Re: [PATCH v2 1/3] tty: serdev: Export functions to pause receive_buf callback calls

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] tty: missing hardware memory barrier after test_bit() on weakly ordered archs
--

commit 85ed03352c1176c6dcb07b7e3b1ab8aa8ce0db1d
Author: Markus Probst <markus.probst@posteo.de>

tty: serdev: Export functions to pause receive_buf callback calls

This commit introduces functions to pause and resume the receive_buf
callback in the serdev core. These changes are intended to simplify the
serdev Rust abstraction and help resolve race conditions in data
reception handling.

> diff --git a/drivers/tty/serdev/serdev-ttyport.c b/drivers/tty/serdev/serdev-ttyport.c
> index bab1b143b8a68..e8aa89e733bd8 100644
> --- a/drivers/tty/serdev/serdev-ttyport.c
> +++ b/drivers/tty/serdev/serdev-ttyport.c
> @@ -32,6 +34,14 @@ static size_t ttyport_receive_buf(struct tty_port *port, const u8 *cp,
>  	if (!test_bit(SERPORT_ACTIVE, &serport->flags))
>  		return 0;
>  
> +	if (test_bit(SERPORT_PAUSE_RX, &serport->flags))
> +		return 0;
> +
> +	/*
> +	 * Ensure writes by the driver are visible before allowing traffic to resume.
> +	 */
> +	smp_mb__after_atomic();
> +
>  	ret = serdev_controller_receive_buf(ctrl, cp, count);

[Severity: High]
Does this fail to provide a hardware memory barrier after test_bit() on weakly
ordered architectures?

According to the kernel documentation for atomic bitops, test_bit() is a
non-RMW (read-modify-write) operation. The smp_mb__after_atomic() macro is
strictly intended for RMW operations.

On weakly ordered architectures where atomic RMWs are naturally ordered,
smp_mb__after_atomic() expands to a mere compiler barrier without emitting an
actual hardware fence. As a result, the CPU may be free to reorder the load of
SERPORT_PAUSE_RX with subsequent driver data loads inside
serdev_controller_receive_buf().

Could this reordering lead to the consumer observing stale buffer state,
potentially causing data corruption or dropped RX data?

Would it be more appropriate to use test_bit_acquire() or a full smp_mb() here
to establish the necessary acquire barrier?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260920-rust_serdev_probe_refactor-v2-0-43b855162f5d@posteo.de?part=1