Re: [PATCH 1/1] mmc: cqhci: fix random crash when remove mmc module

2021-03-03 Thread Zhi Li 
On Tue, Mar 2, 2021 at 12:39 PM Zhi Li  wrote:
>
> On Tue, Mar 2, 2021 at 10:25 AM Adrian Hunter  wrote:
> >
> > On 2/03/21 5:12 pm, Zhi Li wrote:
> > >
> > >
> > > On Tue, Mar 2, 2021 at 1:03 AM Adrian Hunter  > > > wrote:
> > >
> > > On 1/03/21 7:21 pm, Frank Li wrote:
> > > > [ 6684.493350] Unable to handle kernel paging request at virtual 
> > > address 800011c5b0f0
> > > > [ 6684.498531] mmc0: card 0001 removed
> > > > [ 6684.501556] Mem abort info:
> > > > [ 6684.509681]   ESR = 0x9647
> > > > [ 6684.512786]   EC = 0x25: DABT (current EL), IL = 32 bits
> > > > [ 6684.518394]   SET = 0, FnV = 0
> > > > [ 6684.521707]   EA = 0, S1PTW = 0
> > > > [ 6684.524998] Data abort info:
> > > > [ 6684.528236]   ISV = 0, ISS = 0x0047
> > > > [ 6684.532986]   CM = 0, WnR = 1
> > > > [ 6684.536129] swapper pgtable: 4k pages, 48-bit VAs, 
> > > pgdp=81b22000
> > > > [ 6684.543923] [800011c5b0f0] pgd=b003, 
> > > p4d=b003, pud=bfffe003, pmd=900e1003, 
> > > pte=
> > > > [ 6684.557915] Internal error: Oops: 9647 [#1] PREEMPT SMP
> > > > [ 6684.564240] Modules linked in: sdhci_esdhc_imx(-) sdhci_pltfm 
> > > sdhci cqhci mmc_block mmc_core fsl_jr_uio caam_jr caamkeyblob_desc 
> > > caamhash_desc caamalg_desc crypto_engine rng_core authenc libdes 
> > > crct10dif_ce flexcan can_dev caam error [last unloaded: mmc_core]
> > > > [ 6684.587281] CPU: 0 PID: 79138 Comm: kworker/0:3H Not tainted 
> > > 5.10.9-01410-g3ba33182767b-dirty #10
> > > > [ 6684.596160] Hardware name: Freescale i.MX8DXL EVK (DT)
> > > > [ 6684.601320] Workqueue: kblockd blk_mq_run_work_fn
> > > >
> > > > [ 6684.606094] pstate: 4005 (nZcv daif -PAN -UAO -TCO BTYPE=--)
> > > > [ 6684.612286] pc : cqhci_request+0x148/0x4e8 [cqhci]
> > > > ^GMessage from syslogd@  at Thu Jan  1 01:51:24 1970 ...[ 
> > > 6684.617085] lr : cqhci_request+0x314/0x4e8 [cqhci]
> > > > [ 6684.626734] sp : 80001243b9f0
> > > > [ 6684.630049] x29: 80001243b9f0 x28: 2c3dd000
> > > > [ 6684.635367] x27: 0001 x26: 0001
> > > > [ 6684.640690] x25: 2c451000 x24: 000f
> > > > [ 6684.646007] x23: 17e71c80 x22: 2c451000
> > > > [ 6684.651326] x21: 2c0f3550 x20: 2c0f3550
> > > > [ 6684.656651] x19: 17d46880 x18: 2cea1500
> > > > [ 6684.661977] x17:  x16: 
> > > > [ 6684.667294] x15: 01ee628e3ed1 x14: 0278
> > > > [ 6684.672610] x13: 0001 x12: 0001
> > > > [ 6684.677927] x11:  x10: 
> > > > [ 6684.683243] x9 : 002b x8 : 1000
> > > > [ 6684.688560] x7 : 0010 x6 : 2c0f3678
> > > > [ 6684.693886] x5 : 000f x4 : 800011c5b000
> > > > [ 6684.699211] x3 : 0002d988 x2 : 0008
> > > > [ 6684.704537] x1 : 00f0 x0 : 0002d9880008102f
> > > > [ 6684.709854] Call trace:
> > > > [ 6684.712313]  cqhci_request+0x148/0x4e8 [cqhci]
> > > > [ 6684.716803]  mmc_cqe_start_req+0x58/0x68 [mmc_core]
> > > > [ 6684.721698]  mmc_blk_mq_issue_rq+0x460/0x810 [mmc_block]
> > > > [ 6684.727018]  mmc_mq_queue_rq+0x118/0x2b0 [mmc_block]
> > > >
> > > > cqhci_request was called after cqhci_disable.
> > > >
> > > > cqhci_disable cqhci_request
> > > > { {
> > > >   dmam_free_coherent();  (1) free
> > > >   
> > > if(!cq_host->enable)
> > > >return
> > > >(2) pass check here
> > > >   cq_host->enable = false;
> > > >
> > > >   task_desc= 
> > > get_desc(cq_host,tag);
> > > >   
> > > crash here
> > > >  (3) access memory which is 
> > > already free
> > > >
> > > > } }
> > > >
> > > > Signed-off-by: Frank Li mailto:frank...@nxp.com>>
> > > > ---
> > > >  drivers/mmc/host/cqhci-core.c | 18 ++
> > > >  1 file changed, 14 insertions(+), 4 deletions(-)
> > > >
> > > > diff --git a/drivers/mmc/host/cqhci-core.c 
> > > b/drivers/mmc/host/cqhci-core.c
> > > > index 93b0432bb601..36d292261e50 100644
> > > > --- a/drivers/mmc/host/cqhci-core.c
> > > > +++ b/drivers/mmc/host/cqhci-core.c
> > > > @@ -389,6 +389,7 @@ static void cqhci_off(struct mmc_host *mmc)
> > > >  static void cqhci_disable(struct mmc_host *mmc)

Re: [PATCH 1/1] mmc: cqhci: fix random crash when remove mmc module

2021-03-02 Thread Zhi Li 
On Tue, Mar 2, 2021 at 10:25 AM Adrian Hunter  wrote:
>
> On 2/03/21 5:12 pm, Zhi Li wrote:
> >
> >
> > On Tue, Mar 2, 2021 at 1:03 AM Adrian Hunter  > > wrote:
> >
> > On 1/03/21 7:21 pm, Frank Li wrote:
> > > [ 6684.493350] Unable to handle kernel paging request at virtual 
> > address 800011c5b0f0
> > > [ 6684.498531] mmc0: card 0001 removed
> > > [ 6684.501556] Mem abort info:
> > > [ 6684.509681]   ESR = 0x9647
> > > [ 6684.512786]   EC = 0x25: DABT (current EL), IL = 32 bits
> > > [ 6684.518394]   SET = 0, FnV = 0
> > > [ 6684.521707]   EA = 0, S1PTW = 0
> > > [ 6684.524998] Data abort info:
> > > [ 6684.528236]   ISV = 0, ISS = 0x0047
> > > [ 6684.532986]   CM = 0, WnR = 1
> > > [ 6684.536129] swapper pgtable: 4k pages, 48-bit VAs, 
> > pgdp=81b22000
> > > [ 6684.543923] [800011c5b0f0] pgd=b003, 
> > p4d=b003, pud=bfffe003, pmd=900e1003, 
> > pte=
> > > [ 6684.557915] Internal error: Oops: 9647 [#1] PREEMPT SMP
> > > [ 6684.564240] Modules linked in: sdhci_esdhc_imx(-) sdhci_pltfm 
> > sdhci cqhci mmc_block mmc_core fsl_jr_uio caam_jr caamkeyblob_desc 
> > caamhash_desc caamalg_desc crypto_engine rng_core authenc libdes 
> > crct10dif_ce flexcan can_dev caam error [last unloaded: mmc_core]
> > > [ 6684.587281] CPU: 0 PID: 79138 Comm: kworker/0:3H Not tainted 
> > 5.10.9-01410-g3ba33182767b-dirty #10
> > > [ 6684.596160] Hardware name: Freescale i.MX8DXL EVK (DT)
> > > [ 6684.601320] Workqueue: kblockd blk_mq_run_work_fn
> > >
> > > [ 6684.606094] pstate: 4005 (nZcv daif -PAN -UAO -TCO BTYPE=--)
> > > [ 6684.612286] pc : cqhci_request+0x148/0x4e8 [cqhci]
> > > ^GMessage from syslogd@  at Thu Jan  1 01:51:24 1970 ...[ 
> > 6684.617085] lr : cqhci_request+0x314/0x4e8 [cqhci]
> > > [ 6684.626734] sp : 80001243b9f0
> > > [ 6684.630049] x29: 80001243b9f0 x28: 2c3dd000
> > > [ 6684.635367] x27: 0001 x26: 0001
> > > [ 6684.640690] x25: 2c451000 x24: 000f
> > > [ 6684.646007] x23: 17e71c80 x22: 2c451000
> > > [ 6684.651326] x21: 2c0f3550 x20: 2c0f3550
> > > [ 6684.656651] x19: 17d46880 x18: 2cea1500
> > > [ 6684.661977] x17:  x16: 
> > > [ 6684.667294] x15: 01ee628e3ed1 x14: 0278
> > > [ 6684.672610] x13: 0001 x12: 0001
> > > [ 6684.677927] x11:  x10: 
> > > [ 6684.683243] x9 : 002b x8 : 1000
> > > [ 6684.688560] x7 : 0010 x6 : 2c0f3678
> > > [ 6684.693886] x5 : 000f x4 : 800011c5b000
> > > [ 6684.699211] x3 : 0002d988 x2 : 0008
> > > [ 6684.704537] x1 : 00f0 x0 : 0002d9880008102f
> > > [ 6684.709854] Call trace:
> > > [ 6684.712313]  cqhci_request+0x148/0x4e8 [cqhci]
> > > [ 6684.716803]  mmc_cqe_start_req+0x58/0x68 [mmc_core]
> > > [ 6684.721698]  mmc_blk_mq_issue_rq+0x460/0x810 [mmc_block]
> > > [ 6684.727018]  mmc_mq_queue_rq+0x118/0x2b0 [mmc_block]
> > >
> > > cqhci_request was called after cqhci_disable.
> > >
> > > cqhci_disable cqhci_request
> > > { {
> > >   dmam_free_coherent();  (1) free
> > >   if(!cq_host->enable)
> > >return
> > >(2) pass check here
> > >   cq_host->enable = false;
> > >
> > >   task_desc= 
> > get_desc(cq_host,tag);
> > >   
> > crash here
> > >  (3) access memory which is 
> > already free
> > >
> > > } }
> > >
> > > Signed-off-by: Frank Li mailto:frank...@nxp.com>>
> > > ---
> > >  drivers/mmc/host/cqhci-core.c | 18 ++
> > >  1 file changed, 14 insertions(+), 4 deletions(-)
> > >
> > > diff --git a/drivers/mmc/host/cqhci-core.c 
> > b/drivers/mmc/host/cqhci-core.c
> > > index 93b0432bb601..36d292261e50 100644
> > > --- a/drivers/mmc/host/cqhci-core.c
> > > +++ b/drivers/mmc/host/cqhci-core.c
> > > @@ -389,6 +389,7 @@ static void cqhci_off(struct mmc_host *mmc)
> > >  static void cqhci_disable(struct mmc_host *mmc)
> > >  {
> > >   struct cqhci_host *cq_host = mmc->cqe_private;
> > > + unsigned long flags;
> > >
> > >   if (!cq_host->enabled)
> > >   return;
> > > @@ -397,6 +398,11 @@ static void cq

Re: [PATCH 1/1] mmc: cqhci: fix random crash when remove mmc module

2021-03-02 Thread Adrian Hunter 
On 2/03/21 5:12 pm, Zhi Li wrote:
> 
> 
> On Tue, Mar 2, 2021 at 1:03 AM Adrian Hunter  > wrote:
> 
> On 1/03/21 7:21 pm, Frank Li wrote:
> > [ 6684.493350] Unable to handle kernel paging request at virtual 
> address 800011c5b0f0
> > [ 6684.498531] mmc0: card 0001 removed
> > [ 6684.501556] Mem abort info:
> > [ 6684.509681]   ESR = 0x9647
> > [ 6684.512786]   EC = 0x25: DABT (current EL), IL = 32 bits
> > [ 6684.518394]   SET = 0, FnV = 0
> > [ 6684.521707]   EA = 0, S1PTW = 0
> > [ 6684.524998] Data abort info:
> > [ 6684.528236]   ISV = 0, ISS = 0x0047
> > [ 6684.532986]   CM = 0, WnR = 1
> > [ 6684.536129] swapper pgtable: 4k pages, 48-bit VAs, 
> pgdp=81b22000
> > [ 6684.543923] [800011c5b0f0] pgd=b003, 
> p4d=b003, pud=bfffe003, pmd=900e1003, 
> pte=
> > [ 6684.557915] Internal error: Oops: 9647 [#1] PREEMPT SMP
> > [ 6684.564240] Modules linked in: sdhci_esdhc_imx(-) sdhci_pltfm sdhci 
> cqhci mmc_block mmc_core fsl_jr_uio caam_jr caamkeyblob_desc caamhash_desc 
> caamalg_desc crypto_engine rng_core authenc libdes crct10dif_ce flexcan 
> can_dev caam error [last unloaded: mmc_core]
> > [ 6684.587281] CPU: 0 PID: 79138 Comm: kworker/0:3H Not tainted 
> 5.10.9-01410-g3ba33182767b-dirty #10
> > [ 6684.596160] Hardware name: Freescale i.MX8DXL EVK (DT)
> > [ 6684.601320] Workqueue: kblockd blk_mq_run_work_fn
> >
> > [ 6684.606094] pstate: 4005 (nZcv daif -PAN -UAO -TCO BTYPE=--)
> > [ 6684.612286] pc : cqhci_request+0x148/0x4e8 [cqhci]
> > ^GMessage from syslogd@  at Thu Jan  1 01:51:24 1970 ...[ 6684.617085] 
> lr : cqhci_request+0x314/0x4e8 [cqhci]
> > [ 6684.626734] sp : 80001243b9f0
> > [ 6684.630049] x29: 80001243b9f0 x28: 2c3dd000
> > [ 6684.635367] x27: 0001 x26: 0001
> > [ 6684.640690] x25: 2c451000 x24: 000f
> > [ 6684.646007] x23: 17e71c80 x22: 2c451000
> > [ 6684.651326] x21: 2c0f3550 x20: 2c0f3550
> > [ 6684.656651] x19: 17d46880 x18: 2cea1500
> > [ 6684.661977] x17:  x16: 
> > [ 6684.667294] x15: 01ee628e3ed1 x14: 0278
> > [ 6684.672610] x13: 0001 x12: 0001
> > [ 6684.677927] x11:  x10: 
> > [ 6684.683243] x9 : 002b x8 : 1000
> > [ 6684.688560] x7 : 0010 x6 : 2c0f3678
> > [ 6684.693886] x5 : 000f x4 : 800011c5b000
> > [ 6684.699211] x3 : 0002d988 x2 : 0008
> > [ 6684.704537] x1 : 00f0 x0 : 0002d9880008102f
> > [ 6684.709854] Call trace:
> > [ 6684.712313]  cqhci_request+0x148/0x4e8 [cqhci]
> > [ 6684.716803]  mmc_cqe_start_req+0x58/0x68 [mmc_core]
> > [ 6684.721698]  mmc_blk_mq_issue_rq+0x460/0x810 [mmc_block]
> > [ 6684.727018]  mmc_mq_queue_rq+0x118/0x2b0 [mmc_block]
> >
> > cqhci_request was called after cqhci_disable.
> >
> > cqhci_disable                                 cqhci_request
> > {                                             {
> >       dmam_free_coherent();  (1) free
> >                                                   if(!cq_host->enable)
> >                                                        return
> >                                        (2) pass check here
> >       cq_host->enable = false;
> >
> >                                                   task_desc= 
> get_desc(cq_host,tag);
> >                                                               crash 
> here
> >                                          (3) access memory which is 
> already free
> >
> > }                                             }
> >
> > Signed-off-by: Frank Li mailto:frank...@nxp.com>>
> > ---
> >  drivers/mmc/host/cqhci-core.c | 18 ++
> >  1 file changed, 14 insertions(+), 4 deletions(-)
> >
> > diff --git a/drivers/mmc/host/cqhci-core.c 
> b/drivers/mmc/host/cqhci-core.c
> > index 93b0432bb601..36d292261e50 100644
> > --- a/drivers/mmc/host/cqhci-core.c
> > +++ b/drivers/mmc/host/cqhci-core.c
> > @@ -389,6 +389,7 @@ static void cqhci_off(struct mmc_host *mmc)
> >  static void cqhci_disable(struct mmc_host *mmc)
> >  {
> >       struct cqhci_host *cq_host = mmc->cqe_private;
> > +     unsigned long flags;
> > 
> >       if (!cq_host->enabled)
> >               return;
> > @@ -397,6 +398,11 @@ static void cqhci_disable(struct mmc_host *mmc)
> > 
> >       __cqhci_disable(cq_host);
> > 
> > +     /* need wait for cqhci_request finish before free memory */
> > +     spin_lock_irqsave(&cq_host->lock, flags);
> > +     cq_host->e

Re: [PATCH 1/1] mmc: cqhci: fix random crash when remove mmc module

2021-03-02 Thread Adrian Hunter 
On 1/03/21 7:21 pm, Frank Li wrote:
> [ 6684.493350] Unable to handle kernel paging request at virtual address 
> 800011c5b0f0
> [ 6684.498531] mmc0: card 0001 removed
> [ 6684.501556] Mem abort info:
> [ 6684.509681]   ESR = 0x9647
> [ 6684.512786]   EC = 0x25: DABT (current EL), IL = 32 bits
> [ 6684.518394]   SET = 0, FnV = 0
> [ 6684.521707]   EA = 0, S1PTW = 0
> [ 6684.524998] Data abort info:
> [ 6684.528236]   ISV = 0, ISS = 0x0047
> [ 6684.532986]   CM = 0, WnR = 1
> [ 6684.536129] swapper pgtable: 4k pages, 48-bit VAs, pgdp=81b22000
> [ 6684.543923] [800011c5b0f0] pgd=b003, p4d=b003, 
> pud=bfffe003, pmd=900e1003, pte=
> [ 6684.557915] Internal error: Oops: 9647 [#1] PREEMPT SMP
> [ 6684.564240] Modules linked in: sdhci_esdhc_imx(-) sdhci_pltfm sdhci cqhci 
> mmc_block mmc_core fsl_jr_uio caam_jr caamkeyblob_desc caamhash_desc 
> caamalg_desc crypto_engine rng_core authenc libdes crct10dif_ce flexcan 
> can_dev caam error [last unloaded: mmc_core]
> [ 6684.587281] CPU: 0 PID: 79138 Comm: kworker/0:3H Not tainted 
> 5.10.9-01410-g3ba33182767b-dirty #10
> [ 6684.596160] Hardware name: Freescale i.MX8DXL EVK (DT)
> [ 6684.601320] Workqueue: kblockd blk_mq_run_work_fn
> 
> [ 6684.606094] pstate: 4005 (nZcv daif -PAN -UAO -TCO BTYPE=--)
> [ 6684.612286] pc : cqhci_request+0x148/0x4e8 [cqhci]
> ^GMessage from syslogd@  at Thu Jan  1 01:51:24 1970 ...[ 6684.617085] lr : 
> cqhci_request+0x314/0x4e8 [cqhci]
> [ 6684.626734] sp : 80001243b9f0
> [ 6684.630049] x29: 80001243b9f0 x28: 2c3dd000
> [ 6684.635367] x27: 0001 x26: 0001
> [ 6684.640690] x25: 2c451000 x24: 000f
> [ 6684.646007] x23: 17e71c80 x22: 2c451000
> [ 6684.651326] x21: 2c0f3550 x20: 2c0f3550
> [ 6684.656651] x19: 17d46880 x18: 2cea1500
> [ 6684.661977] x17:  x16: 
> [ 6684.667294] x15: 01ee628e3ed1 x14: 0278
> [ 6684.672610] x13: 0001 x12: 0001
> [ 6684.677927] x11:  x10: 
> [ 6684.683243] x9 : 002b x8 : 1000
> [ 6684.688560] x7 : 0010 x6 : 2c0f3678
> [ 6684.693886] x5 : 000f x4 : 800011c5b000
> [ 6684.699211] x3 : 0002d988 x2 : 0008
> [ 6684.704537] x1 : 00f0 x0 : 0002d9880008102f
> [ 6684.709854] Call trace:
> [ 6684.712313]  cqhci_request+0x148/0x4e8 [cqhci]
> [ 6684.716803]  mmc_cqe_start_req+0x58/0x68 [mmc_core]
> [ 6684.721698]  mmc_blk_mq_issue_rq+0x460/0x810 [mmc_block]
> [ 6684.727018]  mmc_mq_queue_rq+0x118/0x2b0 [mmc_block]
> 
> cqhci_request was called after cqhci_disable.
> 
> cqhci_disable cqhci_request
> { {
>   dmam_free_coherent();  (1) free
>   if(!cq_host->enable)
>return
>(2) pass check here
>   cq_host->enable = false;
> 
>   task_desc= 
> get_desc(cq_host,tag);
>   crash here
>  (3) access memory which is already 
> free
> 
> } }
> 
> Signed-off-by: Frank Li 
> ---
>  drivers/mmc/host/cqhci-core.c | 18 ++
>  1 file changed, 14 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/mmc/host/cqhci-core.c b/drivers/mmc/host/cqhci-core.c
> index 93b0432bb601..36d292261e50 100644
> --- a/drivers/mmc/host/cqhci-core.c
> +++ b/drivers/mmc/host/cqhci-core.c
> @@ -389,6 +389,7 @@ static void cqhci_off(struct mmc_host *mmc)
>  static void cqhci_disable(struct mmc_host *mmc)
>  {
>   struct cqhci_host *cq_host = mmc->cqe_private;
> + unsigned long flags;
>  
>   if (!cq_host->enabled)
>   return;
> @@ -397,6 +398,11 @@ static void cqhci_disable(struct mmc_host *mmc)
>  
>   __cqhci_disable(cq_host);
>  
> + /* need wait for cqhci_request finish before free memory */
> + spin_lock_irqsave(&cq_host->lock, flags);
> + cq_host->enabled = false;
> + spin_unlock_irqrestore(&cq_host->lock, flags);
> +
>   dmam_free_coherent(mmc_dev(mmc), cq_host->data_size,
>  cq_host->trans_desc_base,
>  cq_host->trans_desc_dma_base);
> @@ -408,7 +414,6 @@ static void cqhci_disable(struct mmc_host *mmc)
>   cq_host->trans_desc_base = NULL;
>   cq_host->desc_base = NULL;
>  
> - cq_host->enabled = false;
>  }
>  
>  static void cqhci_prep_task_desc(struct mmc_request *mrq,
> @@ -612,6 +617,13 @@ static int cqhci_request(struct mmc_host *mmc, struct 
> mmc_request *mrq)
>   cq_host->ops->enable(mmc);
>   }
>

[PATCH 1/1] mmc: cqhci: fix random crash when remove mmc module

2021-03-01 Thread Frank Li 
[ 6684.493350] Unable to handle kernel paging request at virtual address 
800011c5b0f0
[ 6684.498531] mmc0: card 0001 removed
[ 6684.501556] Mem abort info:
[ 6684.509681]   ESR = 0x9647
[ 6684.512786]   EC = 0x25: DABT (current EL), IL = 32 bits
[ 6684.518394]   SET = 0, FnV = 0
[ 6684.521707]   EA = 0, S1PTW = 0
[ 6684.524998] Data abort info:
[ 6684.528236]   ISV = 0, ISS = 0x0047
[ 6684.532986]   CM = 0, WnR = 1
[ 6684.536129] swapper pgtable: 4k pages, 48-bit VAs, pgdp=81b22000
[ 6684.543923] [800011c5b0f0] pgd=b003, p4d=b003, 
pud=bfffe003, pmd=900e1003, pte=
[ 6684.557915] Internal error: Oops: 9647 [#1] PREEMPT SMP
[ 6684.564240] Modules linked in: sdhci_esdhc_imx(-) sdhci_pltfm sdhci cqhci 
mmc_block mmc_core fsl_jr_uio caam_jr caamkeyblob_desc caamhash_desc 
caamalg_desc crypto_engine rng_core authenc libdes crct10dif_ce flexcan can_dev 
caam error [last unloaded: mmc_core]
[ 6684.587281] CPU: 0 PID: 79138 Comm: kworker/0:3H Not tainted 
5.10.9-01410-g3ba33182767b-dirty #10
[ 6684.596160] Hardware name: Freescale i.MX8DXL EVK (DT)
[ 6684.601320] Workqueue: kblockd blk_mq_run_work_fn

[ 6684.606094] pstate: 4005 (nZcv daif -PAN -UAO -TCO BTYPE=--)
[ 6684.612286] pc : cqhci_request+0x148/0x4e8 [cqhci]
^GMessage from syslogd@  at Thu Jan  1 01:51:24 1970 ...[ 6684.617085] lr : 
cqhci_request+0x314/0x4e8 [cqhci]
[ 6684.626734] sp : 80001243b9f0
[ 6684.630049] x29: 80001243b9f0 x28: 2c3dd000
[ 6684.635367] x27: 0001 x26: 0001
[ 6684.640690] x25: 2c451000 x24: 000f
[ 6684.646007] x23: 17e71c80 x22: 2c451000
[ 6684.651326] x21: 2c0f3550 x20: 2c0f3550
[ 6684.656651] x19: 17d46880 x18: 2cea1500
[ 6684.661977] x17:  x16: 
[ 6684.667294] x15: 01ee628e3ed1 x14: 0278
[ 6684.672610] x13: 0001 x12: 0001
[ 6684.677927] x11:  x10: 
[ 6684.683243] x9 : 002b x8 : 1000
[ 6684.688560] x7 : 0010 x6 : 2c0f3678
[ 6684.693886] x5 : 000f x4 : 800011c5b000
[ 6684.699211] x3 : 0002d988 x2 : 0008
[ 6684.704537] x1 : 00f0 x0 : 0002d9880008102f
[ 6684.709854] Call trace:
[ 6684.712313]  cqhci_request+0x148/0x4e8 [cqhci]
[ 6684.716803]  mmc_cqe_start_req+0x58/0x68 [mmc_core]
[ 6684.721698]  mmc_blk_mq_issue_rq+0x460/0x810 [mmc_block]
[ 6684.727018]  mmc_mq_queue_rq+0x118/0x2b0 [mmc_block]

cqhci_request was called after cqhci_disable.

cqhci_disable cqhci_request
{ {
dmam_free_coherent();  (1) free
  if(!cq_host->enable)
   return
 (2) pass check here
cq_host->enable = false;

  task_desc= 
get_desc(cq_host,tag);
  crash here
 (3) access memory which is already free

} }

Signed-off-by: Frank Li 
---
 drivers/mmc/host/cqhci-core.c | 18 ++
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/drivers/mmc/host/cqhci-core.c b/drivers/mmc/host/cqhci-core.c
index 93b0432bb601..36d292261e50 100644
--- a/drivers/mmc/host/cqhci-core.c
+++ b/drivers/mmc/host/cqhci-core.c
@@ -389,6 +389,7 @@ static void cqhci_off(struct mmc_host *mmc)
 static void cqhci_disable(struct mmc_host *mmc)
 {
struct cqhci_host *cq_host = mmc->cqe_private;
+   unsigned long flags;
 
if (!cq_host->enabled)
return;
@@ -397,6 +398,11 @@ static void cqhci_disable(struct mmc_host *mmc)
 
__cqhci_disable(cq_host);
 
+   /* need wait for cqhci_request finish before free memory */
+   spin_lock_irqsave(&cq_host->lock, flags);
+   cq_host->enabled = false;
+   spin_unlock_irqrestore(&cq_host->lock, flags);
+
dmam_free_coherent(mmc_dev(mmc), cq_host->data_size,
   cq_host->trans_desc_base,
   cq_host->trans_desc_dma_base);
@@ -408,7 +414,6 @@ static void cqhci_disable(struct mmc_host *mmc)
cq_host->trans_desc_base = NULL;
cq_host->desc_base = NULL;
 
-   cq_host->enabled = false;
 }
 
 static void cqhci_prep_task_desc(struct mmc_request *mrq,
@@ -612,6 +617,13 @@ static int cqhci_request(struct mmc_host *mmc, struct 
mmc_request *mrq)
cq_host->ops->enable(mmc);
}
 
+   spin_lock_irqsave(&cq_host->lock, flags);
+   if (!cq_host->enabled) {
+   pr_err("%s: cqhci: not enabled\n", mmc_hostname(mmc));
+   err = -EINVAL;
+   goto out_unlock