Re: [PATCH v3 2/3] serial: tegra: fix TX DMA descriptor use-after-free

[sashiko-bot@kernel.org]

> From: Austin Schlegel <schlegelas@outlook.com>
> 
> tegra_uart_stop_tx() calls dmaengine_terminate_all() and then
> async_tx_ack(tup->tx_dma_desc) on the descriptor that was just
> terminated. With the GPC DMA driver, dmaengine_terminate_all() frees
> the active descriptor immediately, so the ack call that follows
> touches freed memory.
> 
> This is the same use-after-free pattern fixed for the RX path in
> tegra_uart_terminate_rx_dma() ("serial: tegra: fix RX DMA descriptor
> use-after-free"). dmaengine clients must not touch a descriptor once
> dmaengine_terminate_all() has returned.
> 
> Move the ack before dmaengine_terminate_all(), while the descriptor
> is still valid.
> [ ... ]
> Fixes: e9ea096dd225 ("serial: tegra: add serial driver")
> Cc: stable@vger.kernel.org
> Link: https://lore.kernel.org/all/sashiko-outbox-172211@kernel.org/
> Assisted-by: LLM
> Signed-off-by: Austin Schlegel <schlegelas@outlook.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261022-serial-tegra-dma-uaf-v3-0-129f6d67f673@outlook.com?part=2