Re: [PATCH] firewire: core: fix race condition in split transaction handling

[Takashi Sakamoto <o-takashi@sakamocchi.jp>]

On Sun, Oct 18, 2026 at 11:55:04AM +0900, Takashi Sakamoto wrote:
> For a split transaction, either fw_core_handle_response() or
> split_transaction_timeout_callback() may manipulate the same transaction
> entry in the pending transaction list. The return value of timer_delete()
> is used to determine which function handles the entry. If the transaction
> is a split transaction and timer_delete() returns zero, the timeout
> callback may already be running. In this case, the response handler must
> leave the entry in the list for the timeout callback to remove.
> 
> A previous code refactoring broke this behavior, introducing a race
> condition in which both functions could process the same transaction.
> This could lead to a use-after-free on the transaction initiator side.
> 
> Fix the regression by ensuring that the response handler does not process
> the transaction when timer_delete() returns zero. The timeout callback is
> responsible for removing the entry from the pending transaction list.
> 
> Fixes: fa2dc2710076 ("firewire: core: code refactoring to find and pop transaction entry")
> Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
> ---
>  drivers/firewire/core-transaction.c | 8 ++++++--
>  1 file changed, 6 insertions(+), 2 deletions(-)

Applied to for-linus branch.


Regards

Takashi Sakamoto