Re: [PATCH 2/2] serial: tegra: fix TX DMA descriptor use-after-free

[sashiko-bot@kernel.org]

> From: Austin <austin.schlegel@arthrex.com>
> 
> tegra_uart_stop_tx() calls dmaengine_terminate_all() and then
> async_tx_ack(tup->tx_dma_desc) on the descriptor that was just
> terminated. With the GPC DMA driver, dmaengine_terminate_all() frees
> the active descriptor immediately, so the ack call that follows
> touches freed memory, the same use-after-free pattern fixed for the
> RX path in tegra_uart_terminate_rx_dma() ("serial: tegra: fix RX DMA
> descriptor use-after-free"). dmaengine clients must not touch a
> descriptor once dmaengine_terminate_all() has returned.
> 
> Move the ack before dmaengine_terminate_all(), while the descriptor
> is still owned by the driver. tegra_uart_tx_dma_complete() already
> acks inside the completion callback, where the descriptor is valid,
> and is unaffected.
> 
> Found by code inspection while fixing the analogous RX bug; not
> reproduced on hardware, since triggering it requires stopping an
> in-flight TX DMA transfer (e.g. via a modem control line or flush)
> at the right moment. The RX and TX paths share the same
> dmaengine_terminate_all()-then-ack structure and the same root cause.
> 
> Signed-off-by: Austin <austin.schlegel@arthrex.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261001-tty-linus-v1-0-ecb8576c802d@arthrex.com?part=2