Re: [PATCH 1/1] cdx: fix use-after-free in cdx_mcdi_process_cmd after timeout

[Agarwal, Nikhil]

Abhijit Gangurde wrote on 8/7/2026 12:06 PM:
> When an MCDI command times out, cdx_mcdi_timeout_cmd() frees the cmd
> via cdx_mcdi_remove_cmd() but does not clear mcdi->seq_held_by[] or
> mcdi->db_held_by. If the firmware responds after the timeout,
> cdx_mcdi_process_cmd() dereferences the freed cmd pointer leading to a
> use-after-free.
> 
> clear the seq_held_by and db_held_by in the timeout path, and
> add an extra kref to handle the race where the response arrives
> concurrently with the timeout handler.
> 
> Fixes: eb96b740192b ("cdx: add MCDI protocol interface for firmware interaction")
> Co-developed-by: Prasanna Kumar T S M <ptsm@xxxxxxxxxxxxxxxxxxx>
> Signed-off-by: Prasanna Kumar T S M <ptsm@xxxxxxxxxxxxxxxxxxx>
> Signed-off-by: Abhijit Gangurde <abhijit.gangurde@xxxxxxx>
> ---

Reviewed-by: Nikhil Agarwal <nikhil.agarwal@xxxxxxx>