Re: [PATCH v2 1/2] serial: tegra: fix RX DMA descriptor use-after-free

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] tty: serial: tegra: DMA tasklets race with termination causing corruption
--

commit 829540ff4c493e2669ac25a22f37fd2da4f2c018
Author: Austin Schlegel <schlegelas@outlook.com>

serial: tegra: fix RX DMA descriptor use-after-free

This commit fixes a use-after-free by moving the async_tx_ack() call to
tegra_uart_rx_dma_complete() and tegra_uart_terminate_rx_dma() before the
descriptors are freed. It removes the ack from tegra_uart_rx_buffer_push()
where the descriptor is no longer safe to access.

Link: https://lore.kernel.org/all/20261001-tty-linus-v1-1-ecb8576c802d@arthrex.com/

> --- a/drivers/tty/serial/serial-tegra.c
> +++ b/drivers/tty/serial/serial-tegra.c

[ ... ]

> @@ -761,6 +760,7 @@ static void tegra_uart_rx_dma_complete(void *args)
>  		set_rts(tup, false);
>  
>  	tup->rx_dma_active = false;
> +	async_tx_ack(tup->rx_dma_desc);
>  	tegra_uart_rx_buffer_push(tup, 0);
>  	tegra_uart_start_rx_dma(tup);
>  

[Severity: High]
Can this callback race with concurrent DMA termination?

If tegra_uart_stop_rx() or tegra_uart_terminate_rx_dma() is called
concurrently (for instance, when userspace calls tcsetattr() or closes
the port while data is transferring), CPU 0 might terminate the DMA,
acknowledge the descriptor, and update the state. Meanwhile, CPU 1's DMA
completion tasklet could be spinning on the uart_port_lock.

Once CPU 1 acquires the lock, it appears to unconditionally execute this
block without checking if the channel was already intentionally terminated
(e.g., by checking if tup->rx_dma_active is still true). Could this
redundantly push buffers, erroneously access the potentially freed
descriptor via async_tx_ack(), and incorrectly restart the DMA?

Additionally, does a similar race condition exist in the TX path? In
tegra_uart_tx_dma_complete(), the callback accesses the descriptor outside
the lock and unconditionally advances the TX ring, which seems like it could
race destructively with tegra_uart_stop_tx().

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261014-serial-tegra-dma-uaf-v2-0-b142b31b67e3@outlook.com?part=1