[PATCH RESEND v2 0/2] nfc: st21nfca: fix SE APDU request race condition

From: Joas Antonio dos Santos via B4 Relay

Date: Mon Nov 09 2026 - 22:30:01 EST


Fix a race between the timeout work handler and the EVT_TRANSMIT_DATA
event handler that can lead to a double invocation of the SE APDU
callback, resulting in use-after-free or double-free of the callback
context.

Split into two patches:
1/2: Add a spinlock to serialize access to bwi_active, cb, and
cb_context across the three concurrent paths.
2/2: Use the lock to guard against double completion and reject
overlapping requests.

Changes since v1:
- Use spinlock instead of plain bwi_active flag checks (Simon Horman)
- Split into 2-patch series: locking infrastructure + completion fix
- Move bwi_active = true before mod_timer()
- Copy cb/cb_context under lock, invoke after releasing
- Reject overlapping se_io requests with -EBUSY
- Drop Assisted-by trailer

---
Joas Antonio dos Santos (2):
nfc: st21nfca: add spinlock to serialize SE APDU request state
nfc: st21nfca: prevent double completion of SE APDU request

drivers/nfc/st21nfca/se.c | 36 ++++++++++++++++++++++++++++++++----
drivers/nfc/st21nfca/st21nfca.h | 2 ++
2 files changed, 34 insertions(+), 4 deletions(-)
---
base-commit: 602042bf29f6efde39cfb5fdd9289bf4854bc0c5
change-id: 20261108-st21nfca-v2-f4c5f861e416

Best regards,
--
Joas Antonio dos Santos <joasantonio108@xxxxxxxxx>