[PATCH v2] tty: serial: lpuart: Add port lock for registers read in lpuart32_set_termios()

[PATCH v2] tty: serial: lpuart: Add port lock for registers read in lpuart32_set_termios()

[Sherry Sun (OSS)]

From: Sherry Sun <sherry.sun@nxp.com>

lpuart32_set_termios() reads UARTCTRL at function entry without holding
the port lock. lpuart32_console_write() can run concurrently on another
CPU and temporarily clears the RIE (Receiver Interrupt Enable) bit while
it polls characters out. If the unlocked read in set_termios lands inside
that window, the stale snapshot is written back, permanently clearing
RIE. Once lost, no normal code path re-enables them, so the UART stops
receiving characters and becomes unresponsive.

Need to add port lock for the registers read in lpuart32_set_termios() to
avoid the unlocked snapshot captured. Since neither uart_get_baud_rate()
nor lpuart_dma_rx_free() uses ctrl, old_ctrl, bd, or modem, the register
reads and bit manipulations could be moved into the existing
uart_port_lock_irqsave() critical section after lpuart_dma_rx_free().

Please note that this only fix the normal printk path, in the
oops_in_progress path of lpuart32_console_write(), when trylock fails,
RIE is cleared and old_cr restored without the port lock held, there is
still a risk of stale snapshot, but it's acceptable for the post-oops
state and the trylock-fail window.

Fixes: 380c966c093e ("tty: serial: fsl_lpuart: add 32-bit register interface support")
Signed-off-by: Sherry Sun <sherry.sun@nxp.com>
---
Changes in v2:
- As suggested by Sashiko, since neither uart_get_baud_rate() nor
  lpuart_dma_rx_free() uses ctrl, old_ctrl, bd, or modem, move the
  register reads and bit manipulations into the existing
  uart_port_lock_irqsave() critical section after lpuart_dma_rx_free().
- Link to v1: https://lore.kernel.org/r/20261111-lpuart_port_lock-v1-1-5d332c51edfe@nxp.com
---
 drivers/tty/serial/fsl_lpuart.c | 29 ++++++++++++++---------------
 1 file changed, 14 insertions(+), 15 deletions(-)

diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
index cd2575a3aef7..074bd9d42f84 100644
--- a/drivers/tty/serial/fsl_lpuart.c
+++ b/drivers/tty/serial/fsl_lpuart.c
@@ -2241,6 +2241,20 @@ lpuart32_set_termios(struct uart_port *port, struct ktermios *termios,
 	unsigned int  baud;
 	unsigned int old_csize = old ? old->c_cflag & CSIZE : CS8;
 
+	/* ask the core to calculate the divisor */
+	baud = uart_get_baud_rate(port, termios, old, 50, port->uartclk / 4);
+
+	/*
+	 * Need to update the Ring buffer length according to the selected
+	 * baud rate and restart Rx DMA path.
+	 *
+	 * Since timer function acqures port->lock, need to stop before
+	 * acquring same lock because otherwise timer_delete_sync() can deadlock.
+	 */
+	if (old && sport->lpuart_dma_rx_use)
+		lpuart_dma_rx_free(port);
+
+	uart_port_lock_irqsave(port, &flags);
 	ctrl = old_ctrl = lpuart32_read(port, UARTCTRL);
 	bd = lpuart32_read(port, UARTBAUD);
 	modem = lpuart32_read(port, UARTMODIR);
@@ -2320,21 +2334,6 @@ lpuart32_set_termios(struct uart_port *port, struct ktermios *termios,
 		ctrl &= ~UARTCTRL_PE;
 	}
 
-	/* ask the core to calculate the divisor */
-	baud = uart_get_baud_rate(port, termios, old, 50, port->uartclk / 4);
-
-	/*
-	 * Need to update the Ring buffer length according to the selected
-	 * baud rate and restart Rx DMA path.
-	 *
-	 * Since timer function acqures port->lock, need to stop before
-	 * acquring same lock because otherwise timer_delete_sync() can deadlock.
-	 */
-	if (old && sport->lpuart_dma_rx_use)
-		lpuart_dma_rx_free(port);
-
-	uart_port_lock_irqsave(port, &flags);
-
 	port->read_status_mask = 0;
 	if (termios->c_iflag & INPCK)
 		port->read_status_mask |= UARTSTAT_FE | UARTSTAT_PE;

---
base-commit: 793807ca13bf3072fc6d16ce6d90e9ab9beff2a5
change-id: 20261111-lpuart_port_lock-01f7deab451a

Best regards,
-- 
Sherry Sun <sherry.sun@nxp.com>

Re: [PATCH v2] tty: serial: lpuart: Add port lock for registers read in lpuart32_set_termios()

[sashiko-bot]

> From: Sherry Sun <sherry.sun@nxp.com>
> 
> lpuart32_set_termios() reads UARTCTRL at function entry without holding
> the port lock. lpuart32_console_write() can run concurrently on another
> CPU and temporarily clears the RIE (Receiver Interrupt Enable) bit while
> it polls characters out. If the unlocked read in set_termios lands inside
> that window, the stale snapshot is written back, permanently clearing
> RIE. Once lost, no normal code path re-enables them, so the UART stops
> receiving characters and becomes unresponsive.
> 
> Need to add port lock for the registers read in lpuart32_set_termios() to
> avoid the unlocked snapshot captured. Since neither uart_get_baud_rate()
> nor lpuart_dma_rx_free() uses ctrl, old_ctrl, bd, or modem, the register
> reads and bit manipulations could be moved into the existing
> uart_port_lock_irqsave() critical section after lpuart_dma_rx_free().
> 
> Please note that this only fix the normal printk path, in the
> oops_in_progress path of lpuart32_console_write(), when trylock fails,
> RIE is cleared and old_cr restored without the port lock held, there is
> still a risk of stale snapshot, but it's acceptable for the post-oops
> state and the trylock-fail window.
> 
> Fixes: 380c966c093e ("tty: serial: fsl_lpuart: add 32-bit register interface support")
> Signed-off-by: Sherry Sun <sherry.sun@nxp.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261112-lpuart_port_lock-v2-1-e1d914e52660@nxp.com?part=1

Re: [PATCH v2] tty: serial: lpuart: Add port lock for registers read in lpuart32_set_termios()

[Daniel Baluta]

On 11/12/26 05:19, Sherry Sun (OSS) wrote:
> From: Sherry Sun <sherry.sun@nxp.com>
> 
> lpuart32_set_termios() reads UARTCTRL at function entry without holding
> the port lock. lpuart32_console_write() can run concurrently on another
> CPU and temporarily clears the RIE (Receiver Interrupt Enable) bit while
> it polls characters out. If the unlocked read in set_termios lands inside
> that window, the stale snapshot is written back, permanently clearing
> RIE. Once lost, no normal code path re-enables them, so the UART stops
> receiving characters and becomes unresponsive.
> 
> Need to add port lock for the registers read in lpuart32_set_termios() to
> avoid the unlocked snapshot captured. Since neither uart_get_baud_rate()
> nor lpuart_dma_rx_free() uses ctrl, old_ctrl, bd, or modem, the register
> reads and bit manipulations could be moved into the existing
> uart_port_lock_irqsave() critical section after lpuart_dma_rx_free().
> 
> Please note that this only fix the normal printk path, in the
> oops_in_progress path of lpuart32_console_write(), when trylock fails,
> RIE is cleared and old_cr restored without the port lock held, there is
> still a risk of stale snapshot, but it's acceptable for the post-oops
> state and the trylock-fail window.
> 
> Fixes: 380c966c093e ("tty: serial: fsl_lpuart: add 32-bit register interface support")
> Signed-off-by: Sherry Sun <sherry.sun@nxp.com>
> ---
> Changes in v2:
> - As suggested by Sashiko, since neither uart_get_baud_rate() nor
>   lpuart_dma_rx_free() uses ctrl, old_ctrl, bd, or modem, move the
>   register reads and bit manipulations into the existing
>   uart_port_lock_irqsave() critical section after lpuart_dma_rx_free().
> - Link to v1: https://lore.kernel.org/r/20261111-lpuart_port_lock-v1-1-5d332c51edfe@nxp.com
> ---
>  drivers/tty/serial/fsl_lpuart.c | 29 ++++++++++++++---------------
>  1 file changed, 14 insertions(+), 15 deletions(-)
> 
> diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
> index cd2575a3aef7..074bd9d42f84 100644
> --- a/drivers/tty/serial/fsl_lpuart.c
> +++ b/drivers/tty/serial/fsl_lpuart.c
> @@ -2241,6 +2241,20 @@ lpuart32_set_termios(struct uart_port *port, struct ktermios *termios,
>  	unsigned int  baud;
>  	unsigned int old_csize = old ? old->c_cflag & CSIZE : CS8;
>  
> +	/* ask the core to calculate the divisor */
> +	baud = uart_get_baud_rate(port, termios, old, 50, port->uartclk / 4);
> +
> +	/*
> +	 * Need to update the Ring buffer length according to the selected
> +	 * baud rate and restart Rx DMA path.

While you are here please fix the typo. s/acqures/acquires.> +	 *
> +	 * Since timer function acqures port->lock, need to stop before
> +	 * acquring same lock because otherwise timer_delete_sync() can deadlock.
> +	 */
> +	if (old && sport->lpuart_dma_rx_use)
> +		lpuart_dma_rx_free(port);
> +
> +	uart_port_lock_irqsave(port, &flags);
>  	ctrl = old_ctrl = lpuart32_read(port, UARTCTRL);
>  	bd = lpuart32_read(port, UARTBAUD);
>  	modem = lpuart32_read(port, UARTMODIR);
> @@ -2320,21 +2334,6 @@ lpuart32_set_termios(struct uart_port *port, struct ktermios *termios,
>  		ctrl &= ~UARTCTRL_PE;
>  	}
>  
> -	/* ask the core to calculate the divisor */
> -	baud = uart_get_baud_rate(port, termios, old, 50, port->uartclk / 4);
> -
> -	/*
> -	 * Need to update the Ring buffer length according to the selected
> -	 * baud rate and restart Rx DMA path.
> -	 *
> -	 * Since timer function acqures port->lock, need to stop before
> -	 * acquring same lock because otherwise timer_delete_sync() can deadlock.
> -	 */
> -	if (old && sport->lpuart_dma_rx_use)
> -		lpuart_dma_rx_free(port);
> -
> -	uart_port_lock_irqsave(port, &flags);
> -
>  	port->read_status_mask = 0;
>  	if (termios->c_iflag & INPCK)
>  		port->read_status_mask |= UARTSTAT_FE | UARTSTAT_PE;
> 
> ---
> base-commit: 793807ca13bf3072fc6d16ce6d90e9ab9beff2a5
> change-id: 20261111-lpuart_port_lock-01f7deab451a
> 
> Best regards,

RE: [PATCH v2] tty: serial: lpuart: Add port lock for registers read in lpuart32_set_termios()

[Sherry Sun]

> 
> On 11/12/26 05:19, Sherry Sun (OSS) wrote:
> > From: Sherry Sun <sherry.sun@nxp.com>
> >
> > lpuart32_set_termios() reads UARTCTRL at function entry without
> > holding the port lock. lpuart32_console_write() can run concurrently
> > on another CPU and temporarily clears the RIE (Receiver Interrupt
> > Enable) bit while it polls characters out. If the unlocked read in
> > set_termios lands inside that window, the stale snapshot is written
> > back, permanently clearing RIE. Once lost, no normal code path
> > re-enables them, so the UART stops receiving characters and becomes
> unresponsive.
> >
> > Need to add port lock for the registers read in lpuart32_set_termios()
> > to avoid the unlocked snapshot captured. Since neither
> > uart_get_baud_rate() nor lpuart_dma_rx_free() uses ctrl, old_ctrl, bd,
> > or modem, the register reads and bit manipulations could be moved into
> > the existing
> > uart_port_lock_irqsave() critical section after lpuart_dma_rx_free().
> >
> > Please note that this only fix the normal printk path, in the
> > oops_in_progress path of lpuart32_console_write(), when trylock fails,
> > RIE is cleared and old_cr restored without the port lock held, there
> > is still a risk of stale snapshot, but it's acceptable for the
> > post-oops state and the trylock-fail window.
> >
> > Fixes: 380c966c093e ("tty: serial: fsl_lpuart: add 32-bit register
> > interface support")
> > Signed-off-by: Sherry Sun <sherry.sun@nxp.com>
> > ---
> > Changes in v2:
> > - As suggested by Sashiko, since neither uart_get_baud_rate() nor
> >   lpuart_dma_rx_free() uses ctrl, old_ctrl, bd, or modem, move the
> >   register reads and bit manipulations into the existing
> >   uart_port_lock_irqsave() critical section after lpuart_dma_rx_free().
> > - Link to v1:
> > https://lore.kernel.org/r/20261111-lpuart_port_lock-v1-1-5d332c51edfe@
> > nxp.com
> > ---
> >  drivers/tty/serial/fsl_lpuart.c | 29 ++++++++++++++---------------
> >  1 file changed, 14 insertions(+), 15 deletions(-)
> >
> > diff --git a/drivers/tty/serial/fsl_lpuart.c
> > b/drivers/tty/serial/fsl_lpuart.c index cd2575a3aef7..074bd9d42f84
> > 100644
> > --- a/drivers/tty/serial/fsl_lpuart.c
> > +++ b/drivers/tty/serial/fsl_lpuart.c
> > @@ -2241,6 +2241,20 @@ lpuart32_set_termios(struct uart_port *port,
> struct ktermios *termios,
> >  	unsigned int  baud;
> >  	unsigned int old_csize = old ? old->c_cflag & CSIZE : CS8;
> >
> > +	/* ask the core to calculate the divisor */
> > +	baud = uart_get_baud_rate(port, termios, old, 50, port->uartclk /
> > +4);
> > +
> > +	/*
> > +	 * Need to update the Ring buffer length according to the selected
> > +	 * baud rate and restart Rx DMA path.
> 
> While you are here please fix the typo. s/acqures/acquires.> +	 *

Ok, will fix in V3.

Best Regards
Sherry

> > +	 * Since timer function acqures port->lock, need to stop before
> > +	 * acquring same lock because otherwise timer_delete_sync() can
> deadlock.
> > +	 */
> > +	if (old && sport->lpuart_dma_rx_use)
> > +		lpuart_dma_rx_free(port);
> > +
> > +	uart_port_lock_irqsave(port, &flags);
> >  	ctrl = old_ctrl = lpuart32_read(port, UARTCTRL);
> >  	bd = lpuart32_read(port, UARTBAUD);
> >  	modem = lpuart32_read(port, UARTMODIR); @@ -2320,21 +2334,6
> @@
> > lpuart32_set_termios(struct uart_port *port, struct ktermios *termios,
> >  		ctrl &= ~UARTCTRL_PE;
> >  	}
> >
> > -	/* ask the core to calculate the divisor */
> > -	baud = uart_get_baud_rate(port, termios, old, 50, port->uartclk / 4);
> > -
> > -	/*
> > -	 * Need to update the Ring buffer length according to the selected
> > -	 * baud rate and restart Rx DMA path.
> > -	 *
> > -	 * Since timer function acqures port->lock, need to stop before
> > -	 * acquring same lock because otherwise timer_delete_sync() can
> deadlock.
> > -	 */
> > -	if (old && sport->lpuart_dma_rx_use)
> > -		lpuart_dma_rx_free(port);
> > -
> > -	uart_port_lock_irqsave(port, &flags);
> > -
> >  	port->read_status_mask = 0;
> >  	if (termios->c_iflag & INPCK)
> >  		port->read_status_mask |= UARTSTAT_FE | UARTSTAT_PE;
> >
> > ---
> > base-commit: 793807ca13bf3072fc6d16ce6d90e9ab9beff2a5
> > change-id: 20261111-lpuart_port_lock-01f7deab451a
> >
> > Best regards,