[PATCH 2/2] firmware: arm_scmi: Don't reuse raw xfers with async_done still armed

[Cristian Marussi]

On Fri, Aug 14, 2026 at 08:15:34PM +0000, Roland Dreier via B4 Relay wrote:
> From: Roland Dreier <rolanddreier at rivian.com>
> 
> In SCMI raw mode, scmi_xfer_raw_worker() releases the xfer before
> releasing the waiter that disarms xfer->async_done, and scmi_xfer_get()
> does not clear async_done when it hands out a recycled xfer. A concurrent
> transaction can therefore pick up the xfer while it still points at the
> old waiter's completion, so:
> 
>  - a delayed response arriving for the new transaction can be signalled
>    on the old waiter's completion, which may already be re-armed for yet
>    another unrelated transaction, making that transaction's wait return
>    early; and
> 
>  - the old waiter's disarm, which still runs after the xfer has been
>    released, clobbers the arming just installed by the new transaction,
>    so the new waiter times out even if its delayed response arrives.
> 
> Release the waiter first, while the worker still holds a reference on
> the xfer, so that an xfer can never reach the free list still
> armed. Track whether a delayed response is expected in the waiter
> itself instead of peeking at xfer->async_done outside xfer->lock, and
> wait on the waiter's own embedded completion. (The new async flag is
> not strictly needed but it makes the logic easier to reason about)
> 
> Finally, harden scmi_xfer_get() to clear async_done when handing out
> an xfer, so that no future release-ordering change can leak a stale
> arming into a new transaction.
> 
> Fixes: 3c3d818a9317 ("firmware: arm_scmi: Add core raw transmission support")
> Signed-off-by: Roland Dreier <rolanddreier at rivian.com>

Hi,

thanks for this.

LGTM.

Reviewed-by: Cristian Marussi <cristian.marussi at arm.com>
Tested-by: Cristian Marussi <cristian.marussi at arm.com>

Thanks,
Cristian