From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DE625392C21; Tue, 25 Aug 2026 13:51:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787665893; cv=none; b=bkVqkqBfEhKnYiW3F42T3SjhNGo07gQs1EcchMm71FhPvbFU+j8/69L0iaeJN8A/IxyiqAJzDQjFXSGjVU0afGdWnUYjJ+KN14Hv4SJf5e6gcsYrTDa1aP4H0nYC9pTrqXPGAn95MdQPKiy+OOMMfrlFvWJT86Pr4uM/3nvyYb4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787665893; c=relaxed/simple; bh=PGJ0E1kh/TXDWEtLtzRfsZccZe1WDRPifrOzWxDLBqQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=BvKyLFgVt2kxd7BYBMEIr/R0CTW8+LIkbFQ89WOD3pPRvGyEoQpG3RNs1BBROvRD+ZolVec9330VnSAAvy0EDWo0GYfumEOviqf+hpIfPgpWamnvkOkB7/2lyAhiyJxP9Tdn1EjHvAjSEmxnGRvHdijVX9gtkeQPjUVXgg8Nbe4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=tBntep+1; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="tBntep+1" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3784D1F000E9; Tue, 25 Aug 2026 13:51:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1787665891; bh=Ac00odrekr6e3jeGP1/lmT9o6gCToldq2AC0ZQ+u/0A=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=tBntep+1kYEK6mGHIZO1rGzdNiIvOxspuPyaXs8yc0DAL0jZOMgFPmRs94UPcT8Az oX6vG/6nSXmETgCL6hYvhp3tMmJHbLcoGDj/DKeso9XqBxvXKqPGdx/tRHhBALzvx8 e221TSsW85ijQ7qSdwdD/3ESU3aA0E60RgsgSzLA= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, stable , Fan Wu , Sasha Levin Subject: [PATCH 6.1 14/79] serial: amba-pl011: synchronize DMA teardown Date: Tue, 25 Aug 2026 15:25:54 +0200 Message-ID: <20260825132542.221147171@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260825132541.677185791@linuxfoundation.org> References: <20260825132541.677185791@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.1-stable review patch. If anyone has any objections, please let me know. ------------------ From: Fan Wu [ Upstream commit 440915499231e9db1c361aa45bb702e8fd3b4a32 ] dmaengine_terminate_all() does not wait for a running callback, so the TX callback can still touch the TX buffer after it is freed. The RX poll timer reads the RX buffers without the port lock. Switch to dmaengine_terminate_sync() and delete the RX timer before freeing the buffers. Fixes: ead76f329f77 ("ARM: 6763/1: pl011: add optional RX DMA to PL011 v2") Cc: stable Assisted-by: Codex:gpt-5.6 Signed-off-by: Fan Wu Link: https://patch.msgid.link/20260731085915.326775-4-fanwu01@zju.edu.cn Signed-off-by: Greg Kroah-Hartman [ changed upstream's `timer_delete_sync()` deletion to match this tree's `del_timer_sync()` spelling at the old call site ] Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman --- drivers/tty/serial/amba-pl011.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) --- a/drivers/tty/serial/amba-pl011.c +++ b/drivers/tty/serial/amba-pl011.c @@ -1193,7 +1193,7 @@ static void pl011_dma_shutdown(struct ua if (uap->using_tx_dma) { /* In theory, this should already be done by pl011_dma_flush_buffer */ - dmaengine_terminate_all(uap->dmatx.chan); + dmaengine_terminate_sync(uap->dmatx.chan); if (uap->dmatx.queued) { dma_unmap_single(uap->dmatx.chan->device->dev, uap->dmatx.dma, uap->dmatx.len, @@ -1206,12 +1206,12 @@ static void pl011_dma_shutdown(struct ua } if (uap->using_rx_dma) { - dmaengine_terminate_all(uap->dmarx.chan); + if (uap->dmarx.poll_rate) + timer_delete_sync(&uap->dmarx.timer); + dmaengine_terminate_sync(uap->dmarx.chan); /* Clean up the RX DMA */ pl011_dmabuf_free(uap->dmarx.chan, &uap->dmarx.dbuf_a, DMA_FROM_DEVICE); pl011_dmabuf_free(uap->dmarx.chan, &uap->dmarx.dbuf_b, DMA_FROM_DEVICE); - if (uap->dmarx.poll_rate) - del_timer_sync(&uap->dmarx.timer); uap->using_rx_dma = false; } }