From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A70CF43B483; Mon, 17 Aug 2026 13:58:36 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786975117; cv=none; b=BWM4VVYkrf5JKVgwzGcbSlKrJQuahjj/Xk82zgIY6XNKGoVm95C7h77l9Ie6EcLcQ509P5mVRdgvPuDvsin+pSC2YayG/O3dXpTMx7XkbvUlZ0X0E9asn0ikOP5vlcHWeaJBHGqGnwfg/c+1luTl0JjoRt+Qw8xwjG+uvmRI9Qg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786975117; c=relaxed/simple; bh=lteoI74JntbfcskEiHb4xorWEo8LDU/32L8IyLavpCM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=NN7wnH/afV7JbJD+/uBjjCdDjr+XGp7OZtyitWZJ99NLKp4B5o+jKbdLNuj2F+Hs164A6lPDHHqDJbmzimy8RZrOuGnC9N72BKcJ1YFsv5aDEJn3ZxIQ6nFm2hVVKc5AYRfd/j6u5S0LXKgaXEnJ7MwfD3I5DmJRVdWRnTRN2QM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=n3S6wvtm; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="n3S6wvtm" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 05A761F000E9; Mon, 17 Aug 2026 13:58:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1786975116; bh=AsYb6QOCjrzk100p3mRg18Ur/TYP1JKQivDAKruNQoc=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=n3S6wvtm9YKaZhD/sDgfjMD4C9AJhvMeJ0fHSb3/qyru9KIfGI4RjPQqmHpX7D4N9 l4o0AQIifjBhhKSs45MDaj6siBlDeQIoLm2QvD8q6T2nl1KRk1J4pACggovfi/uwsC K29DBfrmqZtINKW0368HFNxVyT3pJ1Zh+cEwbyGk= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, stable , Fan Wu Subject: [PATCH 6.18 169/250] serial: amba-pl011: synchronize DMA teardown Date: Mon, 17 Aug 2026 15:32:10 +0200 Message-ID: <20260817132543.539047200@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260817132536.466235697@linuxfoundation.org> References: <20260817132536.466235697@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Fan Wu commit 440915499231e9db1c361aa45bb702e8fd3b4a32 upstream. dmaengine_terminate_all() does not wait for a running callback, so the TX callback can still touch the TX buffer after it is freed. The RX poll timer reads the RX buffers without the port lock. Switch to dmaengine_terminate_sync() and delete the RX timer before freeing the buffers. Fixes: ead76f329f77 ("ARM: 6763/1: pl011: add optional RX DMA to PL011 v2") Cc: stable Assisted-by: Codex:gpt-5.6 Signed-off-by: Fan Wu Link: https://patch.msgid.link/20260731085915.326775-4-fanwu01@zju.edu.cn Signed-off-by: Greg Kroah-Hartman Signed-off-by: Greg Kroah-Hartman --- drivers/tty/serial/amba-pl011.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) --- a/drivers/tty/serial/amba-pl011.c +++ b/drivers/tty/serial/amba-pl011.c @@ -1182,7 +1182,7 @@ static void pl011_dma_shutdown(struct ua if (uap->using_tx_dma) { /* In theory, this should already be done by pl011_dma_flush_buffer */ - dmaengine_terminate_all(uap->dmatx.chan); + dmaengine_terminate_sync(uap->dmatx.chan); if (uap->dmatx.queued) { dma_unmap_single(uap->dmatx.chan->device->dev, uap->dmatx.dma, uap->dmatx.len, @@ -1195,12 +1195,12 @@ static void pl011_dma_shutdown(struct ua } if (uap->using_rx_dma) { - dmaengine_terminate_all(uap->dmarx.chan); + if (uap->dmarx.poll_rate) + timer_delete_sync(&uap->dmarx.timer); + dmaengine_terminate_sync(uap->dmarx.chan); /* Clean up the RX DMA */ pl011_dmabuf_free(uap->dmarx.chan, &uap->dmarx.dbuf_a, DMA_FROM_DEVICE); pl011_dmabuf_free(uap->dmarx.chan, &uap->dmarx.dbuf_b, DMA_FROM_DEVICE); - if (uap->dmarx.poll_rate) - timer_delete_sync(&uap->dmarx.timer); uap->using_rx_dma = false; } }