Re: [PATCH v3 1/3] serial: tegra: fix RX DMA descriptor use-after-free

[sashiko-bot@kernel.org]

> From: Austin Schlegel <schlegelas@outlook.com>
> 
> tegra_uart_terminate_rx_dma() calls dmaengine_terminate_all() and then
> tegra_uart_rx_buffer_push(), which calls async_tx_ack(tup->rx_dma_desc)
> on the just-terminated descriptor. With the GPC DMA driver,
> dmaengine_terminate_all() frees the active descriptor immediately, so
> the subsequent async_tx_ack() touches freed memory. dmaengine clients
> are not allowed to touch a descriptor once it has been terminated.
> 
> Move the ack into the two call sites that still own a live descriptor:
> tegra_uart_rx_dma_complete() (before the completion callback hands the
> descriptor back) and tegra_uart_terminate_rx_dma() (before terminating),
> and drop it from tegra_uart_rx_buffer_push() itself, since that function
> no longer has a descriptor it's safe to ack.
> 
> [ ... ]
> 
> Fixes: b31245b94207 ("serial: tegra: ack the rx dma desc after transfer terminated")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Austin Schlegel <schlegelas@outlook.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261022-serial-tegra-dma-uaf-v3-0-129f6d67f673@outlook.com?part=1