* Re: [PATCH] vt: keyboard: add NULL check for vc_cons[fg_console].d in kbd_keycode and kbd_rawcode
From: Greg Kroah-Hartman @ 2026-03-12 14:22 UTC (permalink / raw)
To: Daniel Hodges
Cc: Jiri Slaby, linux-kernel, linux-serial,
syzbot+c3693b491545af43db87, syzbot+03f79366754268a0f20c
In-Reply-To: <20260208003112.6040-1-git@danielhodges.dev>
On Sat, Feb 07, 2026 at 07:31:12PM -0500, Daniel Hodges wrote:
> kbd_keycode() and kbd_rawcode() dereference vc_cons[fg_console].d
> without checking if it is NULL. The foreground console should normally
> always be allocated, but there could be a time during console setup or
> teardown where this pointer could be NULL, leading to a general
> protection fault.
>
> Syzkaller triggers this by injecting USB HID input events that reach
> kbd_event() while the console state may not be fully consistent. The crash
> manifests as a null-ptr-deref in __queue_work when put_queue() or
> puts_queue() calls tty_flip_buffer_push() on the uninitialized vc port.
>
> Add a NULL check for vc at the start of both kbd_rawcode() and
> kbd_keycode() to bail out early if the foreground console is not allocated.
>
> Reported-by: syzbot+c3693b491545af43db87@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=c3693b491545af43db87
> Reported-by: syzbot+03f79366754268a0f20c@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=03f79366754268a0f20c
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Signed-off-by: Daniel Hodges <git@danielhodges.dev>
> ---
> drivers/tty/vt/keyboard.c | 6 ++++++
> 1 file changed, 6 insertions(+)
>
> diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c
> index a2116e135a82..975830013d24 100644
> --- a/drivers/tty/vt/keyboard.c
> +++ b/drivers/tty/vt/keyboard.c
> @@ -1389,6 +1389,9 @@ static void kbd_rawcode(unsigned char data)
> {
> struct vc_data *vc = vc_cons[fg_console].d;
>
> + if (!vc)
> + return;
> +
What prevents vc from being NULL right after checking this?
> kbd = &kbd_table[vc->vc_num];
> if (kbd->kbdmode == VC_RAW)
> put_queue(vc, data);
> @@ -1405,6 +1408,9 @@ static void kbd_keycode(unsigned int keycode, int down, bool hw_raw)
> struct keyboard_notifier_param param = { .vc = vc, .value = keycode, .down = down };
> int rc;
>
> + if (!vc)
> + return;
Same here, where is the locking?
thanks,
greg k-h
^ permalink raw reply
* Re: [PATCH] tty: n_tty: fix KCSAN data-race in n_tty_flush_buffer / n_tty_lookahead_flow_ctrl
From: Greg Kroah-Hartman @ 2026-03-12 14:21 UTC (permalink / raw)
To: Osama Abdelkader
Cc: Jiri Slaby, Andy Shevchenko, Ilpo Järvinen, linux-kernel,
linux-serial, syzbot+80806cf7508e92c7cc86
In-Reply-To: <20260211210838.45127-1-osama.abdelkader@gmail.com>
On Wed, Feb 11, 2026 at 10:08:38PM +0100, Osama Abdelkader wrote:
> n_tty_lookahead_flow_ctrl() accesses ldata->lookahead_count without
> holding termios_rwsem, while reset_buffer_flags() in n_tty_flush_buffer()
> resets it with exclusive termios_rwsem held. This causes a data race
> reported by KCSAN when a PTY is closed while flush_to_ldisc is still
> processing lookahead data.
A data race of what exactly? lookahead_count?
> Fix by taking termios_rwsem (read) in n_tty_lookahead_flow_ctrl(),
> consistent with __receive_buf() which also modifies lookahead_count
> under the read lock.
This feels wrong. I would like to see a LOT of testing and validation
that this is correct before being able to take this patch. How was that
done?
thanks,
greg k-h
^ permalink raw reply
* Re: [PATCH v2] tty: vt/keyboard: Hoist and reuse variable in vt_do_kdgkb_ioctl
From: Greg Kroah-Hartman @ 2026-03-12 14:18 UTC (permalink / raw)
To: Thorsten Blum
Cc: Jiri Slaby, Alexey Gladkov, Nathan Chancellor, Myrrh Periwinkle,
Thomas Gleixner, linux-kernel, linux-serial
In-Reply-To: <20260302153255.6278-2-thorsten.blum@linux.dev>
On Mon, Mar 02, 2026 at 04:32:52PM +0100, Thorsten Blum wrote:
> Hoist 'len' and use it in both cases.
Why? And what is "both cases"?
> Add a comment explaining why reassigning 'kbs' is intentional.
>
> Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
> ---
> Changes in v2:
> - Keep 'kbs' reassignment and add a comment why it's required (Jiri)
> - Link to v1: https://lore.kernel.org/lkml/20260226123419.737669-1-thorsten.blum@linux.dev/
> ---
> drivers/tty/vt/keyboard.c | 14 ++++++++++----
> 1 file changed, 10 insertions(+), 4 deletions(-)
I feel you just made the code harder to understand, as you added
complexity :(
>
> diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c
> index 13bc048f45e8..88fd4ef2634a 100644
> --- a/drivers/tty/vt/keyboard.c
> +++ b/drivers/tty/vt/keyboard.c
> @@ -2000,17 +2000,18 @@ static char *vt_kdskbsent(char *kbs, unsigned char cur)
> int vt_do_kdgkb_ioctl(int cmd, struct kbsentry __user *user_kdgkb, int perm)
> {
> unsigned char kb_func;
> + ssize_t len;
>
> if (get_user(kb_func, &user_kdgkb->kb_func))
> return -EFAULT;
>
> kb_func = array_index_nospec(kb_func, MAX_NR_FUNC);
>
> + /* size should have been a struct member */
> + len = sizeof(user_kdgkb->kb_string);
> +
> switch (cmd) {
> case KDGKBSENT: {
> - /* size should have been a struct member */
> - ssize_t len = sizeof(user_kdgkb->kb_string);
> -
> char __free(kfree) *kbs = kmalloc(len, GFP_KERNEL);
> if (!kbs)
> return -ENOMEM;
> @@ -2031,11 +2032,16 @@ int vt_do_kdgkb_ioctl(int cmd, struct kbsentry __user *user_kdgkb, int perm)
> return -EPERM;
>
> char __free(kfree) *kbs = strndup_user(user_kdgkb->kb_string,
> - sizeof(user_kdgkb->kb_string));
> + len);
> if (IS_ERR(kbs))
> return PTR_ERR(kbs);
>
> guard(spinlock_irqsave)(&func_buf_lock);
> +
> + /*
> + * Ownership transfer: vt_kdskbsent() returns a pointer
> + * that must be freed (new buffer, old buffer, or NULL).
> + */
> kbs = vt_kdskbsent(kbs, kb_func);
That's fine, but what does it have to do with len?
confused,
greg k-h
^ permalink raw reply
* Re: [PATCH] dt-bindings: serial: 8250: spacemit: fix clock property for K3 SoC
From: Greg Kroah-Hartman @ 2026-03-12 14:13 UTC (permalink / raw)
To: Yixun Lan
Cc: Jiri Slaby, Rob Herring, Krzysztof Kozlowski, Conor Dooley,
Lubomir Rintel, devicetree, Guodong Xu, Conor Dooley,
linux-kernel, linux-serial, linux-riscv, spacemit
In-Reply-To: <20260310093446-GYC318052@gentoo.org>
On Tue, Mar 10, 2026 at 05:34:46PM +0800, Yixun Lan wrote:
> Hi Greg, Jiri,
>
> Do you mind if I taking this patch via SpacemiT's SoC tree? and if
> possible, it would be nice to have your Acks..
> (or either way works for me, if you grab it and merged via tty tree)
>
> On 07:19 Wed 04 Mar , Yixun Lan wrote:
> > The UART of SpacemiT K3 SoC has same clock property as K1 generation which
> > request two clock sources, fix the binding otherwise will get DT check
> > warnings.
> >
> > Fixes: b5024e804ee0 ("dt-bindings: serial: 8250: add SpacemiT K3 UART compatible")
> I would just drop the Fixes tag, as I think at the time of Gudong
> submitting the patch, the clock driver isn't ready, so he deliberatly
> removed this clock contraint and provided with a fixed clock frequency
> (the bindings match with DTS)
>
> https://github.com/torvalds/linux/blob/v7.0-rc3/arch/riscv/boot/dts/spacemit/k3.dtsi#L414
You need to get a DT maintainer to review it before you can apply it.
If you want to take it through your tree once that happens, that's fine
with me.
thanks,
greg k-h
^ permalink raw reply
* Re: [PATCH] serial: 8250_fintek: Add support for F81214E
From: Greg KH @ 2026-03-12 14:11 UTC (permalink / raw)
To: Ravindra Rama; +Cc: jirislaby, linux-serial, linux-kernel
In-Reply-To: <CA+mnHaW481bx8nJBNkkgS+oB+=Y=+qeX+hP0q6ObULt8=ewr-g@mail.gmail.com>
On Mon, Feb 23, 2026 at 02:40:24PM -0600, Ravindra Rama wrote:
> The F81214E is a LPC/eSPI to 2 UART Super I/O chip.
>
> Functionally, it is the same as the F81216E. The only difference
> is that the F81216E has 4 UART ports, whereas the F81214E has 2
> UART ports.
>
> Signed-off-by: Ravi Rama <ravi.rama@nexthop.ai>
> ---
> drivers/tty/serial/8250/8250_fintek.c | 10 +++++++++-
> 1 file changed, 9 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/tty/serial/8250/8250_fintek.c
> b/drivers/tty/serial/8250/8250_fintek.c
> index b4461a89b8d0..976c5748905c 100644
> --- a/drivers/tty/serial/8250/8250_fintek.c
> +++ b/drivers/tty/serial/8250/8250_fintek.c
> @@ -1,6 +1,6 @@
> // SPDX-License-Identifier: GPL-2.0
> /*
> - * Probe for F81216A LPC to 4 UART
> + * Probe for F81216A LPC to 4 UART and F81214E LPC/eSPI to 2 UART
> *
> * Copyright (C) 2014-2016 Ricardo Ribalda, Qtechnology A/S
> */
> @@ -23,6 +23,7 @@
> #define CHIP_ID_F81216AD 0x1602
> #define CHIP_ID_F81216E 0x1617
> #define CHIP_ID_F81216H 0x0501
> +#define CHIP_ID_F81214E 0x1417
> #define CHIP_ID_F81216 0x0802
> #define VENDOR_ID1 0x23
> #define VENDOR_ID1_VAL 0x19
Hi,
This is the friendly patch-bot of Greg Kroah-Hartman. You have sent him
a patch that has triggered this response. He used to manually respond
to these common problems, but in order to save his sanity (he kept
writing the same thing over and over, yet to different people), I was
created. Hopefully you will not take offence and will fix the problem
in your patch and resubmit it so that it can be accepted into the Linux
kernel tree.
You are receiving this message because of the following common error(s)
as indicated below:
- Your patch is malformed (tabs converted to spaces, linewrapped, etc.)
and can not be applied. Please read the file,
Documentation/process/email-clients.rst in order to fix this.
If you wish to discuss this problem further, or you have questions about
how to resolve this issue, please feel free to respond to this email and
Greg will reply once he has dug out from the pending patches received
from other developers.
thanks,
greg k-h's patch email bot
^ permalink raw reply
* Re: [PATCH] tty: vt: keyboard: fix general protection fault in k_meta
From: Greg KH @ 2026-03-12 13:51 UTC (permalink / raw)
To: Soham Kute
Cc: jirislaby, linux-serial, linux-kernel,
syzbot+03f79366754268a0f20c
In-Reply-To: <20260207192708.44188-1-officialsohamkute@gmail.com>
On Sun, Feb 08, 2026 at 12:57:08AM +0530, Soham Kute wrote:
> syzbot reported a general protection fault in k_meta() caused by
> dereferencing an invalid keyboard pointer when checking META mode.
>
> Add a defensive check to ensure the keyboard pointer is valid before
> calling vc_kbd_mode().
How can kbd be NULL here? What causes that to happen?
>
> Reported-by: syzbot+03f79366754268a0f20c@syzkaller.appspotmail.com
>
> Signed-off-by: Soham Kute <officialsohamkute@gmail.com>
> ---
> drivers/tty/vt/keyboard.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c
> index d65fc60dd..b535d7a42 100644
> --- a/drivers/tty/vt/keyboard.c
> +++ b/drivers/tty/vt/keyboard.c
> @@ -880,7 +880,7 @@ static void k_meta(struct vc_data *vc, unsigned char value, char up_flag)
> if (up_flag)
> return;
>
> - if (vc_kbd_mode(kbd, VC_META)) {
> + if (kbd && vc_kbd_mode(kbd, VC_META)) {
What prevents kbd from being NULL _right_ after you check it? There's
no locking here at all...
Perhaps fix the root problem here?
thanks,
greg k-h
^ permalink raw reply
* Re: [PATCH 0/3] vt: add modifier support to cursor and navigation keys
From: Greg Kroah-Hartman @ 2026-03-12 13:48 UTC (permalink / raw)
To: Nicolas Pitre; +Cc: Jiri Slaby, Alexey Gladkov, linux-serial, linux-kernel
In-Reply-To: <p6r658p5-4q55-8pn6-q78n-107599qq653n@syhkavp.arg>
On Fri, Mar 06, 2026 at 01:26:56PM -0500, Nicolas Pitre wrote:
> On Tue, 10 Feb 2026, Greg Kroah-Hartman wrote:
>
> > On Sun, Feb 08, 2026 at 11:22:27AM -0500, Nicolas Pitre wrote:
> > > On Sun, 8 Feb 2026, Greg Kroah-Hartman wrote:
> > >
> > > > Argh, sorry, I saw this patch series too late for this merge window.
> > > > I'll review it after -rc1 is out.
> > >
> > > Too bad.
> > >
> > > But please at least consider this one now
> > > https://lkml.org/lkml/2026/1/27/1886
> > > and queue it for the stable tree as well.
> >
> > Sorry, that slipped through as well, I'll grab it after -rc1 is out and
> > get it backported to stable kernels.
>
> Ping. ;-)
Sorry, am catching up now...
^ permalink raw reply
* Re: [PATCH] dt-bindings: serial: 8250: spacemit: fix clock property for K3 SoC
From: Rob Herring (Arm) @ 2026-03-12 13:46 UTC (permalink / raw)
To: Yixun Lan
Cc: devicetree, Conor Dooley, Conor Dooley, Greg Kroah-Hartman,
Lubomir Rintel, linux-kernel, Jiri Slaby, Guodong Xu,
linux-serial, Krzysztof Kozlowski, spacemit, linux-riscv
In-Reply-To: <20260304-01-uart-clock-names-v1-1-338483f04a8b@kernel.org>
On Wed, 04 Mar 2026 07:19:39 +0000, Yixun Lan wrote:
> The UART of SpacemiT K3 SoC has same clock property as K1 generation which
> request two clock sources, fix the binding otherwise will get DT check
> warnings.
>
> Fixes: b5024e804ee0 ("dt-bindings: serial: 8250: add SpacemiT K3 UART compatible")
> Signed-off-by: Yixun Lan <dlan@kernel.org>
> ---
> Documentation/devicetree/bindings/serial/8250.yaml | 5 ++++-
> 1 file changed, 4 insertions(+), 1 deletion(-)
>
Acked-by: Rob Herring (Arm) <robh@kernel.org>
^ permalink raw reply
* Re: [PATCH v1 2/2] LRW UART: serial: add driver for the LRW UART
From: Greg KH @ 2026-03-12 13:45 UTC (permalink / raw)
To: LiuQingtao
Cc: jirislaby, robh, krzk+dt, conor+dt, neil.armstrong,
bjorn.andersson, marex, dev, mani, prabhakar.mahadev-lad.rj,
linux-serial, linux-riscv, liu.wenhong35, liu.qingtao2, hu.yuye,
dai.hualiang, deng.weixian, jia.yunxiang, bai.lu5, yang.susheng,
shen.lin1, tan.hu, zuo.jiang
In-Reply-To: <20260213093334.9217-3-qtliu@mail.ustc.edu.cn>
On Fri, Feb 13, 2026 at 05:33:34PM +0800, LiuQingtao wrote:
> From: Wenhong Liu <liu.wenhong35@zte.com.cn>
>
> This commit introduces a serial driver for the LRW UART controller
>
> Key features implemented:
> - Support for FIFO mode (16-byte depth)
> - Baud rate configuration
> - Standard asynchronous communication formats:
> * Data bits: 5, 6, 7, 8, 9 bits
> * Parity: odd, even, fixed, none
> * Stop bits: 1 or 2 bits
> - Hardware flow control (RTS/CTS)
> - Multiple interrupt reporting mechanisms
>
> Signed-off-by: Wenhong Liu <liu.wenhong35@zte.com.cn>
> Signed-off-by: Qingtao Liu <liu.qingtao2@zte.com.cn>
> ---
> MAINTAINERS | 3 +
> drivers/tty/serial/Kconfig | 33 +
> drivers/tty/serial/Makefile | 1 +
> drivers/tty/serial/lrw_uart.c | 2822 ++++++++++++++++++++++++++++++
This really is a totally new uart? No relation to any existing devices
at all? Why would that be created?
Anyway, this doesn't seem to build properly, how was it tested?
> --- a/include/uapi/linux/serial_core.h
> +++ b/include/uapi/linux/serial_core.h
> @@ -231,6 +231,9 @@
> /* Sunplus UART */
> #define PORT_SUNPLUS 123
>
> +/* LRW UART */
> +#define PORT_LRW 124
Why is this id needed?
thanks,
greg k-h
^ permalink raw reply
* Re: [PATCH] serial: 8250_ni: use kzalloc_obj() for allocation
From: Greg Kroah-Hartman @ 2026-03-12 13:44 UTC (permalink / raw)
To: Pete Connor; +Cc: Chaitanya Vadrevu, Jiri Slaby, linux-serial, linux-kernel
In-Reply-To: <20260217031913.1166949-1-pete.connor@pythcoiner.dev>
On Mon, Feb 16, 2026 at 10:19:13PM -0500, Pete Connor wrote:
> Replace kzalloc() with the preferred kzalloc_obj() helper
> to address a checkpatch warning.
>
> Signed-off-by: Pete Connor <pete.connor@pythcoiner.dev>
Something went wrong with your indentation here :(
^ permalink raw reply
* Re: [PATCH] serial: tegra: remove Kconfig dependency on APB DMA controller
From: Greg Kroah-Hartman @ 2026-03-12 13:43 UTC (permalink / raw)
To: Francesco Lavra
Cc: Jiri Slaby, Andy Shevchenko, Kartik Rajput, Geert Uytterhoeven,
Wolfram Sang, Robert Marko, Thierry Bultel, Douglas Anderson,
linux-kernel, linux-serial
In-Reply-To: <c850b374071b694e4c33ca091d124c0e90df02e1.camel@baylibre.com>
On Wed, Feb 25, 2026 at 12:35:53PM +0100, Francesco Lavra wrote:
> Friendly ping
Can you resend this, I don't have it around anymore, thanks.
greg k-h
^ permalink raw reply
* Re: [PATCH] 8250_men_mcb: port.dev unset can entail a null ptr deref
From: Greg KH @ 2026-03-12 13:42 UTC (permalink / raw)
To: Filip Jensen
Cc: jirislaby, dev-jorge.sanjuangarcia, linux-kernel, linux-serial,
Jose Javier Rodriguez Barbarin
In-Reply-To: <20260305162815.41818-1-dev-Felipe.Jensen@duagon.com>
On Thu, Mar 05, 2026 at 05:28:15PM +0100, Filip Jensen wrote:
> The dev field of the uart_port structure is needed in the later call to
> serial8250_register_8250_port and unless the port is part of the initial
> registered ports (cf. CONFIG_SERIAL_8250_RUNTIME_UARTS) with a dev
> already set, it will make a null pointer deref in has_acpi_companion
> and could also later at uart_add_one_port call:
>
> Oops: general protection fault, probably for non-canonical address
> KASAN: null-ptr-deref in range
> RIP: 0010:serial8250_register_8250_port+0xd34/0x2030
> drivers/tty/serial/8250/8250_core.c
>
> A proposal for a security check against this missing field in any driver
> for the 8250_core.c will be sent in another patch.
>
> Reviewed-by: Jose Javier Rodriguez Barbarin <dev-josejavier.rodriguez@duagon.com>
> Signed-off-by: Filip Jensen <dev-Felipe.Jensen@duagon.com>
> ---
> drivers/tty/serial/8250/8250_men_mcb.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/drivers/tty/serial/8250/8250_men_mcb.c b/drivers/tty/serial/8250/8250_men_mcb.c
> index 6373234da03d..259516078793 100644
> --- a/drivers/tty/serial/8250/8250_men_mcb.c
> +++ b/drivers/tty/serial/8250/8250_men_mcb.c
> @@ -214,6 +214,7 @@ static int serial_8250_men_mcb_probe(struct mcb_device *mdev,
> uart.port.iotype = UPIO_MEM;
> uart.port.uartclk = men_lookup_uartclk(mdev);
> uart.port.irq = mcb_get_irq(mdev);
> + uart.port.dev = &mdev->dev;
> uart.port.mapbase = (unsigned long) mem->start
> + data->offset[i];
>
> --
> 2.34.1
>
What changed to require this patch? And can you fix up the same issues
that Jiri pointed out in your other patch like this?
thanks,
greg k-h
^ permalink raw reply
* Re: [PATCH] tty: ipwireless: fix memory leak in do_go_offline()
From: Greg Kroah-Hartman @ 2026-03-12 13:40 UTC (permalink / raw)
To: David Sterba
Cc: Qingfang Deng, Jiri Kosina, David Sterba, Jiri Slaby,
Stephen Blackheath, Ben Martel, linux-kernel, linux-serial
In-Reply-To: <20260312120036.GF5735@suse.cz>
On Thu, Mar 12, 2026 at 01:00:36PM +0100, David Sterba wrote:
> On Fri, Mar 06, 2026 at 11:40:58AM +0800, Qingfang Deng wrote:
> > The ppp_channel is allocated and registered in do_go_online(). But when
> > the channel is unregistered in do_go_offline(), the driver forgets to
> > release its memory. This leads to a memory leak each time the network
> > goes online and then offline.
> >
> > Fix this by adding a kfree call after unregistering the channel.
> >
> > Fixes: 099dc4fb6265 ("ipwireless: driver for PC Card 3G/UMTS modem")
> > Signed-off-by: Qingfang Deng <dqfext@gmail.com>
>
> Thanks, but the driver is going to be deleted.
>
Great, can you send a patch to do that?
thanks,
greg k-h
^ permalink raw reply
* Re: [PATCH] tty: ipwireless: fix memory leak in do_go_offline()
From: David Sterba @ 2026-03-12 12:00 UTC (permalink / raw)
To: Qingfang Deng
Cc: Jiri Kosina, David Sterba, Greg Kroah-Hartman, Jiri Slaby,
Stephen Blackheath, Ben Martel, linux-kernel, linux-serial
In-Reply-To: <20260306034058.386747-1-dqfext@gmail.com>
On Fri, Mar 06, 2026 at 11:40:58AM +0800, Qingfang Deng wrote:
> The ppp_channel is allocated and registered in do_go_online(). But when
> the channel is unregistered in do_go_offline(), the driver forgets to
> release its memory. This leads to a memory leak each time the network
> goes online and then offline.
>
> Fix this by adding a kfree call after unregistering the channel.
>
> Fixes: 099dc4fb6265 ("ipwireless: driver for PC Card 3G/UMTS modem")
> Signed-off-by: Qingfang Deng <dqfext@gmail.com>
Thanks, but the driver is going to be deleted.
^ permalink raw reply
* [PATCH] tty: serial: imx: keep dma request disabled before dma transfer setup
From: Sherry Sun @ 2026-03-12 9:45 UTC (permalink / raw)
To: gregkh, jirislaby, Frank.Li, s.hauer, kernel, festevam, tglx,
mingo
Cc: imx, linux-kernel, linux-serial, linux-arm-kernel
From: Robin Gong <yibin.gong@nxp.com>
Since sdma hardware configure postpone to transfer phase, have to
disable dma request before dma transfer setup because there is a
hardware limitation on sdma event enable(ENBLn) as below.
Refer SDMA 2.6.28 Channel Enable RAM (SDMAARMx_CHNENBLn) section:
"It is thus essential for the Arm platform to program them before any
DMA request is triggered to the SDMA, otherwise an unpredictable
combination of channels may be started."
Signed-off-by: Robin Gong <yibin.gong@nxp.com>
Signed-off-by: Sherry Sun <sherry.sun@nxp.com>
---
drivers/tty/serial/imx.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c
index c488e5d372ff..251a50c8aa38 100644
--- a/drivers/tty/serial/imx.c
+++ b/drivers/tty/serial/imx.c
@@ -1442,9 +1442,9 @@ static void imx_uart_enable_dma(struct imx_port *sport)
imx_uart_setup_ufcr(sport, TXTL_DMA, RXTL_DMA);
- /* set UCR1 */
+ /* set UCR1 except TXDMAEN which would be enabled in imx_uart_dma_tx */
ucr1 = imx_uart_readl(sport, UCR1);
- ucr1 |= UCR1_RXDMAEN | UCR1_TXDMAEN | UCR1_ATDMAEN;
+ ucr1 |= UCR1_RXDMAEN | UCR1_ATDMAEN;
imx_uart_writel(sport, ucr1, UCR1);
sport->dma_is_enabled = 1;
@@ -1567,8 +1567,9 @@ static int imx_uart_startup(struct uart_port *port)
imx_uart_enable_ms(&sport->port);
if (dma_is_inited) {
- imx_uart_enable_dma(sport);
+ /* Note: enable dma request after transfer start! */
imx_uart_start_rx_dma(sport);
+ imx_uart_enable_dma(sport);
} else {
ucr1 = imx_uart_readl(sport, UCR1);
ucr1 |= UCR1_RRDYEN;
--
2.37.1
^ permalink raw reply related
* [PATCH 2/2] serial: sh-sci: Add support for RZ/G3L RSCI
From: Biju @ 2026-03-12 8:26 UTC (permalink / raw)
To: Greg Kroah-Hartman, Jiri Slaby, Geert Uytterhoeven, Magnus Damm
Cc: Biju Das, Lad Prabhakar, Wolfram Sang, linux-kernel, linux-serial,
linux-renesas-soc, Biju Das
In-Reply-To: <20260312082708.98835-1-biju.das.jz@bp.renesas.com>
From: Biju Das <biju.das.jz@bp.renesas.com>
Add support for RZ/G3L RSCI. The RSCI IP found on the RZ/G3L SoC is
similar to RZ/G3E, but it has 3 clocks (2 module clocks + 1 external
clock) instead of 6 clocks (5 module clocks + 1 external clock) on the
RZ/G3E. Both RZ/G3L and RZ/G3E have a 32-bit FIFO, but RZ/G3L has a
single TCLK with internal dividers, whereas the RZ/G3E has explicit
clocks for TCLK and its dividers. Add a new port type
RSCI_PORT_SCIF32_SINGLE_TCLK to handle this clock difference.
Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
---
drivers/tty/serial/rsci.c | 13 +++++++++++++
drivers/tty/serial/rsci.h | 1 +
drivers/tty/serial/sh-sci-common.h | 1 +
drivers/tty/serial/sh-sci.c | 14 +++++++++++---
4 files changed, 26 insertions(+), 3 deletions(-)
diff --git a/drivers/tty/serial/rsci.c b/drivers/tty/serial/rsci.c
index c3f12df693ad..b00c9e385169 100644
--- a/drivers/tty/serial/rsci.c
+++ b/drivers/tty/serial/rsci.c
@@ -695,6 +695,13 @@ struct sci_of_data of_rsci_rzg3e_data = {
.params = &rsci_rzg3e_port_params,
};
+struct sci_of_data of_rsci_rzg3l_data = {
+ .type = RSCI_PORT_SCIF32_SINGLE_TCLK,
+ .ops = &rsci_port_ops,
+ .uart_ops = &rsci_uart_ops,
+ .params = &rsci_rzg3e_port_params,
+};
+
struct sci_of_data of_rsci_rzt2h_data = {
.type = RSCI_PORT_SCIF16,
.ops = &rsci_port_ops,
@@ -703,6 +710,11 @@ struct sci_of_data of_rsci_rzt2h_data = {
};
#ifdef CONFIG_SERIAL_SH_SCI_EARLYCON
+static int __init rsci_rzg3l_early_console_setup(struct earlycon_device *device,
+ const char *opt)
+{
+ return scix_early_console_setup(device, &of_rsci_rzg3l_data);
+}
static int __init rsci_rzg3e_early_console_setup(struct earlycon_device *device,
const char *opt)
@@ -716,6 +728,7 @@ static int __init rsci_rzt2h_early_console_setup(struct earlycon_device *device,
return scix_early_console_setup(device, &of_rsci_rzt2h_data);
}
+OF_EARLYCON_DECLARE(rsci, "renesas,r9a08g046-rsci", rsci_rzg3l_early_console_setup);
OF_EARLYCON_DECLARE(rsci, "renesas,r9a09g047-rsci", rsci_rzg3e_early_console_setup);
OF_EARLYCON_DECLARE(rsci, "renesas,r9a09g077-rsci", rsci_rzt2h_early_console_setup);
diff --git a/drivers/tty/serial/rsci.h b/drivers/tty/serial/rsci.h
index 2aa2ba3973ee..0985fd1b3348 100644
--- a/drivers/tty/serial/rsci.h
+++ b/drivers/tty/serial/rsci.h
@@ -6,6 +6,7 @@
#include "sh-sci-common.h"
extern struct sci_of_data of_rsci_rzg3e_data;
+extern struct sci_of_data of_rsci_rzg3l_data;
extern struct sci_of_data of_rsci_rzt2h_data;
#endif /* __RSCI_H__ */
diff --git a/drivers/tty/serial/sh-sci-common.h b/drivers/tty/serial/sh-sci-common.h
index f363a659c46a..01ff9fced803 100644
--- a/drivers/tty/serial/sh-sci-common.h
+++ b/drivers/tty/serial/sh-sci-common.h
@@ -9,6 +9,7 @@
enum SCI_PORT_TYPE {
RSCI_PORT_SCIF16 = BIT(7) | 0,
RSCI_PORT_SCIF32 = BIT(7) | 1,
+ RSCI_PORT_SCIF32_SINGLE_TCLK = BIT(7) | 2,
};
enum SCI_CLKS {
diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
index bd7486315338..6c819b6b2425 100644
--- a/drivers/tty/serial/sh-sci.c
+++ b/drivers/tty/serial/sh-sci.c
@@ -1184,7 +1184,8 @@ static int sci_handle_errors(struct uart_port *port)
static bool sci_is_rsci_type(u8 type)
{
- return (type == RSCI_PORT_SCIF16 || type == RSCI_PORT_SCIF32);
+ return (type == RSCI_PORT_SCIF16 || type == RSCI_PORT_SCIF32 ||
+ type == RSCI_PORT_SCIF32_SINGLE_TCLK);
}
static int sci_handle_fifo_overrun(struct uart_port *port)
@@ -3181,7 +3182,8 @@ static int sci_init_clocks(struct sci_port *sci_port, struct device *dev)
if (sci_port->type == PORT_HSCIF) {
clk_names[SCI_SCK] = "hsck";
- } else if (sci_port->type == RSCI_PORT_SCIF16) {
+ } else if (sci_port->type == RSCI_PORT_SCIF16 ||
+ sci_port->type == RSCI_PORT_SCIF32_SINGLE_TCLK) {
clk_names[SCI_FCK] = "operation";
clk_names[SCI_BRG_INT] = "bus";
} else if (sci_port->type == RSCI_PORT_SCIF32) {
@@ -3196,7 +3198,8 @@ static int sci_init_clocks(struct sci_port *sci_port, struct device *dev)
if (IS_ERR(clk))
return PTR_ERR(clk);
- if (!clk && sci_port->type == RSCI_PORT_SCIF16 &&
+ if (!clk && (sci_port->type == RSCI_PORT_SCIF16 ||
+ sci_port->type == RSCI_PORT_SCIF32_SINGLE_TCLK) &&
(i == SCI_FCK || i == SCI_BRG_INT))
return dev_err_probe(dev, -ENODEV, "failed to get %s\n", name);
@@ -3330,6 +3333,7 @@ static int sci_init_single(struct platform_device *dev,
break;
case PORT_SCIFA:
case RSCI_PORT_SCIF32:
+ case RSCI_PORT_SCIF32_SINGLE_TCLK:
sci_port->rx_trigger = 32;
break;
case PORT_SCIF:
@@ -3663,6 +3667,10 @@ static const struct of_device_id of_sci_match[] __maybe_unused = {
.data = &of_sci_scif_rzv2h,
},
#ifdef CONFIG_SERIAL_RSCI
+ {
+ .compatible = "renesas,r9a08g046-rsci",
+ .data = &of_rsci_rzg3l_data,
+ },
{
.compatible = "renesas,r9a09g047-rsci",
.data = &of_rsci_rzg3e_data,
--
2.43.0
^ permalink raw reply related
* [PATCH 1/2] dt-bindings: serial: renesas,rsci: Document RZ/G3L SoC
From: Biju @ 2026-03-12 8:26 UTC (permalink / raw)
To: Greg Kroah-Hartman, Jiri Slaby, Rob Herring, Krzysztof Kozlowski,
Conor Dooley, Geert Uytterhoeven, Magnus Damm
Cc: Biju Das, Lad Prabhakar, linux-kernel, linux-serial, devicetree,
linux-renesas-soc, Biju Das
In-Reply-To: <20260312082708.98835-1-biju.das.jz@bp.renesas.com>
From: Biju Das <biju.das.jz@bp.renesas.com>
Document the serial communication interface (RSCI) used on the Renesas
RZ/G3L (R9A08G046) SoC. This SoC integrates the same RSCI IP block as
the RZ/G3E (R9A09G047), but it has 3 clocks compared to 6 clocks on
the RZ/G3E SoC. The RZ/G3L has a single TCLK with internal dividers,
whereas the RZ/G3E has explicit clocks for TCLK and its dividers.
Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
---
.../bindings/serial/renesas,rsci.yaml | 26 +++++++++++++++++++
1 file changed, 26 insertions(+)
diff --git a/Documentation/devicetree/bindings/serial/renesas,rsci.yaml b/Documentation/devicetree/bindings/serial/renesas,rsci.yaml
index e059b14775eb..85ebb3056066 100644
--- a/Documentation/devicetree/bindings/serial/renesas,rsci.yaml
+++ b/Documentation/devicetree/bindings/serial/renesas,rsci.yaml
@@ -14,6 +14,7 @@ properties:
compatible:
oneOf:
- enum:
+ - renesas,r9a08g046-rsci # RZ/G3L
- renesas,r9a09g047-rsci # RZ/G3E
- renesas,r9a09g077-rsci # RZ/T2H
@@ -145,6 +146,31 @@ allOf:
- resets
- reset-names
+ - if:
+ properties:
+ compatible:
+ contains:
+ const: renesas,r9a08g046-rsci
+ then:
+ properties:
+ interrupts:
+ minItems: 6
+
+ interrupt-names:
+ minItems: 6
+
+ clocks:
+ minItems: 2
+ maxItems: 3
+
+ clock-names:
+ minItems: 2
+ maxItems: 3
+
+ required:
+ - resets
+ - reset-names
+
unevaluatedProperties: false
examples:
--
2.43.0
^ permalink raw reply related
* [PATCH 0/2] Add support for RZ/G3L RSCI
From: Biju @ 2026-03-12 8:26 UTC (permalink / raw)
To: Greg Kroah-Hartman, Jiri Slaby, Rob Herring, Krzysztof Kozlowski,
Conor Dooley, Geert Uytterhoeven, Magnus Damm
Cc: Biju Das, Lad Prabhakar, linux-kernel, linux-serial, devicetree,
linux-renesas-soc, Biju Das
From: Biju Das <biju.das.jz@bp.renesas.com>
Add support for RZ/G3L RSCI. The RSCI IP found on the RZ/G3L SoC is
similar to RZ/G3E, but it has 3 clocks (2 module clocks + 1 external
clock) instead of 6 clocks (5 module clocks + 1 external clock) on the
RZ/G3E. Both RZ/G3L and RZ/G3E have a 32-bit FIFO, but RZ/G3L has a
single TCLK with internal dividers, whereas the RZ/G3E has explicit
clocks for TCLK and its dividers. Add a new port type
RSCI_PORT_SCIF32_SINGLE_TCLK to handle this clock difference.
Biju Das (2):
dt-bindings: serial: renesas,rsci: Document RZ/G3L SoC
serial: sh-sci: Add support for RZ/G3L RSCI
.../bindings/serial/renesas,rsci.yaml | 26 +++++++++++++++++++
drivers/tty/serial/rsci.c | 13 ++++++++++
drivers/tty/serial/rsci.h | 1 +
drivers/tty/serial/sh-sci-common.h | 1 +
drivers/tty/serial/sh-sci.c | 14 +++++++---
5 files changed, 52 insertions(+), 3 deletions(-)
--
2.43.0
^ permalink raw reply
* [PATCH] serdev: serdev.h: clean up kernel-doc comments
From: Randy Dunlap @ 2026-03-11 5:23 UTC (permalink / raw)
To: linux-kernel; +Cc: Randy Dunlap, Rob Herring, linux-serial, Greg Kroah-Hartman
Correct kernel-doc comment format and add a missing to avoid
kernel-doc warnings:
Warning: include/linux/serdev.h:49 struct member 'write_comp' not
described in 'serdev_device'
Warning: include/linux/serdev.h:49 struct member 'write_lock' not
described in 'serdev_device'
Warning: include/linux/serdev.h:68 struct member 'shutdown' not described
in 'serdev_device_driver'
Warning: include/linux/serdev.h:134 function parameter 'serdev' not
described in 'serdev_device_put'
Warning: include/linux/serdev.h:162 function parameter 'ctrl' not
described in 'serdev_controller_put'
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
---
Cc: Rob Herring <robh@kernel.org>
Cc: linux-serial@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
include/linux/serdev.h | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
--- linux-next-20260309.orig/include/linux/serdev.h
+++ linux-next-20260309/include/linux/serdev.h
@@ -37,8 +37,8 @@ struct serdev_device_ops {
* @nr: Device number on serdev bus.
* @ctrl: serdev controller managing this device.
* @ops: Device operations.
- * @write_comp Completion used by serdev_device_write() internally
- * @write_lock Lock to serialize access when writing data
+ * @write_comp: Completion used by serdev_device_write() internally
+ * @write_lock: Lock to serialize access when writing data
*/
struct serdev_device {
struct device dev;
@@ -60,6 +60,7 @@ static inline struct serdev_device *to_s
* structure.
* @probe: binds this driver to a serdev device.
* @remove: unbinds this driver from the serdev device.
+ * @shutdown: shut down this serdev device.
*/
struct serdev_device_driver {
struct device_driver driver;
@@ -129,7 +130,7 @@ static inline void serdev_device_set_drv
/**
* serdev_device_put() - decrement serdev device refcount
- * @serdev serdev device.
+ * @serdev: serdev device.
*/
static inline void serdev_device_put(struct serdev_device *serdev)
{
@@ -157,7 +158,7 @@ static inline void serdev_controller_set
/**
* serdev_controller_put() - decrement controller refcount
- * @ctrl serdev controller.
+ * @ctrl: serdev controller.
*/
static inline void serdev_controller_put(struct serdev_controller *ctrl)
{
^ permalink raw reply
* [PATCH v1] serial: qcom-geni: Fix RTS behavior with flow control
From: Anup Kulkarni @ 2026-03-10 10:41 UTC (permalink / raw)
To: kernel, gregkh, jirislaby, praveen.talari, bryan.odonoghue,
viken.dadhaniya, quic_zongjian, quic_jseerapu, krzk,
linux-arm-msm, linux-kernel, linux-serial
Cc: Anup Kulkarni
When userspace enables flow control (CRTSCTS), the driver
deasserts RTS even when the receive buffer has space. This prevents the
peer device from transmitting, causing communication to stall.
The root cause is that the driver unconditionally uses manual RTS control
regardless of flow control mode. When CRTSCTS is set, the hardware should
automatically manage RTS based on buffer status, but the driver overrides
this by setting manual control.
Fix this by introducing port->manual_flow flag. In set_termios(), disable
manual flow when CRTSCTS is set. In set_mctrl(), only assert
SE_UART_MANUAL_RFR when manual_flow is active. Verified by enabling and
disabling hardware flow control with stty.
Signed-off-by: Anup Kulkarni <anup.kulkarni@oss.qualcomm.com>
---
drivers/tty/serial/qcom_geni_serial.c | 19 +++++++++++++++----
1 file changed, 15 insertions(+), 4 deletions(-)
diff --git a/drivers/tty/serial/qcom_geni_serial.c b/drivers/tty/serial/qcom_geni_serial.c
index e6b0a55f0cfb..9854bb2406e3 100644
--- a/drivers/tty/serial/qcom_geni_serial.c
+++ b/drivers/tty/serial/qcom_geni_serial.c
@@ -146,6 +146,7 @@ struct qcom_geni_serial_port {
int wakeup_irq;
bool rx_tx_swap;
bool cts_rts_swap;
+ bool manual_flow;
struct qcom_geni_private_data private_data;
const struct qcom_geni_device_data *dev_data;
@@ -250,7 +251,7 @@ static void qcom_geni_serial_set_mctrl(struct uart_port *uport,
if (mctrl & TIOCM_LOOP)
port->loopback = RX_TX_CTS_RTS_SORTED;
- if (!(mctrl & TIOCM_RTS) && !uport->suspended)
+ if (port->manual_flow && !(mctrl & TIOCM_RTS) && !uport->suspended)
uart_manual_rfr = UART_MANUAL_RFR_EN | UART_RFR_NOT_READY;
writel(uart_manual_rfr, uport->membase + SE_UART_MANUAL_RFR);
}
@@ -1401,11 +1402,21 @@ static void qcom_geni_serial_set_termios(struct uart_port *uport,
else
stop_bit_len = TX_STOP_BIT_LEN_1;
- /* flow control, clear the CTS_MASK bit if using flow control. */
- if (termios->c_cflag & CRTSCTS)
+ /* Configure flow control based on CRTSCTS flag.
+ * When CRTSCTS is set, use HW/auto flow control mode, where HW
+ * controls the RTS/CTS pin based FIFO state.
+ * When CRTSCTS is clear, the CTS pin value is ignored for TX
+ * path and RTS pin can be set/cleared using registers, for RX
+ * path.
+ */
+
+ if (termios->c_cflag & CRTSCTS) {
tx_trans_cfg &= ~UART_CTS_MASK;
- else
+ port->manual_flow = false;
+ } else {
tx_trans_cfg |= UART_CTS_MASK;
+ port->manual_flow = true;
+ }
if (baud) {
uart_update_timeout(uport, termios->c_cflag, baud);
--
2.34.1
^ permalink raw reply related
* Re: [PATCH] dt-bindings: serial: 8250: spacemit: fix clock property for K3 SoC
From: Yixun Lan @ 2026-03-10 9:34 UTC (permalink / raw)
To: Greg Kroah-Hartman, Jiri Slaby
Cc: Rob Herring, Krzysztof Kozlowski, Conor Dooley, Lubomir Rintel,
devicetree, Guodong Xu, Conor Dooley, linux-kernel, linux-serial,
linux-riscv, spacemit
In-Reply-To: <20260304-01-uart-clock-names-v1-1-338483f04a8b@kernel.org>
Hi Greg, Jiri,
Do you mind if I taking this patch via SpacemiT's SoC tree? and if
possible, it would be nice to have your Acks..
(or either way works for me, if you grab it and merged via tty tree)
On 07:19 Wed 04 Mar , Yixun Lan wrote:
> The UART of SpacemiT K3 SoC has same clock property as K1 generation which
> request two clock sources, fix the binding otherwise will get DT check
> warnings.
>
> Fixes: b5024e804ee0 ("dt-bindings: serial: 8250: add SpacemiT K3 UART compatible")
I would just drop the Fixes tag, as I think at the time of Gudong
submitting the patch, the clock driver isn't ready, so he deliberatly
removed this clock contraint and provided with a fixed clock frequency
(the bindings match with DTS)
https://github.com/torvalds/linux/blob/v7.0-rc3/arch/riscv/boot/dts/spacemit/k3.dtsi#L414
> Signed-off-by: Yixun Lan <dlan@kernel.org>
> ---
> Documentation/devicetree/bindings/serial/8250.yaml | 5 ++++-
> 1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/Documentation/devicetree/bindings/serial/8250.yaml b/Documentation/devicetree/bindings/serial/8250.yaml
> index 73851f19330d..e9e07c2356bc 100644
> --- a/Documentation/devicetree/bindings/serial/8250.yaml
> +++ b/Documentation/devicetree/bindings/serial/8250.yaml
> @@ -63,7 +63,9 @@ allOf:
> properties:
> compatible:
> contains:
> - const: spacemit,k1-uart
> + enum:
> + - spacemit,k1-uart
> + - spacemit,k3-uart
> then:
> properties:
> clock-names:
> @@ -76,6 +78,7 @@ allOf:
> contains:
> enum:
> - spacemit,k1-uart
> + - spacemit,k3-uart
> - nxp,lpc1850-uart
> then:
> required:
>
> ---
> base-commit: ec1fb4e55df47ed043ab2ccc6787e39b9d67e49b
> change-id: 20260304-01-uart-clock-names-551463132daa
>
> Best regards,
> --
> Yixun Lan <dlan@kernel.org>
>
--
Yixun Lan (dlan)
^ permalink raw reply
* Re: [PATCH v2 RESEND] dt-bindings: serial: snps-dw-apb-uart: Add RV1103B compatible
From: Heiko Stuebner @ 2026-03-10 8:11 UTC (permalink / raw)
To: gregkh, Fabio Estevam
Cc: robh, krzk+dt, conor+dt, linux-kernel, linux-serial, devicetree,
Fabio Estevam, Krzysztof Kozlowski
In-Reply-To: <20260310000606.415206-1-festevam@gmail.com>
Am Dienstag, 10. März 2026, 01:06:06 Mitteleuropäische Normalzeit schrieb Fabio Estevam:
> From: Fabio Estevam <festevam@nabladev.com>
>
> The RV1103B UART is compatible with the existing DesignWare APB UART
> binding. Add the rockchip,rv1103b-uart compatible string.
>
> Signed-off-by: Fabio Estevam <festevam@nabladev.com>
> Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Reviewed-by: Heiko Stuebner <heiko@sntech.de>
> ---
> Changes since v1:
> - Make commit log more concise.
>
> Documentation/devicetree/bindings/serial/snps-dw-apb-uart.yaml | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/Documentation/devicetree/bindings/serial/snps-dw-apb-uart.yaml b/Documentation/devicetree/bindings/serial/snps-dw-apb-uart.yaml
> index 6efe43089a74..685c1eceb782 100644
> --- a/Documentation/devicetree/bindings/serial/snps-dw-apb-uart.yaml
> +++ b/Documentation/devicetree/bindings/serial/snps-dw-apb-uart.yaml
> @@ -71,6 +71,7 @@ properties:
> - rockchip,rk3568-uart
> - rockchip,rk3576-uart
> - rockchip,rk3588-uart
> + - rockchip,rv1103b-uart
> - rockchip,rv1108-uart
> - rockchip,rv1126-uart
> - sophgo,sg2044-uart
>
^ permalink raw reply
* Re: [PATCH v2] serial: 8250: Fix null ptr deref has_acpi_companion
From: Jiri Slaby @ 2026-03-10 7:17 UTC (permalink / raw)
To: Filip Jensen, gregkh, ilpo.jarvinen
Cc: linux-kernel, linux-serial, Jose Javier Rodriguez Barbarin
In-Reply-To: <20260309142836.95514-1-dev-Felipe.Jensen@duagon.com>
The subject is not a proper English though :). Esp. the missing
preposition. And parens.
What about:
serial: 8250: Fix NULL pointer dereference in has_acpi_companion()
?
On 09. 03. 26, 15:28, Filip Jensen wrote:
...
> --- a/drivers/tty/serial/8250/8250_core.c
> +++ b/drivers/tty/serial/8250/8250_core.c
> @@ -756,6 +756,8 @@ int serial8250_register_8250_port(const struct uart_8250_port *up)
> if (ret)
> goto err;
> }
> + if (!uart->port.dev)
> + return -EINVAL;
Does this even compile?
thanks,
--
js
suse labs
^ permalink raw reply
* [PATCH v2 RESEND] dt-bindings: serial: snps-dw-apb-uart: Add RV1103B compatible
From: Fabio Estevam @ 2026-03-10 0:06 UTC (permalink / raw)
To: gregkh
Cc: robh, krzk+dt, conor+dt, linux-kernel, linux-serial, devicetree,
heiko, Fabio Estevam, Krzysztof Kozlowski
From: Fabio Estevam <festevam@nabladev.com>
The RV1103B UART is compatible with the existing DesignWare APB UART
binding. Add the rockchip,rv1103b-uart compatible string.
Signed-off-by: Fabio Estevam <festevam@nabladev.com>
Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
---
Changes since v1:
- Make commit log more concise.
Documentation/devicetree/bindings/serial/snps-dw-apb-uart.yaml | 1 +
1 file changed, 1 insertion(+)
diff --git a/Documentation/devicetree/bindings/serial/snps-dw-apb-uart.yaml b/Documentation/devicetree/bindings/serial/snps-dw-apb-uart.yaml
index 6efe43089a74..685c1eceb782 100644
--- a/Documentation/devicetree/bindings/serial/snps-dw-apb-uart.yaml
+++ b/Documentation/devicetree/bindings/serial/snps-dw-apb-uart.yaml
@@ -71,6 +71,7 @@ properties:
- rockchip,rk3568-uart
- rockchip,rk3576-uart
- rockchip,rk3588-uart
+ - rockchip,rv1103b-uart
- rockchip,rv1108-uart
- rockchip,rv1126-uart
- sophgo,sg2044-uart
--
2.34.1
^ permalink raw reply related
* [PATCH v2] serial: 8250: Fix null ptr deref has_acpi_companion
From: Filip Jensen @ 2026-03-09 14:28 UTC (permalink / raw)
To: gregkh, jirislaby, ilpo.jarvinen
Cc: linux-kernel, linux-serial, Filip Jensen,
Jose Javier Rodriguez Barbarin
uart->port.dev will have a value in serial8250_register_8250_port if the
port number is under the initial CONFIG_SERIAL_8250_RUNTIME_UARTS. If
unset, it will depend upon up->port.dev being set by the particular serial
driver. A faulty driver might not set this value and this leads to null
pointer dereferenced later in has_acpi_companion and later at
uart_add_one_port call:
Oops: general protection fault, probably for non-canonical address
KASAN: null-ptr-deref in range
RIP: 0010:serial8250_register_8250_port+0xd34/0x2030
drivers/tty/serial/8250/8250_core.c
Reviewed-by: Jose Javier Rodriguez Barbarin <dev-josejavier.rodriguez@duagon.com>
Signed-off-by: Filip Jensen <dev-Felipe.Jensen@duagon.com>
---
Thank you very much for the revision, Jiri. As suggested, I have removed
people from the recipients list that have not made relevant changes related
to this patch recently.
V1 -> V2: Fixed that the return value was not setting an error value.
Rewriten the subject to make clear that this is a fix to a posible null
pointer deref and slightly rewriten the description for the changelog.
V1: https://lore.kernel.org/linux-serial/20260305163358.42599-1-dev-Felipe.Jensen@duagon.com/
For a case of a low level driver not setting this, cf.
Link: https://lore.kernel.org/linux-serial/20260305162815.41818-1-dev-Felipe.Jensen@duagon.com/
drivers/tty/serial/8250/8250_core.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/tty/serial/8250/8250_core.c b/drivers/tty/serial/8250/8250_core.c
index d2e2c5dfef99..d758f871fbbd 100644
--- a/drivers/tty/serial/8250/8250_core.c
+++ b/drivers/tty/serial/8250/8250_core.c
@@ -756,6 +756,8 @@ int serial8250_register_8250_port(const struct uart_8250_port *up)
if (ret)
goto err;
}
+ if (!uart->port.dev)
+ return -EINVAL;
if (up->port.flags & UPF_FIXED_TYPE)
uart->port.type = up->port.type;
--
2.34.1
^ permalink raw reply related
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox