[PATCH v2] slimbus: messaging: hold lock until transaction is completed

[Changyul Lee <lcy8047@gmail.com>]

slim_msg_response() releases ctrl->txn_lock right after idr_find()
and then uses txn. If the request times out in the meantime, it
returns, and txn is no longer valid.

Keep ctrl->txn_lock held until complete() returns, so the timeout
path in slim_free_txn_tid() waits until slim_msg_response() is done
with txn. Call idr_remove() directly, since slim_free_txn_tid() takes
the same lock.

Tested on v7.3 with a delay after idr_find(), in QEMU with KASAN
and on a DragonBoard 845c. Without this patch, both reproduced the
use-after-free in slim_msg_response(). With this patch, neither did.

Fixes: afbdcc7c384b ("slimbus: Add messaging APIs to slimbus framework")
Assisted-by: LLM
Signed-off-by: Changyul Lee <lcy8047@gmail.com>
---
Changes in v2:
 - Add a summary of the test results to the commit message
 - Remove the blank line between Fixes: and Signed-off-by:
 - Add Assisted-by: tag

Detailed test results (QEMU and DragonBoard 845c):
https://lore.kernel.org/all/CAKefsHuMzUr6LForJnx4ZQiBUMLQm60_iNEKmjxnGDTVxr88Cg@mail.gmail.com/

v1: https://lore.kernel.org/all/20260911045911.1327413-1-lcy8047@gmail.com/

 drivers/slimbus/messaging.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/drivers/slimbus/messaging.c b/drivers/slimbus/messaging.c
index e2dbe4a66b70..aa98f5480ba4 100644
--- a/drivers/slimbus/messaging.c
+++ b/drivers/slimbus/messaging.c
@@ -29,22 +29,24 @@ void slim_msg_response(struct slim_controller *ctrl, u8 *reply, u8 tid, u8 len)
 
 	spin_lock_irqsave(&ctrl->txn_lock, flags);
 	txn = idr_find(&ctrl->tid_idr, tid);
-	spin_unlock_irqrestore(&ctrl->txn_lock, flags);
-
-	if (txn == NULL)
+	if (txn == NULL) {
+		spin_unlock_irqrestore(&ctrl->txn_lock, flags);
 		return;
+	}
 
 	msg = txn->msg;
 	if (msg == NULL || msg->rbuf == NULL) {
+		spin_unlock_irqrestore(&ctrl->txn_lock, flags);
 		dev_err(ctrl->dev, "Got response to invalid TID:%d, len:%d\n",
 				tid, len);
 		return;
 	}
 
-	slim_free_txn_tid(ctrl, txn);
+	idr_remove(&ctrl->tid_idr, txn->tid);
 	memcpy(msg->rbuf, reply, len);
 	if (txn->comp)
 		complete(txn->comp);
+	spin_unlock_irqrestore(&ctrl->txn_lock, flags);
 
 	/* Remove runtime-pm vote now that response was received for TID txn */
 	pm_runtime_mark_last_busy(ctrl->dev);

base-commit: c03c1a14507dfaf8b856c2608f9ac216021fc222
-- 
2.43.0