[PATCH 0/1] tty: serial: samsung: fix TX fifo underflow on flush race

[tianci xie <xiex16070@gmail.com>]

On Sat, Oct 31, 2026 at 09:54:55AM +0100, Greg Kroah-Hartman wrote:
> Always just send us patches, after testing them, you never need to ask
> if you should do so.

Understood.  Here is the samsung_tty part of the report; the other four
drivers are separate and I have not touched them.

The analysis holds up against mainline.  Neither s3c64xx_serial_ops nor
apple_s5l_serial_ops has a ->flush_buffer() callback, and
s3c24xx_serial_tx_dma_complete() samples tx_bytes_requested before it
takes the port lock.  A completion that raced with uart_flush_buffer()
therefore advances the freshly reset kfifo by the byte count of the
discarded transfer, and since kfifo_skip_count() does not clamp, ->out
passes ->in and kfifo_len() wraps.

One detail worth adding to the report.  In 29bef7990845, where TX DMA was
introduced, the callback advanced the buffer with

	xmit->tail = (xmit->tail + count) & (UART_XMIT_SIZE - 1);

so an over-advance was masked away and could not wrap.  The wrap only
became possible once the driver moved to the kfifo helpers, which drop
the mask.  That is probably why this never showed up on the older code.

The patch follows the 8250 fix in 9e512eaaf8f4, with one addition.  The
8250 changelog says that clearing the outstanding byte count under the
port lock is sufficient "since the port lock is held when the kfifo is
reset in uart_flush_buffer() and in __dma_tx_complete()".  That holds for
8250 because __dma_tx_complete() reads tx_size inside the lock.  Here the
count is read before the lock, so clearing alone would not help; the
patch also moves the sample under the lock.  The same gap applies to
serial-tegra as reported.

Testing so far:

  - BUILD_RESULT: builds cleanly with gcc 12.3 on x86_64 (COMPILE_TEST,
    CONFIG_SERIAL_SAMSUNG=m, W=1) and with aarch64-linux-gcc 13.3.0 on
    arm64 (arm64 defconfig, which enables ARCH_EXYNOS, ARCH_APPLE and
    SERIAL_SAMSUNG_CONSOLE); no warnings from the new code.
  - BOOT_OR_RUNTIME_RESULT: not booted; I have no Exynos or Apple board.
    Runtime behaviour is covered by the exhaustive interleaving model.
  - the patch applies to mainline at 83f32c773255 with git am;
  - a model of the two actors, with the kfifo semantics taken from
    include/linux/kfifo.h, exhausts every interleaving under the port
    lock: the unpatched callback wraps kfifo_len() in all four flush
    scenarios, the patched one in none, and both agree when no flush
    happens.

I do not have a Linux machine of my own.  The x86_64 build above was run
on a rented Linux server, and the arm64 build was cross-compiled there
with a no-libc aarch64 toolchain; that is as far as I can take testing
without hardware.  There is no Exynos or Apple board available to me, so
the model is what stands in for a runtime reproduction.  If you would
rather have the flush modelled as a KUnit test in the tree, say so and I
will send that instead.

Thanks,
tianci xie


tianci xie (1):
  tty: serial: samsung: fix TX fifo underflow on flush race

 drivers/tty/serial/samsung_tty.c | 40 +++++++++++++++++++++++++++++++-
 1 file changed, 39 insertions(+), 1 deletion(-)