From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id AF50D371049; Mon, 27 Apr 2026 03:51:42 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777261902; cv=none; b=Pn0y2CPo49QD+tIkN5OK7YekgVUhzD2y/1S+nkE+BqUWC1A1Hx5a2M7XGDo499AMLJwQWmYXePA1DXV4GMdsQj8+1o0TPJPnA1U69zPKQ+o7H01gRDDoKe/vrOvgbNa2Lb97qpt3mA0CaAukYkrF+iwlT5VxegUIZ9H/TmhsBXg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777261902; c=relaxed/simple; bh=qfOWciOdj+AxDU1vozH6V2JW/zfXtz0rerqMJUQ6QNo=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=IF7S8u22R+PcN46iLwVR3b6qeqEbYD4Lvwnhu0BoGcy9vd6LPPs2orvI5lz7dXVutolkCE10qnsB7X/HfSR2/9Ofp1PwnrT70lMhymkj0PBEJ/FFa5SQh67Vz66PQsZ7GkFNwoyaevytprRBkLmrnoXYbIoyfhLYYUvu9fiGmPE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Y2A1vmxH; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="Y2A1vmxH" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 55FAAC19425; Mon, 27 Apr 2026 03:51:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1777261902; bh=qfOWciOdj+AxDU1vozH6V2JW/zfXtz0rerqMJUQ6QNo=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=Y2A1vmxHwpLDmtWzkIcHn4RL2q2l73mUiCLJFGlKnCmMkfihR7TpeoWwqqMqOrcMR P9neA699PPDHfJfCT/JvSxn+BH++su3d5omrSZHXs+pyGhuVwDDrIlRi60cMf0YNFu tAh7nu8zl/HUrV7KYg+8arKMphSSjHpqWbVPm6Rk= Date: Sun, 26 Apr 2026 22:45:06 +0200 From: Greg Kroah-Hartman To: "Maciej W. Rozycki" Cc: Thomas Bogendoerfer , Jiri Slaby , Elena Reshetova , David Windsor , Kees Cook , Hans Liljestrand , linux-mips@vger.kernel.org, linux-serial@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH 4/4] Revert "drivers: convert sbd_duart.map_guard from atomic_t to refcount_t" Message-ID: <2026042630-diaphragm-reactor-7cfe@gregkh> References: Precedence: bulk X-Mailing-List: linux-serial@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: On Mon, Apr 13, 2026 at 04:28:53AM +0100, Maciej W. Rozycki wrote: > Revert commit 22a33651a56f ("drivers: convert sbd_duart.map_guard from > atomic_t to refcount_t"), which broke perfectly valid code: > > ------------[ cut here ]------------ > WARNING: CPU: 1 PID: 1 at lib/refcount.c:114 sbd_request_port+0x54/0x140 > refcount_t: increment on 0; use-after-free. > CPU: 1 PID: 1 Comm: swapper/0 Not tainted 4.11.0-rc2+ #34 > Stack : 0000000014001fe0 0000000000000000 ffffffff80830000 0000000000000000 > ffffffff8127bc7a ffffffff8016fe08 ffffffff808d0000 ffffffff808d0000 > ffffffff807aa828 ffffffff80822337 ffffffff808ce188 a8000001860b0000 > 0000000000000001 0000000000000001 00000000000001c8 ffffffff808a3090 > 00000000000000bb ffffffff801b09d4 a80000018609bb68 ffffffff801231cc > ffffffff812a0000 ffffffff80171388 0000000000001000 ffffffff807aa828 > 0000000000000001 0000000000000001 0000000000000000 0000000000000000 > 0000000000000000 a80000018609bab0 0000000000000000 ffffffff803c47cc > 0000000000000000 0000000000000000 0000000000000000 0000000000000000 > ffffffff807cb648 ffffffff8010bff8 0000000014001fe1 ffffffff803c47cc > ... > Call Trace: > [] show_stack+0x28/0x88 > [] dump_stack+0x8c/0xc0 > [] __warn+0xe0/0x114 > [] warn_slowpath_fmt+0x40/0x50 > [] sbd_request_port+0x54/0x140 > [] sbd_config_port+0x2c/0x68 > ---[ end trace f666d696412caa3e ]--- > > (report at the offending commit) -- sbd_request_port() is called twice > per DUART instance, to reserve a resource holding the control register > block shared between the two channels, so there's no slightest chance > for an overflow. Also this doesn't stop the driver from working and > it's just the reservation that is missing as a result, i.e.: > > 10060100-100601ff : sb1250-duart > 10060200-100602ff : sb1250-duart > > as from the offending change, vs: > > 10060100-100601ff : sb1250-duart > 10060200-100602ff : sb1250-duart > 10060300-100603ff : sb1250-duart > > beforehand, which is surely why the breakage has gone so long unnoticed. > > "If it ain't broke, don't fix it," so just revert the broken commit. How about fix this up to work properly with a refcount? having "open coded" atomic variables like this is ripe for problems, like it seems this driver is abusing. thanks, greg k-h