Re: [PATCH] mmc: core: Cancel SDIO IRQ work before freeing host

[Ulf Hansson]

On Thu, Aug 6, 2026 at 3:02 PM Fan Wu <fanwu01@xxxxxxxxxx> wrote:
>
> A host controller that uses sdio_signal_irq() schedules host->sdio_irq_work
> from its interrupt handler.  That work is only cancelled on the suspend
> path (mmc_sdio_suspend()), not on the remove/free path, so a worker armed
> just before the controller freed its IRQ can run after
> mmc_host_classdev_release() has freed the host and dereference it through
> container_of().
>
> Cancel host->sdio_irq_work in mmc_free_host(), like the existing
> host->detect drain added by commit 1036f69e2513 ("mmc: core: Cancel
> delayed work before releasing host").
>
> This issue was found by an in-house static analysis tool.
>
> Fixes: 682696605c7093d ("mmc: sdio: Add API to manage SDIO IRQs from a workqueue")
> Cc: stable@xxxxxxxxxxxxxxx
> Assisted-by: Codex:gpt-5.6
> Signed-off-by: Fan Wu <fanwu01@xxxxxxxxxx>

Applied for fixes, thanks!

Kind regards
Uffe


> ---
>  drivers/mmc/core/host.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/drivers/mmc/core/host.c b/drivers/mmc/core/host.c
> index 88c95dbfd9cf..becb5a850a2f 100644
> --- a/drivers/mmc/core/host.c
> +++ b/drivers/mmc/core/host.c
> @@ -693,6 +693,7 @@ EXPORT_SYMBOL(mmc_remove_host);
>  void mmc_free_host(struct mmc_host *host)
>  {
>         cancel_delayed_work_sync(&host->detect);
> +       cancel_work_sync(&host->sdio_irq_work);
>         mmc_pwrseq_free(host);
>         put_device(&host->class_dev);
>  }
> --
> 2.34.1