Re: [PATCH 1/5] tty: serdev: Export functions to pause receive_buf callback calls

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] ttyport_resume_rx calls the producer API tty_flip_buffer_push from the consumer side, racing with active producers and exposing uninitialized memory.
--

commit bcc044ef1e478c63e3d04ef2d46ec10ebc5b78ee
Author: Markus Probst <markus.probst@posteo.de>

tty: serdev: Export functions to pause receive_buf callback calls
    
These functions will be used to simply the serdev rust abstraction. It
also contributes to the fixing of 2 race conditions in the serdev rust
abstraction.

> diff --git a/drivers/tty/serdev/serdev-ttyport.c b/drivers/tty/serdev/serdev-ttyport.c
> index bab1b143b8a68..85ab454c2f13a 100644
> --- a/drivers/tty/serdev/serdev-ttyport.c
> +++ b/drivers/tty/serdev/serdev-ttyport.c
[ ... ]
> @@ -156,6 +161,31 @@ static void ttyport_close(struct serdev_controller *ctrl)
>  	tty_release_struct(tty, serport->tty_idx);
>  }
>  
> +static void ttyport_pause_rx(struct serdev_controller *ctrl)
> +{
[ ... ]
> +}
> +
> +static void ttyport_resume_rx(struct serdev_controller *ctrl)
> +{
> +	struct serport *serport = serdev_controller_get_drvdata(ctrl);
> +	struct tty_struct *tty = serport->tty;
> +
> +	clear_bit(SERPORT_PAUSE_RX, &serport->flags);
> +
> +	if (test_bit(SERPORT_ACTIVE, &serport->flags))
> +		tty_flip_buffer_push(tty->port);

[Severity: High]
Does calling tty_flip_buffer_push() from the consumer context create a data
race on the tail->commit index?

Because tty_flip_buffer_push() commits unwritten buffer space (moving
tail->used to tail->commit), this could cause the consumer worker to read
uninitialized memory and pass garbage data to the receive_buf callback.

For example, if the serdev consumer calls serdev_device_resume_rx(), and
concurrently a UART hardware IRQ receives data and calls
tty_prepare_flip_string() (which increments tb->used).

If this call to tty_flip_buffer_push() executes before the UART driver writes
data to the buffer, it commits the pre-incremented tb->used.

Is there a way for the consumer to wake up the worker without committing
unwritten data, rather than invoking producer APIs directly?

> +}
> +

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260906-rust_serdev_probe_refactor-v1-0-69cdae0074ec@posteo.de?part=1