Re: [PATCH 1/2] serial: tegra: fix RX DMA descriptor use-after-free

[sashiko-bot@kernel.org]

> From: Austin <austin.schlegel@arthrex.com>
> 
> tegra_uart_terminate_rx_dma() calls dmaengine_terminate_all() and then
> tegra_uart_rx_buffer_push(), which calls async_tx_ack(tup->rx_dma_desc)
> on the just-terminated descriptor. With the GPC DMA driver,
> dmaengine_terminate_all() frees the active descriptor immediately, so
> the subsequent async_tx_ack() touches freed memory. dmaengine clients
> are not allowed to touch a descriptor once it has been terminated.
> 
> The same freed-descriptor access happens via tegra_uart_rx_dma_complete(),
> which also reaches tegra_uart_rx_buffer_push() after RX has stopped.
> 
> Move the ack into the two call sites that still own a live descriptor:
> tegra_uart_rx_dma_complete() (before the completion callback hands the
> descriptor back) and tegra_uart_terminate_rx_dma() (before terminating),
> [ ... ]
> KFENCE reports, tx/rx byte counts in /proc/tty/driver/tegra_hsuart
> remained equal throughout with no framing or break errors.
> 
> Fixes: b31245b94207 ("serial: tegra: ack the rx dma desc after transfer terminated")
> Signed-off-by: Austin <austin.schlegel@arthrex.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261001-tty-linus-v1-0-ecb8576c802d@arthrex.com?part=1