[PATCH v3] tty: serial: lpuart: Add port lock for registers read in lpuart32_set_termios()

[PATCH v3] tty: serial: lpuart: Add port lock for registers read in lpuart32_set_termios()

[Sherry Sun (OSS)]

From: Sherry Sun <sherry.sun@nxp.com>

lpuart32_set_termios() reads UARTCTRL at function entry without holding
the port lock. lpuart32_console_write() can run concurrently on another
CPU and temporarily clears the RIE (Receiver Interrupt Enable) bit while
it polls characters out. If the unlocked read in set_termios lands inside
that window, the stale snapshot is written back, permanently clearing
RIE. Once lost, no normal code path re-enables them, so the UART stops
receiving characters and becomes unresponsive.

Need to add port lock for the registers read in lpuart32_set_termios() to
avoid the unlocked snapshot captured. Since neither uart_get_baud_rate()
nor lpuart_dma_rx_free() uses ctrl, old_ctrl, bd, or modem, the register
reads and bit manipulations could be moved into the existing
uart_port_lock_irqsave() critical section after lpuart_dma_rx_free().

Please note that this only fix the normal printk path, in the
oops_in_progress path of lpuart32_console_write(), when trylock fails,
RIE is cleared and old_cr restored without the port lock held, there is
still a risk of stale snapshot, but it's acceptable for the post-oops
state and the trylock-fail window.

Fixes: 380c966c093e ("tty: serial: fsl_lpuart: add 32-bit register interface support")
Signed-off-by: Sherry Sun <sherry.sun@nxp.com>
---
Changes in v3:
- Fix the typo s/acqur/acquir as Daniel suggested.
- Link to v2: https://lore.kernel.org/r/20261112-lpuart_port_lock-v2-1-e1d914e52660@nxp.com

Changes in v2:
- As suggested by Sashiko, since neither uart_get_baud_rate() nor
  lpuart_dma_rx_free() uses ctrl, old_ctrl, bd, or modem, move the
  register reads and bit manipulations into the existing
  uart_port_lock_irqsave() critical section after lpuart_dma_rx_free().
- Link to v1: https://lore.kernel.org/r/20261111-lpuart_port_lock-v1-1-5d332c51edfe@nxp.com
---
 drivers/tty/serial/fsl_lpuart.c | 29 ++++++++++++++---------------
 1 file changed, 14 insertions(+), 15 deletions(-)

diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
index cd2575a3aef7..6e0da217c404 100644
--- a/drivers/tty/serial/fsl_lpuart.c
+++ b/drivers/tty/serial/fsl_lpuart.c
@@ -2241,6 +2241,20 @@ lpuart32_set_termios(struct uart_port *port, struct ktermios *termios,
 	unsigned int  baud;
 	unsigned int old_csize = old ? old->c_cflag & CSIZE : CS8;
 
+	/* ask the core to calculate the divisor */
+	baud = uart_get_baud_rate(port, termios, old, 50, port->uartclk / 4);
+
+	/*
+	 * Need to update the Ring buffer length according to the selected
+	 * baud rate and restart Rx DMA path.
+	 *
+	 * Since timer function acquires port->lock, need to stop before
+	 * acquiring same lock because otherwise timer_delete_sync() can deadlock.
+	 */
+	if (old && sport->lpuart_dma_rx_use)
+		lpuart_dma_rx_free(port);
+
+	uart_port_lock_irqsave(port, &flags);
 	ctrl = old_ctrl = lpuart32_read(port, UARTCTRL);
 	bd = lpuart32_read(port, UARTBAUD);
 	modem = lpuart32_read(port, UARTMODIR);
@@ -2320,21 +2334,6 @@ lpuart32_set_termios(struct uart_port *port, struct ktermios *termios,
 		ctrl &= ~UARTCTRL_PE;
 	}
 
-	/* ask the core to calculate the divisor */
-	baud = uart_get_baud_rate(port, termios, old, 50, port->uartclk / 4);
-
-	/*
-	 * Need to update the Ring buffer length according to the selected
-	 * baud rate and restart Rx DMA path.
-	 *
-	 * Since timer function acqures port->lock, need to stop before
-	 * acquring same lock because otherwise timer_delete_sync() can deadlock.
-	 */
-	if (old && sport->lpuart_dma_rx_use)
-		lpuart_dma_rx_free(port);
-
-	uart_port_lock_irqsave(port, &flags);
-
 	port->read_status_mask = 0;
 	if (termios->c_iflag & INPCK)
 		port->read_status_mask |= UARTSTAT_FE | UARTSTAT_PE;

---
base-commit: 793807ca13bf3072fc6d16ce6d90e9ab9beff2a5
change-id: 20261111-lpuart_port_lock-01f7deab451a

Best regards,
-- 
Sherry Sun <sherry.sun@nxp.com>

Re: [PATCH v3] tty: serial: lpuart: Add port lock for registers read in lpuart32_set_termios()

[sashiko-bot]

> From: Sherry Sun <sherry.sun@nxp.com>
> 
> lpuart32_set_termios() reads UARTCTRL at function entry without holding
> the port lock. lpuart32_console_write() can run concurrently on another
> CPU and temporarily clears the RIE (Receiver Interrupt Enable) bit while
> it polls characters out. If the unlocked read in set_termios lands inside
> that window, the stale snapshot is written back, permanently clearing
> RIE. Once lost, no normal code path re-enables them, so the UART stops
> receiving characters and becomes unresponsive.
> 
> Need to add port lock for the registers read in lpuart32_set_termios() to
> avoid the unlocked snapshot captured. Since neither uart_get_baud_rate()
> nor lpuart_dma_rx_free() uses ctrl, old_ctrl, bd, or modem, the register
> reads and bit manipulations could be moved into the existing
> uart_port_lock_irqsave() critical section after lpuart_dma_rx_free().
> 
> Please note that this only fix the normal printk path, in the
> oops_in_progress path of lpuart32_console_write(), when trylock fails,
> RIE is cleared and old_cr restored without the port lock held, there is
> still a risk of stale snapshot, but it's acceptable for the post-oops
> state and the trylock-fail window.
> 
> Fixes: 380c966c093e ("tty: serial: fsl_lpuart: add 32-bit register interface support")
> Signed-off-by: Sherry Sun <sherry.sun@nxp.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261113-lpuart_port_lock-v3-1-895c8758a9db@nxp.com?part=1