[PATCH] mmc: wmt-sdmmc: release DMA descriptors after stopping the host

[Guanxin Li]

wmt_mci_remove() currently frees the DMA descriptor buffer before calling
mmc_remove_host() and freeing the controller IRQs. The controller may still
be using the descriptors, and an interrupt handler may still access them
during this window.

Stop the MMC host and free both IRQs before releasing the DMA buffer to
prevent DMA or interrupt accesses to the freed memory during device removal.

Signed-off-by: Guanxin Li <bruceli20040604@xxxxxxxxx>
---
 drivers/mmc/host/wmt-sdmmc.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/mmc/host/wmt-sdmmc.c b/drivers/mmc/host/wmt-sdmmc.c
index 489daee4f4fc..c44befabc909 100644
--- a/drivers/mmc/host/wmt-sdmmc.c
+++ b/drivers/mmc/host/wmt-sdmmc.c
@@ -896,14 +896,14 @@ static void wmt_mci_remove(struct platform_device *pdev)
 	writeb(0xFF, priv->sdmmc_base + SDMMC_STS1);
 
 	/* release the dma buffers */
-	dma_free_coherent(&pdev->dev, priv->mmc->max_blk_count * 16,
-			  priv->dma_desc_buffer, priv->dma_desc_device_addr);
+
 
 	mmc_remove_host(mmc);
 
 	free_irq(priv->irq_regular, priv);
 	free_irq(priv->irq_dma, priv);
-
+	dma_free_coherent(&pdev->dev, priv->mmc->max_blk_count * 16,
+			  priv->dma_desc_buffer, priv->dma_desc_device_addr);
 	iounmap(priv->sdmmc_base);
 
 	clk_disable_unprepare(priv->clk_sdmmc);
-- 
2.43.0