[RFC PATCH v2 0/2] mmc: dw_mmc: fix teardown races on remove

[BeaCox]

This splits the dw_mci_remove() teardown fix in two, because the two
objects have different lifetimes.

1/2 drains bh_work.  The race predates the BH workqueue conversion: the
tasklet that it replaced was never killed in dw_mci_remove() either,
going back to the original driver, and commit 921c87ba3893 ("mmc:
Convert from tasklet to BH workqueue") only replaced tasklet_schedule()
with queue_work().  The patch therefore applies to 6.11 and later,
where the bh_work form exists.

2/2 cancels the central watchdog timer, which is new in 7.4
(ce0043b9a302), after the work has been disabled so that a work item
that is still running cannot rearm it.

v1 incorrectly used 921c87ba3893 as the Fixes tag; thanks to Shawn Lin
for pointing out that it did not introduce the race.  The code is
otherwise unchanged.

Testing is still limited to W=1 object builds and a userspace lifecycle
model; no hardware was available.

BeaCox (2):
  mmc: dw_mmc: drain bh_work on host removal
  mmc: dw_mmc: cancel the watchdog timer on remove

 drivers/mmc/host/dw_mmc.c | 6 ++++++
 1 file changed, 6 insertions(+)

-- 
2.43.0