[PATCH net v2 0/2] nfc: st-nci: drain SE timers before NCI teardown

[Fan Wu]

This is v2 of the st-nci SE-timer use-after-free fix.  v1 was reviewed by
Simon Horman, who raised two concerns about draining the
timers while userspace operations may be in flight.  v2 resolves both and
is restructured as two patches so the drain runs behind an admission
barrier instead of before the device is unregistered.

1/2 adds the barrier pieces to the NFC core:
  - nfc_se_io() is the only secure-element entry point missing the
    dev->shutting_down check the other SE operations have; add it.
  - an optional nci_ops::pre_unregister hook, called in
    nci_unregister_device() after nfc_unregister_rfkill() (the barrier is
    up) and before nci_close_device()/destroy_workqueue() (the NCI core
    still exists).
  This follows the barrier-first teardown ordering from d2492688bb9f.

2/2 registers st_nci_se_deinit() as that hook so the two orphaned se_info
timers are drained after the barrier and before the NCI core is torn down.
It also completes an in-flight SE enable/disable and resolves a pending
APDU with -ENODEV, using bwi_active as an xchg() ownership token so the
callback fires exactly once.

The two patches are a pair: 2/2 assigns the pre_unregister hook that 1/2
adds to struct nci_ops, so 2/2 will not build without 1/2.  Please take
both, in order.

v1 handled operations pending at the drain, but a new SE I/O could install
callback state afterward; with the timer shut down and the PHY closed, that
context was never resolved.  The barrier added by 1/2 closes the window.

Signed-off-by: Fan Wu <fanwu01@xxxxxxxxxx>
---

v1: <20260722034729.3254078-1-fanwu01@xxxxxxxxxx>

Changes since v1:
  - restructure into this 2-patch series (admission barrier + hook drain)
    instead of a direct deinit call in st_nci_remove();
  - complete req_completion so an in-flight SE enable/disable holding the
    device lock is not left waiting (concern 1);
  - invoke the pending APDU callback with -ENODEV (concern 2);
  - bwi_active as an xchg() ownership token (callback exactly once);
  - Fixes: 8ae01f796771 (the orphaned deinit predates the rename).

Tested: builds as a 2-patch series on netdev/net (st-nci.ko, x86_64);
        applies cleanly in order.