From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from SN4PR0501CU005.outbound.protection.outlook.com (mail-southcentralusazon11011033.outbound.protection.outlook.com [40.93.194.33]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B0B1F414DC9 for ; Wed, 12 Aug 2026 11:56:28 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=40.93.194.33 ARC-Seal:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786535790; cv=fail; b=RTaAkrmZECX6Qbsjs9Z5Z6DQUCzekDk1/KizM5C+4LgD3nlBho1KdVVEFfkrSQj1TykLz0esZYinOn0tGoM3Zq/+TncouaaqaTH3qwnpJvwrOcqYeLYEfKKCK2c0ywEjSnkiVFJlEBnJPIZ1hNrzRJ3Pk+XhQKbQHldmbMisfRU= ARC-Message-Signature:i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786535790; c=relaxed/simple; bh=c8k/gFch+E2jmmg+Y3T9qEsLY8bDZWZKXJ/Ist/8w1I=; h=Message-ID:Date:Subject:To:Cc:References:From:In-Reply-To: Content-Type:MIME-Version; b=ih6lcwzKn1PmJrK6tC5eobAKEBqkrdOCUDVm3UFxoy3awR0tmrOvtgD65crl2l4ITZ/AtdhEWOR7jWNcifKD+qqomJqO1aseeVl1FqlkQj4L+3OoS4u6hMxJUEA1ko/GUCrYOmR3+C4bP3PCGZIZBJAhNV3OQUmKor0eGTil9Qg= ARC-Authentication-Results:i=2; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=amd.com; spf=fail smtp.mailfrom=amd.com; dkim=pass (1024-bit key) header.d=amd.com header.i=@amd.com header.b=2IEGyNRY; arc=fail smtp.client-ip=40.93.194.33 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=amd.com Authentication-Results: smtp.subspace.kernel.org; spf=fail smtp.mailfrom=amd.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=amd.com header.i=@amd.com header.b="2IEGyNRY" ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=qewiJAWV/tZMrFecLGIx60k4GbMnIFsxtg008AtUC38DBLbNQjpCS2Pk3Wqswz6tiO3rw8wIodo46H1Dp7o7jqqkGil9CydWrYitO/Jt91jHPuNk3zoDSna4Z5LiFiNIoojGlej6OUOrw1Qog+XeQVRXGxDcyJuZ0YjRmIEdV+JrA8ptIszthwza3A+7q6FgHNxJ4/NmnYxbzd0atNZRZUFwTrobQ4kdbwIedRi1pd06pZfMAivibkyBSLL8sZBEqt/ATRyxUnhDmodVi7aglps9PEe6l1NusiFuWSWa9Uyj7PBnibq3h2bptC7zMdPQReVvGidm8uCRquEOqHjACg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=2vINqmLo2FDT2ObcjbaeJweKFdrO/YM1A36V90UXtfo=; b=L8bIeX5DgRz1q67hq43Vnr7jscxpfHdkEv0mJVUO7+ZSvEWcUztqeGKsvoaa7ZszquOBtjZ1iKxZ9Mfj6dss76VtNWqgycsx80QA/EiMMRLBWmXr65A+fgBI99dyr2/RTEtZ3hHFpsKs83MkIKm4D+oEWEqhakE+/hXXHoH/MvT8vJ7F6lNWEjsNyl5lmHeVDER/14e8gz369K+UAsXZLuJnFNVqwGTXScdelc5RUSqTzdUwWaWiw1IQshoHFcoCERMPG6SJCLwoZh6dgWuYa0UxYcP9nOOH9mS+d/E0mfQ6T+0mpl5E7JpxOsuXFjKrcgvTypqf7+W5Ofts6CCQ8w== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=amd.com; dmarc=pass action=none header.from=amd.com; dkim=pass header.d=amd.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amd.com; s=selector1; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=2vINqmLo2FDT2ObcjbaeJweKFdrO/YM1A36V90UXtfo=; b=2IEGyNRYLNGj48Ch9godEQQjvl7i4gu3ThHakQtqiatrl9iXRgjUN9JZXD91wVtTnILCQCxdgiZ+npulgerJcxRP8fdOiF8yDLE4nST4wUw+SjsAUjDklnpodBDAyILgxNqkKlZBxggY7mxyHD/ss+tXE8lWvSDVw6VZGgW7m9s= Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=amd.com; Received: from CH3PR12MB8547.namprd12.prod.outlook.com (2603:10b6:610:164::10) by LV3PR12MB9265.namprd12.prod.outlook.com (2603:10b6:408:215::14) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.315.12; Wed, 12 Aug 2026 11:56:21 +0000 Received: from CH3PR12MB8547.namprd12.prod.outlook.com ([fe80::bf73:429d:49fd:26e1]) by CH3PR12MB8547.namprd12.prod.outlook.com ([fe80::bf73:429d:49fd:26e1%6]) with mapi id 15.21.0315.008; Wed, 12 Aug 2026 11:56:21 +0000 Message-ID: Date: Wed, 12 Aug 2026 17:26:14 +0530 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH 1/1] cdx: fix use-after-free in cdx_mcdi_process_cmd after timeout To: Abhijit Gangurde , gregkh@linuxfoundation.org Cc: linux-kernel@vger.kernel.org, michal.simek@amd.com, git@amd.com, shubhrajyoti.datta@amd.com, Prasanna Kumar T S M , Nipun.Gupta@amd.com, nikhil.agarwal@amd.com References: <20260807063609.2413865-1-abhijit.gangurde@amd.com> Content-Language: en-US From: "Agarwal, Nikhil" In-Reply-To: <20260807063609.2413865-1-abhijit.gangurde@amd.com> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-ClientProxiedBy: MA0P287CA0014.INDP287.PROD.OUTLOOK.COM (2603:1096:a01:d9::16) To CH3PR12MB8547.namprd12.prod.outlook.com (2603:10b6:610:164::10) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CH3PR12MB8547:EE_|LV3PR12MB9265:EE_ X-MS-Office365-Filtering-Correlation-Id: 7d92cc9b-84e1-45d6-2609-08def868b9bb X-LD-Processed: 3dd8961f-e488-4e60-8e11-a82d994e183d,ExtAddr X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|376014|23010399003|366016|1800799024|22082099003|18002099003|56012099006|11063799006|3023799007|10067099003; X-Microsoft-Antispam-Message-Info: h+twt1EL/5pkcgCHJ8gbRmXaEWQmagob0TWYhEl346Ie6XmqGaN1ap74dpqaixwvbr9PGAz4FBJkmQtKThZw8coCUWm+dWvGsO44j6/3dUgXFcddUgXufSblvG+xjElR1fAtu2pidDCb3r35Hi8RPR6Yu+LqzLFAviJH/XKc2P3y7BB+Z6FNxXuhExThZj2CrWBnYbMeoC20lR0EvDUVYh7V/w/ovhHlStJ2ep7MblCahWnI7EDlUI9JzJQBJhALY8hHhoq0bxYrorZIPpq00HhhQpfARJEzhllywadX3bc+44SEZfhYt0q57CXCAtPaCQwE6jGe+XstZiyVQ+PvV6+JiHiHZFXoV1LmkxPTKHvBGiQqHf64+iKMZAvODFaxxeLQoHHL5k9aUTOH8Pt79LowjmZ0egP1ShFBm9ZZkscg71Ukr6aaduNaVvG4V/TkgGSgmujkZ4uFBZ7vRk9VRf0Uo/mB4esdKwCe+ps1SV/0W1CpVCGwrFvCVe6YJODxT8uDR31T802RfyCijEJZOcVKWo6PHIKeO55clA+jzZSgzu8mqsIBkoAS3TCwcP+Z8wxsau1B0mTulNKDHuYKc4IKr3XyLhetrpytqXbEgBdnvHiSI2yeKSIg/SglFtphwKthHB0WohELZO5bjNv/0eCzjgICshNSP1dntkA4rfE= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CH3PR12MB8547.namprd12.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(376014)(23010399003)(366016)(1800799024)(22082099003)(18002099003)(56012099006)(11063799006)(3023799007)(10067099003);DIR:OUT;SFP:1101; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?V1FxR2FFQjBDU1hEek5taDdPeUZ5cjQvM2dsTlFzN0N0MmE1ZHJHQnl0QjlH?= =?utf-8?B?QjZ5bjhMLzFWNFc1ekFOUTFTTUVjT25EYi9aRURlaHhxYzN4aFZXeDhld3FW?= =?utf-8?B?TFAwMWZwOVdBamJIMDVQR0FST0R1emFXMzcvVWZpNTNBcHBmanoyVENadVJy?= =?utf-8?B?dnJSb2tEc2FmNkJnd3ZuUUtXcXQzNGJYYzRFcE1PaVJnaXhhdHppb3R3d0Nq?= =?utf-8?B?K1FiOU5iMHFUWXJxdVBBeU9CeTI4TlN1YVJweWRVazlJbForelRlUkxTTHRk?= =?utf-8?B?ZnFFWEVBQnhkaU5La05MT1VEb0thclc2NzBhQWdtZlV1eWd0dkxmbUErK01k?= =?utf-8?B?ZzNlUVBuTmFLM3J2aW5ISTcvVk9xOEdMZE9NcEhhRHlLNXhha0U2WUpBMk13?= =?utf-8?B?Zkt2WURHckQwUmgzVmRMMklFbGJLTkpZbEd2Mkg4RUUwNC93WTM3My9mbEla?= =?utf-8?B?NlFJTU1Eb2Fjd0RhdVVRSklpaWVMVk1uMzM1STBJMlBYSHFXQ0NIOU1OeVdS?= =?utf-8?B?Z2FzRmdVWmc2a2NBeUZsVkluU21XWjl5c2M0b3U3cnpSajliakVpdFdvM0cy?= =?utf-8?B?YXZrd0JQSUNHNmRtR2hUNHpOQ1ZvenR6NmhnSk5ncUFGUnEzYUorTmVrRzZy?= =?utf-8?B?ZUdIVzFjZFAzUGQ0WXRmRkpJZzMyOGpSZmY2UGp1b3FDSExvL0k3bDJreEln?= =?utf-8?B?M09Od1pNZForcmMxQXdRcmNqblJDTjc2VnpKZmd0YkZHQ0tHQ01JMlNsZ3Nz?= =?utf-8?B?SE5IRm56L1o3N1doSTd0UnZGK1RSSmZMaFFsdFFYcHNpaXFFbzR0cXhtcVpk?= =?utf-8?B?bFNUemR5a1IxK1cwMHVMeEJBSlk0T1BCa0EvcWVKSllLT1NoQVVBRTUreVhx?= =?utf-8?B?b2tyd1pBTFNxZDkzeEtqTS9aR2ppZWd3QTAyazgvc2RFVDh2VzlsY1VobS80?= =?utf-8?B?ako1UzFOMVVldDhUU2NlWEhVYjF4UjZEQktwQlorMXlQNy9tR25XbDBvekVI?= =?utf-8?B?ZnRncUYyNEhuYjJ5L054Uis3YzdRWjZ5RjBiTWZJU2NxL0VoeE1jY1JiT1pW?= =?utf-8?B?azBBdmRjQTlIL2p0VndzWDdONlJhbFozT256d2VCNW5Bd3d4R2JkSEdaKzha?= =?utf-8?B?ZGloeVhlcitTbGREVTBWUVo2TGVpekxKUGZYQ0FWQlVzdXgxNlptWUdjQ0Rm?= =?utf-8?B?Ly9Vd1JGRFNqOWc5ZTFwM3FCZGI3cmhwNGQyZ29pRy9XN2xHa3VONWVPTDF6?= =?utf-8?B?aHZSNXl1OUY2a0o5UW9EeGJ5SGF5VzJwMHpWb3V6SVJQUysrMFRMS0VoSVpE?= =?utf-8?B?V0FzYkVkQnM5bGRvZ3VldWp1OUFhaGorQzh3akxHb2x4VlRHdlM3a21halBt?= =?utf-8?B?cVROOGM3V0FCMDFoWW5JTjgrc3IrVW8xa0JiaUZQWXFvdFd6YXVvdy90bVU2?= =?utf-8?B?WDc0MC9ySkhOaHp6R1FLOTZtK0hoNUl1eTZLTHZ6Z1ArcTFQeklDSmVWRXZO?= =?utf-8?B?SmNzVnlxZkphQ1BBVTBHM3RkOWNvL2hCNE4rQWFSUEVNS3BVNUZablNmOGlz?= =?utf-8?B?dCtoY3lwZzVVbkVKMGZjRFBwQyszYjJXaXR3eGR0ZjA0R0FES0F4RXlUZ2sv?= =?utf-8?B?Z2pSd0ZTRENPdktwRjNnd3R2ZDVFUDRQbHdkdWNvS245MTlmYlJzZlU4RFNw?= =?utf-8?B?OWd1L2I4ajNHTTlRMXozcVBwUlBQOUhWWHN5TTFUeUxyNTJpZDZEb3ZqS3pa?= =?utf-8?B?QzNRa2JqM1FrL3ZXQjBZZXVIR1NOSkxWZENlVDlNNlBPWldhcXRPTnZNQnls?= =?utf-8?B?ZzNPNnczZ29PcngrcDgxZHd5T3dac0tZZnBtOVBtNzFuVVdoMm1XRkZJZWJv?= =?utf-8?B?cURDVmo1WDRrMm9Dbm13bzFud0xJU0x0R09zVGg4dXQ4Tmw1VjZTdW9Yc1JT?= =?utf-8?B?T253R3B6d0FKQ1Q2bWg4Z3huK25EWFVEQUZmUmlKMkMwaU9FdGJVVWFIY2VZ?= =?utf-8?B?ZERLbXo0RC9abGc3Uk51c0xWT3BSamlCRUU1SWJIVURhNUlyMXBmaWxJejRz?= =?utf-8?B?aDR0My9ERDU4VHpBK0hsaGlRek1Kd3BvM21rUU03cXJRUTNoRnhibWM4LzFE?= =?utf-8?B?eFB5RnAyWFk4OE9sWmpDYnBMdnkvMEViMXVmZlF1VHJMQ1VMa0ZudlNBbk1y?= =?utf-8?B?WHVKL2U1S1U2RWU5eTYrYkI4eGxzT2YrWnFoSmJWeS9jWW5tdktEYXRtdWEv?= =?utf-8?B?VnRxcUpQRVJxRDdPbEFUZW96Ui9JQmNyYXNaTURJclNWM3MxQUJFUjdUQjRm?= =?utf-8?Q?tapVgDJcqxeIbFU67c?= X-OriginatorOrg: amd.com X-MS-Exchange-CrossTenant-Network-Message-Id: 7d92cc9b-84e1-45d6-2609-08def868b9bb X-MS-Exchange-CrossTenant-AuthSource: CH3PR12MB8547.namprd12.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 12 Aug 2026 11:56:21.2196 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 3dd8961f-e488-4e60-8e11-a82d994e183d X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: K5VGVwCPVsxd2MgMfh0odLO0Im6uv6/2AQNoQVEp1RSU8yuAP82Q2TdkGNgRQvwu X-MS-Exchange-Transport-CrossTenantHeadersStamped: LV3PR12MB9265 Abhijit Gangurde wrote on 8/7/2026 12:06 PM: > When an MCDI command times out, cdx_mcdi_timeout_cmd() frees the cmd > via cdx_mcdi_remove_cmd() but does not clear mcdi->seq_held_by[] or > mcdi->db_held_by. If the firmware responds after the timeout, > cdx_mcdi_process_cmd() dereferences the freed cmd pointer leading to a > use-after-free. > > clear the seq_held_by and db_held_by in the timeout path, and > add an extra kref to handle the race where the response arrives > concurrently with the timeout handler. > > Fixes: eb96b740192b ("cdx: add MCDI protocol interface for firmware interaction") > Co-developed-by: Prasanna Kumar T S M > Signed-off-by: Prasanna Kumar T S M > Signed-off-by: Abhijit Gangurde > --- Reviewed-by: Nikhil Agarwal