* [PATCH v4 1/4] tty: serdev: Add mutex lock
2026-10-16 18:00 [PATCH v4 0/4] rust: serdev: Refactor Markus Probst
@ 2026-10-16 18:00 ` Markus Probst
2026-10-16 18:15 ` sashiko-bot
2026-10-16 18:00 ` [PATCH v4 2/4] tty: serdev: Export functions to pause receive_buf callback calls Markus Probst
` (2 subsequent siblings)
3 siblings, 1 reply; 9+ messages in thread
From: Markus Probst @ 2026-10-16 18:00 UTC (permalink / raw)
To: Ayush Singh, Johan Hovold, Alex Elder, Greg Kroah-Hartman,
Miguel Ojeda, Boqun Feng, Gary Guo, Björn Roy Baron,
Benno Lossin, Andreas Hindborg, Alice Ryhl, Trevor Gross,
Danilo Krummrich, Daniel Almeida, Tamir Duberstein,
Alexandre Courbot, Onur Özkan, Eric Biggers, Ard Biesheuvel,
Lorenzo Stoakes, Vlastimil Babka, Liam R. Howlett,
Uladzislau Rezki, Jiri Slaby, Rafael J. Wysocki
Cc: greybus-dev, linux-serial, rust-for-linux, linux-kernel,
driver-core, Markus Probst
Besides more predictable behaviour, this allows for several hardened
behaviour changes:
Return -EALREADY in `serdev_device_open` if the device is already open
instead of causing undefined behaviour.
Allow calling `serdev_device_close`, even if the device is already
closed instead of causing a null pointer dereference.
If the device is left open by the driver after remove, close it and warn
instead of leaving it in a invalid state.
Signed-off-by: Markus Probst <markus.probst@posteo.de>
---
drivers/tty/serdev/core.c | 10 +++++---
drivers/tty/serdev/serdev-ttyport.c | 46 +++++++++++++++++++++++++++++++------
include/linux/serdev.h | 2 +-
3 files changed, 47 insertions(+), 11 deletions(-)
diff --git a/drivers/tty/serdev/core.c b/drivers/tty/serdev/core.c
index 7500efcdfc21..77e8e1d4d2a6 100644
--- a/drivers/tty/serdev/core.c
+++ b/drivers/tty/serdev/core.c
@@ -142,6 +142,11 @@ void serdev_device_remove(struct serdev_device *serdev)
struct serdev_controller *ctrl = serdev->ctrl;
device_unregister(&serdev->dev);
+
+ /* Warn if driver did not close the serial device. */
+ if (ctrl->ops->close && WARN_ON(ctrl->ops->close(ctrl)))
+ pm_runtime_put(&ctrl->dev);
+
ctrl->serdev = NULL;
}
EXPORT_SYMBOL_GPL(serdev_device_remove);
@@ -181,9 +186,8 @@ void serdev_device_close(struct serdev_device *serdev)
if (!ctrl || !ctrl->ops->close)
return;
- pm_runtime_put(&ctrl->dev);
-
- ctrl->ops->close(ctrl);
+ if (ctrl->ops->close(ctrl))
+ pm_runtime_put(&ctrl->dev);
}
EXPORT_SYMBOL_GPL(serdev_device_close);
diff --git a/drivers/tty/serdev/serdev-ttyport.c b/drivers/tty/serdev/serdev-ttyport.c
index bab1b143b8a6..125a17a0bea5 100644
--- a/drivers/tty/serdev/serdev-ttyport.c
+++ b/drivers/tty/serdev/serdev-ttyport.c
@@ -16,6 +16,8 @@ struct serport {
struct tty_driver *tty_drv;
int tty_idx;
unsigned long flags;
+ struct mutex lock; /* lock preventing modification of flags */
+ struct mutex receive_lock; /* lock preventing execution of serdev_controller_receive_buf */
};
/*
@@ -29,6 +31,8 @@ static size_t ttyport_receive_buf(struct tty_port *port, const u8 *cp,
struct serport *serport = serdev_controller_get_drvdata(ctrl);
size_t ret;
+ guard(mutex)(&serport->receive_lock);
+
if (!test_bit(SERPORT_ACTIVE, &serport->flags))
return 0;
@@ -99,16 +103,27 @@ static int ttyport_open(struct serdev_controller *ctrl)
struct ktermios ktermios;
int ret;
+ mutex_lock(&serport->lock);
+
+ if (test_bit(SERPORT_ACTIVE, &serport->flags)) {
+ ret = -EALREADY;
+ goto err_flags_unlock;
+ }
+
tty = tty_init_dev(serport->tty_drv, serport->tty_idx);
- if (IS_ERR(tty))
- return PTR_ERR(tty);
+ if (IS_ERR(tty)) {
+ ret = PTR_ERR(tty);
+ goto err_flags_unlock;
+ }
serport->tty = tty;
if (!tty->ops->open || !tty->ops->close) {
ret = -ENODEV;
- goto err_unlock;
+ goto err_tty_unlock;
}
+ mutex_lock(&serport->receive_lock);
+
ret = tty->ops->open(serport->tty, NULL);
if (ret)
goto err_close;
@@ -130,23 +145,35 @@ static int ttyport_open(struct serdev_controller *ctrl)
set_bit(SERPORT_ACTIVE, &serport->flags);
+ mutex_unlock(&serport->receive_lock);
+ mutex_unlock(&serport->lock);
+
return 0;
err_close:
tty->ops->close(tty, NULL);
-err_unlock:
+ mutex_unlock(&serport->receive_lock);
+err_tty_unlock:
tty_unlock(tty);
tty_release_struct(tty, serport->tty_idx);
+err_flags_unlock:
+ mutex_unlock(&serport->lock);
return ret;
}
-static void ttyport_close(struct serdev_controller *ctrl)
+static bool ttyport_close(struct serdev_controller *ctrl)
{
struct serport *serport = serdev_controller_get_drvdata(ctrl);
- struct tty_struct *tty = serport->tty;
+ struct tty_struct *tty;
+
+ guard(mutex)(&serport->lock);
- clear_bit(SERPORT_ACTIVE, &serport->flags);
+ tty = serport->tty;
+
+ scoped_guard(mutex, &serport->receive_lock)
+ if (!__test_and_clear_bit(SERPORT_ACTIVE, &serport->flags))
+ return false;
tty_lock(tty);
if (tty->ops->close)
@@ -154,6 +181,8 @@ static void ttyport_close(struct serdev_controller *ctrl)
tty_unlock(tty);
tty_release_struct(tty, serport->tty_idx);
+
+ return true;
}
static unsigned int ttyport_set_baudrate(struct serdev_controller *ctrl, unsigned int speed)
@@ -288,6 +317,9 @@ struct device *serdev_tty_port_register(struct tty_port *port,
port->client_ops = &client_ops;
port->client_data = ctrl;
+ mutex_init(&serport->lock);
+ mutex_init(&serport->receive_lock);
+
ret = serdev_controller_add(ctrl);
if (ret)
goto err_reset_data;
diff --git a/include/linux/serdev.h b/include/linux/serdev.h
index b6c3d957ec15..0f4e81c0950d 100644
--- a/include/linux/serdev.h
+++ b/include/linux/serdev.h
@@ -81,7 +81,7 @@ struct serdev_controller_ops {
ssize_t (*write_buf)(struct serdev_controller *, const u8 *, size_t);
void (*write_flush)(struct serdev_controller *);
int (*open)(struct serdev_controller *);
- void (*close)(struct serdev_controller *);
+ bool (*close)(struct serdev_controller *);
void (*set_flow_control)(struct serdev_controller *, bool);
int (*set_parity)(struct serdev_controller *, enum serdev_parity);
unsigned int (*set_baudrate)(struct serdev_controller *, unsigned int);
--
2.55.0
^ permalink raw reply related [flat|nested] 9+ messages in thread* Re: [PATCH v4 1/4] tty: serdev: Add mutex lock
2026-10-16 18:00 ` [PATCH v4 1/4] tty: serdev: Add mutex lock Markus Probst
@ 2026-10-16 18:15 ` sashiko-bot
0 siblings, 0 replies; 9+ messages in thread
From: sashiko-bot @ 2026-10-16 18:15 UTC (permalink / raw)
To: Markus Probst; +Cc: linux-serial, ojeda, gary
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] pm: async pm_runtime_put() in remove path cancelled by pm_runtime_disable()
--
commit c4731a25fb19c22b675757b565d963b9ad0190e8
Author: Markus Probst <markus.probst@posteo.de>
tty: serdev: Add mutex lock
Besides more predictable behaviour, this allows for several hardened
behaviour changes. If the device is left open by the driver after remove,
close it and warn instead of leaving it in an invalid state.
> diff --git a/drivers/tty/serdev/core.c b/drivers/tty/serdev/core.c
> index 7500efcdfc218..77e8e1d4d2a66 100644
> --- a/drivers/tty/serdev/core.c
> +++ b/drivers/tty/serdev/core.c
> @@ -142,6 +142,11 @@ void serdev_device_remove(struct serdev_device *serdev)
> struct serdev_controller *ctrl = serdev->ctrl;
>
> device_unregister(&serdev->dev);
> +
> + /* Warn if driver did not close the serial device. */
> + if (ctrl->ops->close && WARN_ON(ctrl->ops->close(ctrl)))
> + pm_runtime_put(&ctrl->dev);
[Severity: Medium]
When this path is reached during controller teardown, will the pending
asynchronous suspend work be cancelled?
In serdev_controller_remove(), device_for_each_child() synchronously invokes
the removal, and then immediately calls pm_runtime_disable(&ctrl->dev):
serdev_controller_remove() {
...
device_for_each_child(&ctrl->dev, NULL, serdev_remove_device);
pm_runtime_disable(&ctrl->dev);
device_del(&ctrl->dev);
}
Since pm_runtime_disable() cancels pending asynchronous idle and suspend work,
calling pm_runtime_put() here instead of pm_runtime_put_sync() can prevent the
hardware from actually suspending, leaving the controller powered on indefinitely.
Could pm_runtime_put_sync() be used here instead to ensure the device is
properly suspended before pm_runtime_disable() is called?
> +
> ctrl->serdev = NULL;
> }
> EXPORT_SYMBOL_GPL(serdev_device_remove);
--
Sashiko AI review · https://sashiko.dev/#/patchset/20261016-rust_serdev_probe_refactor-v4-0-46832e034757@posteo.de?part=1
^ permalink raw reply [flat|nested] 9+ messages in thread
* [PATCH v4 2/4] tty: serdev: Export functions to pause receive_buf callback calls
2026-10-16 18:00 [PATCH v4 0/4] rust: serdev: Refactor Markus Probst
2026-10-16 18:00 ` [PATCH v4 1/4] tty: serdev: Add mutex lock Markus Probst
@ 2026-10-16 18:00 ` Markus Probst
2026-10-16 18:13 ` sashiko-bot
2026-10-16 18:00 ` [PATCH v4 3/4] rust: serdev: Replace `active` mutex with receive pause Markus Probst
2026-10-16 18:00 ` [PATCH v4 4/4] rust: serdev: Simplify callbacks Markus Probst
3 siblings, 1 reply; 9+ messages in thread
From: Markus Probst @ 2026-10-16 18:00 UTC (permalink / raw)
To: Ayush Singh, Johan Hovold, Alex Elder, Greg Kroah-Hartman,
Miguel Ojeda, Boqun Feng, Gary Guo, Björn Roy Baron,
Benno Lossin, Andreas Hindborg, Alice Ryhl, Trevor Gross,
Danilo Krummrich, Daniel Almeida, Tamir Duberstein,
Alexandre Courbot, Onur Özkan, Eric Biggers, Ard Biesheuvel,
Lorenzo Stoakes, Vlastimil Babka, Liam R. Howlett,
Uladzislau Rezki, Jiri Slaby, Rafael J. Wysocki
Cc: greybus-dev, linux-serial, rust-for-linux, linux-kernel,
driver-core, Markus Probst
These functions will be used to simply the serdev rust abstraction. It
also contributes to the fixing of 2 race conditions in the serdev rust
abstraction.
Signed-off-by: Markus Probst <markus.probst@posteo.de>
---
drivers/tty/serdev/core.c | 44 ++++++++++++++++++++++++++++++++++++-
drivers/tty/serdev/serdev-ttyport.c | 38 ++++++++++++++++++++++++++++++++
include/linux/serdev.h | 6 +++++
3 files changed, 87 insertions(+), 1 deletion(-)
diff --git a/drivers/tty/serdev/core.c b/drivers/tty/serdev/core.c
index 77e8e1d4d2a6..af1470e33620 100644
--- a/drivers/tty/serdev/core.c
+++ b/drivers/tty/serdev/core.c
@@ -191,6 +191,45 @@ void serdev_device_close(struct serdev_device *serdev)
}
EXPORT_SYMBOL_GPL(serdev_device_close);
+/**
+ * serdev_device_pause_rx() - pause data receive
+ * @serdev: serdev device
+ *
+ * Pause calls to receive_buf.
+ *
+ * Note that if a call to receive_buf is currently executed, the function will
+ * sleep until it has finished.
+ */
+void serdev_device_pause_rx(struct serdev_device *serdev)
+{
+ struct serdev_controller *ctrl = serdev->ctrl;
+
+ if (!ctrl || !ctrl->ops->pause_rx)
+ return;
+
+ ctrl->ops->pause_rx(ctrl);
+}
+EXPORT_SYMBOL_GPL(serdev_device_pause_rx);
+
+/**
+ * serdev_device_resume_rx() - resume data receive
+ * @serdev: serdev device
+ *
+ * Resume calls to receive_buf.
+ *
+ * This can be called even if not paused to ensure data receive is active.
+ */
+void serdev_device_resume_rx(struct serdev_device *serdev)
+{
+ struct serdev_controller *ctrl = serdev->ctrl;
+
+ if (!ctrl || !ctrl->ops->resume_rx)
+ return;
+
+ ctrl->ops->resume_rx(ctrl);
+}
+EXPORT_SYMBOL_GPL(serdev_device_resume_rx);
+
static void devm_serdev_device_close(void *serdev)
{
serdev_device_close(serdev);
@@ -402,6 +441,7 @@ EXPORT_SYMBOL_GPL(serdev_device_break_ctl);
static int serdev_drv_probe(struct device *dev)
{
const struct serdev_device_driver *sdrv = to_serdev_device_driver(dev->driver);
+ struct serdev_device *sdev = to_serdev_device(dev);
int ret;
ret = dev_pm_domain_attach(dev, PD_FLAG_ATTACH_POWER_ON |
@@ -409,7 +449,9 @@ static int serdev_drv_probe(struct device *dev)
if (ret)
return ret;
- return sdrv->probe(to_serdev_device(dev));
+ serdev_device_resume_rx(sdev);
+
+ return sdrv->probe(sdev);
}
static void serdev_drv_remove(struct device *dev)
diff --git a/drivers/tty/serdev/serdev-ttyport.c b/drivers/tty/serdev/serdev-ttyport.c
index 125a17a0bea5..e164ee7edc12 100644
--- a/drivers/tty/serdev/serdev-ttyport.c
+++ b/drivers/tty/serdev/serdev-ttyport.c
@@ -7,8 +7,10 @@
#include <linux/tty.h>
#include <linux/tty_driver.h>
#include <linux/poll.h>
+#include "../tty.h"
#define SERPORT_ACTIVE 1
+#define SERPORT_PAUSE_RX 2
struct serport {
struct tty_port *port;
@@ -36,6 +38,9 @@ static size_t ttyport_receive_buf(struct tty_port *port, const u8 *cp,
if (!test_bit(SERPORT_ACTIVE, &serport->flags))
return 0;
+ if (test_bit(SERPORT_PAUSE_RX, &serport->flags))
+ return 0;
+
ret = serdev_controller_receive_buf(ctrl, cp, count);
dev_WARN_ONCE(&ctrl->dev, ret > count,
@@ -185,6 +190,37 @@ static bool ttyport_close(struct serdev_controller *ctrl)
return true;
}
+static void ttyport_pause_rx(struct serdev_controller *ctrl)
+{
+ struct serport *serport = serdev_controller_get_drvdata(ctrl);
+ struct tty_struct *tty = serport->tty;
+
+ guard(mutex)(&serport->lock);
+
+ scoped_guard(mutex, &serport->receive_lock)
+ set_bit(SERPORT_PAUSE_RX, &serport->flags);
+
+ if (test_bit(SERPORT_ACTIVE, &serport->flags))
+ tty_buffer_cancel_work(tty->port);
+}
+
+static void ttyport_resume_rx(struct serdev_controller *ctrl)
+{
+ struct serport *serport = serdev_controller_get_drvdata(ctrl);
+ struct tty_struct *tty = serport->tty;
+
+ guard(mutex)(&serport->lock);
+
+ if (!test_bit(SERPORT_PAUSE_RX, &serport->flags))
+ return;
+
+ scoped_guard(mutex, &serport->receive_lock)
+ clear_bit(SERPORT_PAUSE_RX, &serport->flags);
+
+ if (test_bit(SERPORT_ACTIVE, &serport->flags))
+ tty_buffer_restart_work(tty->port);
+}
+
static unsigned int ttyport_set_baudrate(struct serdev_controller *ctrl, unsigned int speed)
{
struct serport *serport = serdev_controller_get_drvdata(ctrl);
@@ -289,6 +325,8 @@ static const struct serdev_controller_ops ctrl_ops = {
.get_tiocm = ttyport_get_tiocm,
.set_tiocm = ttyport_set_tiocm,
.break_ctl = ttyport_break_ctl,
+ .pause_rx = ttyport_pause_rx,
+ .resume_rx = ttyport_resume_rx,
};
struct device *serdev_tty_port_register(struct tty_port *port,
diff --git a/include/linux/serdev.h b/include/linux/serdev.h
index 0f4e81c0950d..02773554e759 100644
--- a/include/linux/serdev.h
+++ b/include/linux/serdev.h
@@ -89,6 +89,8 @@ struct serdev_controller_ops {
int (*get_tiocm)(struct serdev_controller *);
int (*set_tiocm)(struct serdev_controller *, unsigned int, unsigned int);
int (*break_ctl)(struct serdev_controller *ctrl, unsigned int break_state);
+ void (*pause_rx)(struct serdev_controller *ctrl);
+ void (*resume_rx)(struct serdev_controller *ctrl);
};
/**
@@ -194,6 +196,8 @@ static inline size_t serdev_controller_receive_buf(struct serdev_controller *ctr
int serdev_device_open(struct serdev_device *);
void serdev_device_close(struct serdev_device *);
int devm_serdev_device_open(struct device *, struct serdev_device *);
+void serdev_device_pause_rx(struct serdev_device *serdev);
+void serdev_device_resume_rx(struct serdev_device *serdev);
unsigned int serdev_device_set_baudrate(struct serdev_device *, unsigned int);
void serdev_device_set_flow_control(struct serdev_device *, bool);
int serdev_device_write_buf(struct serdev_device *, const u8 *, size_t);
@@ -233,6 +237,8 @@ static inline int serdev_device_open(struct serdev_device *sdev)
return -ENODEV;
}
static inline void serdev_device_close(struct serdev_device *sdev) {}
+static inline void serdev_device_pause_rx(struct serdev_device *serdev) {}
+static inline void serdev_device_resume_rx(struct serdev_device *serdev) {}
static inline unsigned int serdev_device_set_baudrate(struct serdev_device *sdev, unsigned int baudrate)
{
return 0;
--
2.55.0
^ permalink raw reply related [flat|nested] 9+ messages in thread* Re: [PATCH v4 2/4] tty: serdev: Export functions to pause receive_buf callback calls
2026-10-16 18:00 ` [PATCH v4 2/4] tty: serdev: Export functions to pause receive_buf callback calls Markus Probst
@ 2026-10-16 18:13 ` sashiko-bot
0 siblings, 0 replies; 9+ messages in thread
From: sashiko-bot @ 2026-10-16 18:13 UTC (permalink / raw)
To: Markus Probst; +Cc: linux-serial, ojeda, gary
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] tty: NULL pointer dereference / UAF in ttyport_pause_rx and ttyport_resume_rx due to TOCTOU
--
commit 7862c81055f41fa0e8cc37f91200a9bcccf35960
Author: Markus Probst <markus.probst@posteo.de>
tty: serdev: Export functions to pause receive_buf callback calls
These functions will be used to simply the serdev rust abstraction. It
also contributes to the fixing of 2 race conditions in the serdev rust
abstraction.
> diff --git a/drivers/tty/serdev/serdev-ttyport.c b/drivers/tty/serdev/serdev-ttyport.c
> index 125a17a0bea50..e164ee7edc121 100644
> --- a/drivers/tty/serdev/serdev-ttyport.c
> +++ b/drivers/tty/serdev/serdev-ttyport.c
[ ... ]
> @@ -185,6 +190,37 @@ static bool ttyport_close(struct serdev_controller *ctrl)
> return true;
> }
>
> +static void ttyport_pause_rx(struct serdev_controller *ctrl)
> +{
> + struct serport *serport = serdev_controller_get_drvdata(ctrl);
> + struct tty_struct *tty = serport->tty;
> +
> + guard(mutex)(&serport->lock);
[Severity: High]
Does this code have a race condition since the local pointer tty is assigned
from serport->tty before the serport->lock is acquired?
This lock protects the lifecycle of the tty structure and the SERPORT_ACTIVE
flag, which are modified concurrently by ttyport_open() and ttyport_close().
If a concurrent thread calls ttyport_open() or if the port transitions states
asynchronously, it will allocate a new tty_struct, set serport->tty, and set
SERPORT_ACTIVE to true.
> +
> + scoped_guard(mutex, &serport->receive_lock)
> + set_bit(SERPORT_PAUSE_RX, &serport->flags);
> +
> + if (test_bit(SERPORT_ACTIVE, &serport->flags))
> + tty_buffer_cancel_work(tty->port);
Because tty was captured outside the lock, could it remain NULL if previously
closed or point to a freed structure?
If the ttyport_pause_rx() thread then acquires the lock and sees that
SERPORT_ACTIVE is true, will this result in an immediate NULL pointer
dereference or use-after-free when accessing tty->port?
Should the assignment of the tty pointer be moved inside the critical section?
> +}
> +
> +static void ttyport_resume_rx(struct serdev_controller *ctrl)
> +{
> + struct serport *serport = serdev_controller_get_drvdata(ctrl);
> + struct tty_struct *tty = serport->tty;
> +
> + guard(mutex)(&serport->lock);
[Severity: High]
Does the identical vulnerability exist in the resume path where tty is
captured outside the lock?
> +
> + if (!test_bit(SERPORT_PAUSE_RX, &serport->flags))
> + return;
> +
> + scoped_guard(mutex, &serport->receive_lock)
> + clear_bit(SERPORT_PAUSE_RX, &serport->flags);
> +
> + if (test_bit(SERPORT_ACTIVE, &serport->flags))
> + tty_buffer_restart_work(tty->port);
> +}
--
Sashiko AI review · https://sashiko.dev/#/patchset/20261016-rust_serdev_probe_refactor-v4-0-46832e034757@posteo.de?part=2
^ permalink raw reply [flat|nested] 9+ messages in thread
* [PATCH v4 3/4] rust: serdev: Replace `active` mutex with receive pause
2026-10-16 18:00 [PATCH v4 0/4] rust: serdev: Refactor Markus Probst
2026-10-16 18:00 ` [PATCH v4 1/4] tty: serdev: Add mutex lock Markus Probst
2026-10-16 18:00 ` [PATCH v4 2/4] tty: serdev: Export functions to pause receive_buf callback calls Markus Probst
@ 2026-10-16 18:00 ` Markus Probst
2026-10-16 18:11 ` sashiko-bot
2026-10-16 18:00 ` [PATCH v4 4/4] rust: serdev: Simplify callbacks Markus Probst
3 siblings, 1 reply; 9+ messages in thread
From: Markus Probst @ 2026-10-16 18:00 UTC (permalink / raw)
To: Ayush Singh, Johan Hovold, Alex Elder, Greg Kroah-Hartman,
Miguel Ojeda, Boqun Feng, Gary Guo, Björn Roy Baron,
Benno Lossin, Andreas Hindborg, Alice Ryhl, Trevor Gross,
Danilo Krummrich, Daniel Almeida, Tamir Duberstein,
Alexandre Courbot, Onur Özkan, Eric Biggers, Ard Biesheuvel,
Lorenzo Stoakes, Vlastimil Babka, Liam R. Howlett,
Uladzislau Rezki, Jiri Slaby, Rafael J. Wysocki
Cc: greybus-dev, linux-serial, rust-for-linux, linux-kernel,
driver-core, Markus Probst, Sashiko Bot
There are currently 2 race conditions:
- in probe if `Driver::probe` returns Err
- in unbind
. In those cases the driver data will be set to NULL before the serdev
device was closed. If data is received while the driver data is dropped,
the `receive_buf_callback` might try to access the `active` mutex on a
null pointer.
Removing the need for `receive_buf_callback` to lock the `active` mutex
fixes these.
Fixes: 99f59aa82341 ("rust: add basic serial device bus abstractions")
Reported-by: Sashiko Bot <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/linux-serial/20260905000836.C8FC91F00A3D@smtp.kernel.org/
Closes: https://lore.kernel.org/linux-serial/20260903222159.70A911F000E9@smtp.kernel.org/
Signed-off-by: Markus Probst <markus.probst@posteo.de>
---
rust/kernel/serdev.rs | 60 ++++++++++++---------------------------------------
1 file changed, 14 insertions(+), 46 deletions(-)
diff --git a/rust/kernel/serdev.rs b/rust/kernel/serdev.rs
index 17ca504b7f8d..c16d6593a8d2 100644
--- a/rust/kernel/serdev.rs
+++ b/rust/kernel/serdev.rs
@@ -13,13 +13,9 @@
to_result,
VTABLE_DEFAULT_ERROR, //
},
- new_mutex,
of,
prelude::*,
- sync::{
- aref::AlwaysRefCounted,
- Mutex, //
- },
+ sync::aref::AlwaysRefCounted,
time::Jiffies,
types::{
Opaque,
@@ -103,40 +99,11 @@ pub struct PrivateData<'bound, T: Driver> {
#[pin]
driver: UnsafeCell<MaybeUninit<T::Data<'bound>>>,
open: UnsafeCell<bool>,
- /// Whether `receive_buf_callback` is allowed to call `Driver::receive`.
- ///
- /// If locked, the receive_buf_callback will be blocked on data reception.
- /// This is the case while the driver is being probed or while [`PrivateData`] is being dropped.
- /// This is necessary, because we need to open the serdev device before the driver has been
- /// probed in order to allow it to be configured, which allows `receive_buf_callback` to be
- /// called. Thus we need to block data until probe completes and the driver data becomes
- /// initialized.
- ///
- /// If unlocked and true, the receive_buf_callback will forward the data to
- /// `Driver::receive`. This is the normal state of operation.
- ///
- /// If unlocked and false, the receive_buf_callback will throw away the data.
- /// This is only the case, if the serdev device is open and
- /// - the driver returned an error in probe
- /// or
- /// - the driver data already has been dropped, because it was unbound.
- #[pin]
- active: Mutex<bool>,
}
#[pinned_drop]
impl<T: Driver> PinnedDrop for PrivateData<'_, T> {
fn drop(self: Pin<&mut Self>) {
- let mut active = self.active.lock();
- if *active {
- // SAFETY:
- // - We have exclusive access to `self.driver`.
- // - `self.driver` is guaranteed to be initialized.
- unsafe { (*self.driver.get()).assume_init_drop() };
- *active = false;
- }
- drop(active);
-
// SAFETY: We have exclusive access to `self.open`.
if unsafe { *self.open.get() } {
// SAFETY: `self.sdev.as_raw()` is guaranteed to be a pointer to a valid
@@ -170,7 +137,6 @@ extern "C" fn probe_callback(sdev: *mut bindings::serdev_device) -> kernel::ffi:
sdev: &**sdev,
driver: MaybeUninit::<T::Data<'_>>::zeroed().into(),
open: false.into(),
- active <- new_mutex!(false),
}))?;
// SAFETY: We just set drvdata to `PrivateData<'_, T>`.
let private_data = unsafe { sdev.as_ref().drvdata_borrow::<PrivateData<'_, T>>() };
@@ -178,11 +144,12 @@ extern "C" fn probe_callback(sdev: *mut bindings::serdev_device) -> kernel::ffi:
// SAFETY: We just set drvdata to `PrivateData<'_, T>`.
drop(unsafe { sdev.as_ref().drvdata_obtain::<PrivateData<'_, T>>() });
});
- let mut active = private_data.active.lock();
-
// SAFETY: `sdev.as_raw()` is guaranteed to be a valid pointer to `serdev_device`.
unsafe { bindings::serdev_device_set_client_ops(sdev.as_raw(), Self::OPS) };
+ // SAFETY: `sdev.as_raw()` is guaranteed to be a valid pointer to `serdev_device`.
+ unsafe { bindings::serdev_device_pause_rx(sdev.as_raw()) };
+
// SAFETY: The serial device bus only ever calls the probe callback with a valid pointer
// to a `serdev_device`.
to_result(unsafe { bindings::serdev_device_open(sdev.as_raw()) })?;
@@ -199,12 +166,12 @@ extern "C" fn probe_callback(sdev: *mut bindings::serdev_device) -> kernel::ffi:
// - `private_data.driver` is pinned.
let result = unsafe { pin_init::raw_try_init(driver.as_mut_ptr(), data) };
- *active = result.is_ok();
-
- drop(active);
-
result.map(|()| {
private_data.dismiss();
+
+ // SAFETY: `sdev.as_raw()` is guaranteed to be a valid pointer to `serdev_device`.
+ unsafe { bindings::serdev_device_resume_rx(sdev.as_raw()) };
+
0
})
})
@@ -231,6 +198,12 @@ extern "C" fn remove_callback(sdev: *mut bindings::serdev_device) {
let data_pinned = unsafe { Pin::new_unchecked(data.assume_init_ref()) };
T::unbind(sdev, data_pinned);
+
+ // SAFETY: `sdev.as_raw()` is guaranteed to be a valid pointer to `serdev_device`.
+ unsafe { bindings::serdev_device_pause_rx(sdev.as_raw()) };
+
+ // SAFETY: We already established that `data` is guaranteed to be initialized.
+ unsafe { data.assume_init_drop() };
}
extern "C" fn receive_buf_callback(
@@ -248,11 +221,6 @@ extern "C" fn receive_buf_callback(
// `probe_callback`, hence it's guaranteed that `Device::set_drvdata()` has been called
// and stored a `Pin<KBox<PrivateData<'_, T>>>`.
let private_data = unsafe { sdev.as_ref().drvdata_borrow::<PrivateData<'_, T>>() };
- let active = private_data.active.lock();
-
- if !*active {
- return length;
- }
// SAFETY: No one has exclusive access to `private_data.driver`.
let data = unsafe { &*private_data.driver.get() };
--
2.55.0
^ permalink raw reply related [flat|nested] 9+ messages in thread* [PATCH v4 4/4] rust: serdev: Simplify callbacks
2026-10-16 18:00 [PATCH v4 0/4] rust: serdev: Refactor Markus Probst
` (2 preceding siblings ...)
2026-10-16 18:00 ` [PATCH v4 3/4] rust: serdev: Replace `active` mutex with receive pause Markus Probst
@ 2026-10-16 18:00 ` Markus Probst
2026-10-16 18:17 ` sashiko-bot
3 siblings, 1 reply; 9+ messages in thread
From: Markus Probst @ 2026-10-16 18:00 UTC (permalink / raw)
To: Ayush Singh, Johan Hovold, Alex Elder, Greg Kroah-Hartman,
Miguel Ojeda, Boqun Feng, Gary Guo, Björn Roy Baron,
Benno Lossin, Andreas Hindborg, Alice Ryhl, Trevor Gross,
Danilo Krummrich, Daniel Almeida, Tamir Duberstein,
Alexandre Courbot, Onur Özkan, Eric Biggers, Ard Biesheuvel,
Lorenzo Stoakes, Vlastimil Babka, Liam R. Howlett,
Uladzislau Rezki, Jiri Slaby, Rafael J. Wysocki
Cc: greybus-dev, linux-serial, rust-for-linux, linux-kernel,
driver-core, Markus Probst
Initialize the driver's private data directly on `PrivateData`.
Introduce `OpenGuard` for resource cleanup.
Signed-off-by: Markus Probst <markus.probst@posteo.de>
---
rust/kernel/serdev.rs | 131 ++++++++++++++++++++------------------------------
1 file changed, 52 insertions(+), 79 deletions(-)
diff --git a/rust/kernel/serdev.rs b/rust/kernel/serdev.rs
index c16d6593a8d2..3f9165e16776 100644
--- a/rust/kernel/serdev.rs
+++ b/rust/kernel/serdev.rs
@@ -17,16 +17,12 @@
prelude::*,
sync::aref::AlwaysRefCounted,
time::Jiffies,
- types::{
- Opaque,
- ScopeGuard, //
- }, //
+ types::Opaque, //
};
use core::{
- cell::UnsafeCell,
marker::PhantomData,
- mem::{offset_of, MaybeUninit},
+ mem::offset_of,
ptr::NonNull, //
};
@@ -92,24 +88,36 @@ unsafe fn unregister(sdrv: &Opaque<Self::DriverType>) {
}
}
+struct OpenGuard<'bound> {
+ sdev: &'bound Device<device::Bound>,
+}
+
+impl Drop for OpenGuard<'_> {
+ fn drop(&mut self) {
+ // SAFETY:
+ // - `self.sdev.as_raw()` is guaranteed to be a pointer to a valid
+ // `struct serdev_device`.
+ // - The existence of self proves that the device is open.
+ unsafe { bindings::serdev_device_close(self.sdev.as_raw()) };
+ }
+}
+
#[doc(hidden)]
-#[pin_data(PinnedDrop)]
+#[pin_data]
pub struct PrivateData<'bound, T: Driver> {
- sdev: &'bound Device<device::Bound>,
#[pin]
- driver: UnsafeCell<MaybeUninit<T::Data<'bound>>>,
- open: UnsafeCell<bool>,
+ driver: T::Data<'bound>,
+ open: OpenGuard<'bound>,
}
-#[pinned_drop]
-impl<T: Driver> PinnedDrop for PrivateData<'_, T> {
- fn drop(self: Pin<&mut Self>) {
- // SAFETY: We have exclusive access to `self.open`.
- if unsafe { *self.open.get() } {
- // SAFETY: `self.sdev.as_raw()` is guaranteed to be a pointer to a valid
- // `struct serdev_device`.
- unsafe { bindings::serdev_device_close(self.sdev.as_raw()) };
- }
+impl<'bound, T: Driver> PrivateData<'bound, T> {
+ #[inline]
+ fn driver_data(self: Pin<&Self>) -> Pin<&T::Data<'bound>> {
+ // SAFETY: We treat the result as pinned.
+ let inner = unsafe { Pin::into_inner_unchecked(self) };
+
+ // SAFETY: `self.driver` is pinned.
+ unsafe { Pin::new_unchecked(&inner.driver) }
}
}
@@ -134,46 +142,30 @@ extern "C" fn probe_callback(sdev: *mut bindings::serdev_device) -> kernel::ffi:
from_result(|| {
sdev.as_ref().set_drvdata(try_pin_init!(PrivateData::<T> {
- sdev: &**sdev,
- driver: MaybeUninit::<T::Data<'_>>::zeroed().into(),
- open: false.into(),
+ open: {
+ // SAFETY:
+ // - `sdev.as_raw()` is guaranteed to be a valid pointer to
+ // `serdev_device`.
+ // - It is safe to call before open.
+ unsafe { bindings::serdev_device_set_client_ops(sdev.as_raw(), Self::OPS) };
+
+ // SAFETY: `sdev.as_raw()` is guaranteed to be a valid pointer to
+ // `serdev_device`.
+ unsafe { bindings::serdev_device_pause_rx(sdev.as_raw()) };
+
+ // SAFETY: `sdev.as_raw()` is guaranteed to be a valid pointer to
+ // `serdev_device`.
+ to_result(unsafe { bindings::serdev_device_open(sdev.as_raw()) })?;
+
+ OpenGuard { sdev }
+ },
+ driver <- T::probe(sdev, info),
}))?;
- // SAFETY: We just set drvdata to `PrivateData<'_, T>`.
- let private_data = unsafe { sdev.as_ref().drvdata_borrow::<PrivateData<'_, T>>() };
- let private_data = ScopeGuard::new_with_data(private_data, |_| {
- // SAFETY: We just set drvdata to `PrivateData<'_, T>`.
- drop(unsafe { sdev.as_ref().drvdata_obtain::<PrivateData<'_, T>>() });
- });
- // SAFETY: `sdev.as_raw()` is guaranteed to be a valid pointer to `serdev_device`.
- unsafe { bindings::serdev_device_set_client_ops(sdev.as_raw(), Self::OPS) };
// SAFETY: `sdev.as_raw()` is guaranteed to be a valid pointer to `serdev_device`.
- unsafe { bindings::serdev_device_pause_rx(sdev.as_raw()) };
-
- // SAFETY: The serial device bus only ever calls the probe callback with a valid pointer
- // to a `serdev_device`.
- to_result(unsafe { bindings::serdev_device_open(sdev.as_raw()) })?;
-
- // SAFETY: We have exclusive access to `private_data.open`.
- unsafe { *private_data.open.get() = true };
-
- let data = T::probe(sdev, info);
+ unsafe { bindings::serdev_device_resume_rx(sdev.as_raw()) };
- // SAFETY: We have exclusive access to `private_data.driver`.
- let driver = unsafe { &mut *private_data.driver.get() };
- // SAFETY:
- // - `driver.as_mut_ptr()` is a valid pointer to uninitialized data.
- // - `private_data.driver` is pinned.
- let result = unsafe { pin_init::raw_try_init(driver.as_mut_ptr(), data) };
-
- result.map(|()| {
- private_data.dismiss();
-
- // SAFETY: `sdev.as_raw()` is guaranteed to be a valid pointer to `serdev_device`.
- unsafe { bindings::serdev_device_resume_rx(sdev.as_raw()) };
-
- 0
- })
+ Ok(0)
})
}
@@ -189,21 +181,10 @@ extern "C" fn remove_callback(sdev: *mut bindings::serdev_device) {
// and stored a `Pin<KBox<PrivateData<'_, T>>>`.
let private_data = unsafe { sdev.as_ref().drvdata_borrow::<PrivateData<'_, T>>() };
- // SAFETY: No one has exclusive access to `private_data.driver`.
- let data = unsafe { &*private_data.driver.get() };
- // SAFETY:
- // - `private_data.driver` is pinned.
- // - `remove_callback` is only ever called after a successful call to `probe_callback`,
- // hence it's guaranteed that `private_data.driver` was initialized.
- let data_pinned = unsafe { Pin::new_unchecked(data.assume_init_ref()) };
-
- T::unbind(sdev, data_pinned);
+ T::unbind(sdev, private_data.driver_data());
// SAFETY: `sdev.as_raw()` is guaranteed to be a valid pointer to `serdev_device`.
unsafe { bindings::serdev_device_pause_rx(sdev.as_raw()) };
-
- // SAFETY: We already established that `data` is guaranteed to be initialized.
- unsafe { data.assume_init_drop() };
}
extern "C" fn receive_buf_callback(
@@ -211,6 +192,9 @@ extern "C" fn receive_buf_callback(
buf: *const u8,
length: usize,
) -> usize {
+ // SAFETY: `buf` is guaranteed to be non-null and has the size of `length`.
+ let buf = unsafe { core::slice::from_raw_parts(buf, length) };
+
// SAFETY: The serial device bus only ever calls the receive buf callback with a valid
// pointer to a `struct serdev_device`.
//
@@ -222,18 +206,7 @@ extern "C" fn receive_buf_callback(
// and stored a `Pin<KBox<PrivateData<'_, T>>>`.
let private_data = unsafe { sdev.as_ref().drvdata_borrow::<PrivateData<'_, T>>() };
- // SAFETY: No one has exclusive access to `private_data.driver`.
- let data = unsafe { &*private_data.driver.get() };
- // SAFETY:
- // - `private_data.driver` is pinned.
- // - `receive_buf_callback` is only ever called after a successful call to `probe_callback`,
- // hence it's guaranteed that `private_data.driver` was initialized.
- let data_pinned = unsafe { Pin::new_unchecked(data.assume_init_ref()) };
-
- // SAFETY: `buf` is guaranteed to be non-null and has the size of `length`.
- let buf = unsafe { core::slice::from_raw_parts(buf, length) };
-
- T::receive(sdev, data_pinned, buf)
+ T::receive(sdev, private_data.driver_data(), buf)
}
}
--
2.55.0
^ permalink raw reply related [flat|nested] 9+ messages in thread* Re: [PATCH v4 4/4] rust: serdev: Simplify callbacks
2026-10-16 18:00 ` [PATCH v4 4/4] rust: serdev: Simplify callbacks Markus Probst
@ 2026-10-16 18:17 ` sashiko-bot
0 siblings, 0 replies; 9+ messages in thread
From: sashiko-bot @ 2026-10-16 18:17 UTC (permalink / raw)
To: Markus Probst; +Cc: linux-serial, ojeda, gary
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] rust: missing #[inline] on OpenGuard::drop
--
commit 3744d6179fccd8a1197885b1019f91d6e5f289b7
Author: Markus Probst <markus.probst@posteo.de>
rust: serdev: Simplify callbacks
This commit initializes the driver's private data directly on PrivateData
and introduces OpenGuard for resource cleanup.
> diff --git a/rust/kernel/serdev.rs b/rust/kernel/serdev.rs
> index c16d6593a8d2d..3f9165e167764 100644
> --- a/rust/kernel/serdev.rs
> +++ b/rust/kernel/serdev.rs
[ ... ]
> @@ -92,24 +88,36 @@ unsafe fn unregister(sdrv: &Opaque<Self::DriverType>) {
> }
> }
>
> +struct OpenGuard<'bound> {
> + sdev: &'bound Device<device::Bound>,
> +}
> +
> +impl Drop for OpenGuard<'_> {
> + fn drop(&mut self) {
[Severity: Low]
This isn't a bug, but should the drop method on OpenGuard be annotated with
#[inline]?
The Rust subsystem guidelines recommend using #[inline] on small functions in
abstractions that forward directly to a C binding call, such as the call to
bindings::serdev_device_close() here.
> + // SAFETY:
> + // - `self.sdev.as_raw()` is guaranteed to be a pointer to a valid
> + // `struct serdev_device`.
> + // - The existence of self proves that the device is open.
> + unsafe { bindings::serdev_device_close(self.sdev.as_raw()) };
> + }
> +}
--
Sashiko AI review · https://sashiko.dev/#/patchset/20261016-rust_serdev_probe_refactor-v4-0-46832e034757@posteo.de?part=4
^ permalink raw reply [flat|nested] 9+ messages in thread