Re: [PATCH] mmc: mmci: Fix use-after-free in busy-timeout work

[Ulf Hansson]

On Fri, Aug 14, 2026 at 10:25 AM Fan Wu <fanwu01@xxxxxxxxxx> wrote:
>
> ux500_busy_complete() can queue ux500_busy_timeout_work for an R1b
> command, but mmci_remove() never cancels it. The work can subsequently
> dereference the devm-allocated mmci_host after it has been released.
>
> Mask the controller interrupts and disable the delayed work during
> removal. This drains any queued instance and stops an IRQ handler that
> is still in progress from queueing the work again once it has been
> disabled.
>
> This issue was found by an in-house static analysis tool.
>
> Fixes: b1a665932dc2 ("mmc: mmci: Add support for SW busy-end timeouts")
> Cc: stable@xxxxxxxxxxxxxxx # v6.10+
> Assisted-by: Codex:gpt-5.6
> Signed-off-by: Fan Wu <fanwu01@xxxxxxxxxx>

Applied for fixes, thanks!

Kind regards
Uffe


> ---
>  drivers/mmc/host/mmci.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/drivers/mmc/host/mmci.c b/drivers/mmc/host/mmci.c
> index e500051bd..416bdb184 100644
> --- a/drivers/mmc/host/mmci.c
> +++ b/drivers/mmc/host/mmci.c
> @@ -2511,6 +2511,9 @@ static void mmci_remove(struct amba_device *dev)
>                 writel(0, host->base + MMCICOMMAND);
>                 writel(0, host->base + MMCIDATACTRL);
>
> +               if (variant->busy_detect)
> +                       disable_delayed_work_sync(&host->ux500_busy_timeout_work);
> +
>                 mmci_dma_release(host);
>                 clk_disable_unprepare(host->clk);
>         }