[PATCH] mmc: atmel-mci: fix PDC bounce buffer use-after-free

[Ulf Hansson]

On Tue, Oct 20, 2026 at 4:08 PM Guanxin Li <bruceli20040604 at gmail.com> wrote:
>
> atmci_remove() currently frees the coherent PDC buffer immediately
> after pm_runtime_get_sync(), before the controller and its interrupt
> handler have been quiesced.
>
> A pending RXBUFF or TXBUFE interrupt can enter atmci_interrupt() after
> the buffer has been freed. For a completed receive transfer,
> atmci_pdc_complete() accesses host->buffer while copying received data
> to the request scatterlist. When data remains, the interrupt handler
> can instead call atmci_pdc_set_both_buf(), which may program
> host->buf_phys_addr back into the PDC and make the PDC access a freed
> coherent allocation.
>
> The buffer must also remain valid while atmci_cleanup_slot() calls
> mmc_remove_host(), since an in-flight request may complete during host
> removal and take the same interrupt paths.
>
> Move dma_free_coherent() after the controller is disabled, the timer
> and IRQ handler are synchronized, and bh_work is canceled. Keep the
> remaining teardown order unchanged so that in-flight requests can
> finish before the buffer is released.
>
> Signed-off-by: Guanxin Li <bruceli20040604 at gmail.com>

Applied for next, thanks!

While at it, I noticed that a similar problem exists in ->probe(). The
dma buffer is allocated *after* mmc_add_host() is called. You may want
to fix that too!?

Kind regards
Uffe


> ---
>  drivers/mmc/host/atmel-mci.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/mmc/host/atmel-mci.c b/drivers/mmc/host/atmel-mci.c
> index 8f4df250a77a..7f1a5864da96 100644
> --- a/drivers/mmc/host/atmel-mci.c
> +++ b/drivers/mmc/host/atmel-mci.c
> @@ -2592,9 +2592,6 @@ static void atmci_remove(struct platform_device *pdev)
>
>         pm_runtime_get_sync(dev);
>
> -       if (host->buffer)
> -               dma_free_coherent(dev, host->buf_size, host->buffer, host->buf_phys_addr);
> -
>         for (i = 0; i < ATMCI_MAX_NR_SLOTS; i++) {
>                 if (host->slot[i])
>                         atmci_cleanup_slot(host->slot[i], i);
> @@ -2612,6 +2609,9 @@ static void atmci_remove(struct platform_device *pdev)
>
>         cancel_work_sync(&host->bh_work);
>
> +       if (host->buffer)
> +               dma_free_coherent(dev, host->buf_size, host->buffer, host->buf_phys_addr);
> +
>         clk_disable_unprepare(host->mck);
>
>         pm_runtime_disable(dev);
> --
> 2.43.0
>