[RFC PATCH v2 2/2] mmc: dw_mmc: cancel the watchdog timer on remove

From: BeaCox

Date: Sun Nov 01 2026 - 21:29:48 EST


The central watchdog added for command and data timeout handling is
armed while a request is in flight and is only stopped when the
completion is delivered. If the host is removed with a request still
in flight, the timer can expire after the controller has been disabled
and its callback reads the controller registers and the host state.

Cancel the timer after bh_work has been disabled, so that a work item
that is still running cannot rearm it after the cancellation.

Fixes: ce0043b9a302 ("mmc: dw_mmc: add central watchdog and convert CTO onto it")
Signed-off-by: BeaCox <0xbeac@xxxxxxxxx>
---
drivers/mmc/host/dw_mmc.c | 1 +
1 file changed, 1 insertion(+)

diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c
index 5b47643..dc3beab 100644
--- a/drivers/mmc/host/dw_mmc.c
+++ b/drivers/mmc/host/dw_mmc.c
@@ -3410,6 +3410,7 @@ void dw_mci_remove(struct dw_mci *host)
/* Stop the work before the timer that it can rearm. */
disable_work_sync(&host->bh_work);
dw_mci_stop_fault_timer(host);
+ hrtimer_cancel(&host->wd_timer);

/* disable clock to CIU */
mci_writel(host, CLKENA, 0);
--
2.43.0