[PATCH] serial: 8250_mid: lock RX DMA timeout flushing

[PATCH] serial: 8250_mid: lock RX DMA timeout flushing

[James Hilliard]

The Tangier and Denverton DMA timeout handlers call
serial8250_rx_dma_flush() without holding the UART port lock. The helper
pauses the transfer, copies received data, updates RX state and terminates
the channel. The DMA completion callback accesses the same state under the
port lock, so it can race an unlocked timeout flush. The IRQ-chain lock
held by serial8250_interrupt() does not serialize the completion callback.

Take the port lock around each timeout flush. Release it before handling
the UART interrupt, since serial8250_handle_irq() acquires the port lock
itself.

Fixes: 692aa1905679 ("serial: 8250_mid: Read RX buffer on RX DMA timeout for DNV")
Fixes: 4831e0d9054c ("serial: 8250_mid: handle interrupt correctly in DMA case")
Cc: stable@vger.kernel.org
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
---
Previously included in the DMA cancellation series v4:
https://lore.kernel.org/r/20261023-submit-serial-8250-dma-cancel-v1-v4-0-e759de1839de@gmail.com
---
 drivers/tty/serial/8250/8250_mid.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/tty/serial/8250/8250_mid.c b/drivers/tty/serial/8250/8250_mid.c
index 44b43163df51..83f928b1f643 100644
--- a/drivers/tty/serial/8250/8250_mid.c
+++ b/drivers/tty/serial/8250/8250_mid.c
@@ -94,7 +94,8 @@ static int tng_handle_irq(struct uart_port *p)
 	/* Rx DMA */
 	err = hsu_dma_get_status(chip, mid->dma_index * 2 + 1, &status);
 	if (err > 0) {
-		serial8250_rx_dma_flush(up);
+		scoped_guard(uart_port_lock_irqsave, p)
+			serial8250_rx_dma_flush(up);
 		ret |= 1;
 	} else if (err == 0)
 		ret |= hsu_dma_do_irq(chip, mid->dma_index * 2 + 1, status);
@@ -148,7 +149,8 @@ static int dnv_handle_irq(struct uart_port *p)
 	if (fisr & BIT(2)) {
 		err = hsu_dma_get_status(&mid->dma_chip, 1, &status);
 		if (err > 0) {
-			serial8250_rx_dma_flush(up);
+			scoped_guard(uart_port_lock_irqsave, p)
+				serial8250_rx_dma_flush(up);
 			ret |= 1;
 		} else if (err == 0)
 			ret |= hsu_dma_do_irq(&mid->dma_chip, 1, status);

---
base-commit: 1184f87e2790e8af9be3116f608d2e86b4792d7d
change-id: 20261024-submit-serial-8250-mid-rx-lock-v1-21c66e80df80

Best regards,
--  
James Hilliard <james.hilliard1@gmail.com>

Re: [PATCH] serial: 8250_mid: lock RX DMA timeout flushing

[sashiko-bot]

> The Tangier and Denverton DMA timeout handlers call
> serial8250_rx_dma_flush() without holding the UART port lock. The helper
> pauses the transfer, copies received data, updates RX state and terminates
> the channel. The DMA completion callback accesses the same state under the
> port lock, so it can race an unlocked timeout flush. The IRQ-chain lock
> held by serial8250_interrupt() does not serialize the completion callback.
> 
> Take the port lock around each timeout flush. Release it before handling
> the UART interrupt, since serial8250_handle_irq() acquires the port lock
> itself.
> 
> Fixes: 692aa1905679 ("serial: 8250_mid: Read RX buffer on RX DMA timeout for DNV")
> Fixes: 4831e0d9054c ("serial: 8250_mid: handle interrupt correctly in DMA case")
> Cc: stable@vger.kernel.org
> Signed-off-by: James Hilliard <james.hilliard1@gmail.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261024-submit-serial-8250-mid-rx-lock-v1-v1-1-2b9afdf869d7@gmail.com?part=1