Re: [PATCH] mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition

[Aubin Constans]

On 03/08/2026 11:48, Pei Xiao wrote:

> In atmci_probe, &host->bh_work is bound with atmci_work_func, and> atmci_interrupt, atmci_timeout_timer and atmci_dma_complete can all
> queue this work on system_bh_wq.
>
> If we remove the module, atmci_remove makes cleanup and the memory
> allocated for host with devm_kzalloc() is released after the remove
> callback returns, while the work mentioned above may still be pending
> or running. The sequence of operations that may lead to a UAF bug is
> as follows:

Thank you for having spotted the issue, and sent this fix.
 >
> CPU0                                      CPU1
>
>                                            | atmci_interrupt
>                                            | queue_work(system_bh_wq,
>                                            |            &host->bh_work)
> atmci_remove                              |
> atmci_cleanup_slot(...)                   |
> atmci_writel(host, ATMCI_IDR, ~0UL)       |
> timer_delete_sync(&host->timer)           |
> dma_release_channel(host->dma.chan)       |
> free_irq(platform_get_irq(pdev, 0), host) |
>                                            | atmci_work_func
>                                            | // use host
> // devm resources released after          |
> // remove returns, host is freed          |
>                                            | // use host (use-after-free)
>
> Fix it by canceling the work after all the sources that can schedule
> it (IRQ handler, timeout timer and DMA completion callback) have been
> stopped, and before proceeding with the remaining cleanup in
> atmci_remove.

For completeness, PDC completion could be added to the above list of sources,
even though it is a subroutine of the IRQ handler.
PDC and DMA are exclusive.

Mentioning on which board or MPU the patch was tested would also be a welcome
addition.

> Fixes: 7d2be0749a59 ("atmel-mci: Driver for Atmel on-chip MMC controllers")
> Assisted-by: Codex:deepseek-v4-flash
> Signed-off-by: Pei Xiao <xiaopei01@xxxxxxxxxx>
> ---
>   drivers/mmc/host/atmel-mci.c | 2 ++
>   1 file changed, 2 insertions(+)
>
> diff --git a/drivers/mmc/host/atmel-mci.c b/drivers/mmc/host/atmel-mci.c
> index 3b4928f5b9b2..8f4df250a77a 100644
> --- a/drivers/mmc/host/atmel-mci.c
> +++ b/drivers/mmc/host/atmel-mci.c
> @@ -2610,6 +2610,8 @@ static void atmci_remove(struct platform_device *pdev)
>
>          free_irq(platform_get_irq(pdev, 0), host);
>
> +       cancel_work_sync(&host->bh_work);
> +
>          clk_disable_unprepare(host->mck);
>
>          pm_runtime_disable(dev);
> --
> 2.25.1