Re: [PATCH v2 1/2] serial: core: do not hold the port mutex while waiting for references

[sashiko-bot@kernel.org]

> serial_core_remove_one_port() takes the port mutex and then waits for
> the uart_port_ref() holders to drop their references. Since commit
> 8ca59f7baee7 ("serial: fix ioctl hangup race") uart_wait_until_sent()
> takes the port mutex on every poll iteration to check for the hangup
> before it touches the hardware, while holding its reference for the
> whole wait. A tcdrain() in flight when the port is removed therefore
> deadlocks: the removal holds the mutex and waits for the reference,
> the drain holds the reference and waits for the mutex. Both tasks sit
> uninterruptible, and the port is unusable until a reboot.
> 
> Reproduced by unbinding a UART driver while a process drains a few
> kilobytes at 300 baud: the unbind blocks in wait_event() under the
> mutex, the drain in mutex_lock(), and reading the driver's proc file
> blocks on the same mutex.
> 
> Drop the mutex around the decrement and the wait. The decrement is an
> atomic paired with uart_port_ref() and uart_port_deref(), which never
> take the mutex; the clearing of the port pointer stays under it, where
> uart_port_check() readers expect it. Between the hangup and this wait
> the removal already runs without the mutex, so a mutex holder seeing
> the released port is not a new state.
> uart_wait_modem_status() takes a reference and then the mutex in the
> same way, with a smaller window, and is covered by the same change.
> 
> Fixes: 8ca59f7baee7 ("serial: fix ioctl hangup race")
> Cc: <stable@vger.kernel.org>
> Reviewed-by: Johan Hovold <johan@kernel.org>
> Tested-by: Johan Hovold <johan@kernel.org>
> Signed-off-by: Tapio Reijonen <tapio.reijonen@vaisala.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261112-serial-core-remove-deadlock-v2-0-d3ee4ccec37a@vaisala.com?part=1