[GIT PULL] MMC/MEMSTICK fixes for v7.3-rc4

[Ulf Hansson]

Hi Linus,

Here's a pull-request with some MMC fixes intended for v7.3-rc4. Details about
the highlights are as usual found in the signed tag.

Please pull this in!

Kind regards
Ulf Hansson


The following changes since commit cee9395acd8043be0644b25c34bfa86623f2b935:

  Linux 7.3-rc1 (2026-08-30 13:34:40 -0700)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc.git tags/mmc-v7.3-rc1

for you to fetch changes up to 4396d70bb7fec531bcf934fed016b2f3300c670b:

  mmc: sdhci-of-aspeed: Remove children before releasing SDC resources (2026-09-14 12:04:29 +0200)

----------------------------------------------------------------
MMC core:
 - Prevent potential use-after-free for SDIO IRQ work
 - Fix OF node reference leak on card add failure
 - Fix memory lea when the port table is full for sdio_uart

MMC host:
 - hsq: Fix use-after-free in retry work
 - mmci: Fix use-after-free in busy-timeout work
 - mmc_spi: Reset bytes_xfered before retrying CRC failures
 - mxcmmc: Cancel data work and watchdog on remove
 - rtsx_pci_sdmmc: Ignore broken write-protect on ThinkPad X260
 - sdhci_am654: A couple of fixes for the tuning sequence
 - sdhci-of-aspeed: Remove children before releasing SDC resources
 - sh_mmcif: Initialize IRQ-thread mutex before requesting interrupt

MEMSTICK:
 - ms_block: Destroy io_queue workqueue on removal

----------------------------------------------------------------
Diogo Ivo (Schneider Electric) (4):
      mmc: sdhci_am654: Move tuning_loop to local variable
      mmc: sdhci_am654: Reset command and data lines on failed tuning
      mmc: sdhci_am654: Clear ITAPDLY on tuning failure
      mmc: sdhci_am654: Fallback to DT-provided itap delay on DDR50 tuning failure

Fan Wu (4):
      mmc: core: Cancel SDIO IRQ work before freeing host
      mmc: mmci: Fix use-after-free in busy-timeout work
      mmc: mxcmmc: cancel data work and watchdog on remove
      mmc: hsq: Fix use-after-free in retry work

Felix Gu (1):
      mmc: sdio_uart: fix xmit_fifo leak when the port table is full

Florian Maillard (1):
      mmc: rtsx_pci_sdmmc: ignore broken write-protect on ThinkPad X260

Myeonghun Pak (1):
      mmc: sdhci-of-aspeed: Remove children before releasing SDC resources

Runyu Xiao (1):
      mmc: sh_mmcif: initialize IRQ-thread mutex before requesting interrupt

Xu Rao (1):
      mmc: spi: reset bytes_xfered before retrying CRC failures

Yifei Gao (1):
      memstick: ms_block: destroy io_queue workqueue on removal

Zhu Ling (1):
      mmc: core: Fix OF node reference leak on card add failure

 drivers/memstick/core/ms_block.c   |  2 ++
 drivers/mmc/core/bus.c             |  2 +-
 drivers/mmc/core/host.c            |  1 +
 drivers/mmc/core/sdio_uart.c       |  3 +++
 drivers/mmc/host/mmc_hsq.c         |  8 ++++++-
 drivers/mmc/host/mmc_spi.c         |  1 +
 drivers/mmc/host/mmci.c            |  3 +++
 drivers/mmc/host/mxcmmc.c          |  4 ++++
 drivers/mmc/host/rtsx_pci_sdmmc.c  |  5 +++++
 drivers/mmc/host/sdhci-of-aspeed.c |  5 ++++-
 drivers/mmc/host/sdhci_am654.c     | 43 +++++++++++++++++++++++++-------------
 drivers/mmc/host/sh_mmcif.c        |  3 +--
 12 files changed, 60 insertions(+), 20 deletions(-)