv->clk_sdmmc);
> --
> 2.43.0
>