[PATCH v3] rust: serdev: Mitigate race conditions

[PATCH v3] rust: serdev: Mitigate race conditions

[Markus Probst]

There are currently 2 race conditions:
- in probe if `Driver::probe` returns Err
- in unbind
. In those cases the driver data will be set to NULL before the serdev
device was closed. If data is received while the driver data is dropped,
the `receive_buf_callback` might try to access the `active` mutex on a
null pointer. The race conditions can only occur if `Driver::receive` is
implemented.

The issue cannot be cleanly fixed without rewriting some logic, which
might introduce new regressions.

Temporarily disable the use of `Driver::receive`, until fixed in the
next release.

Fixes: 99f59aa82341 ("rust: add basic serial device bus abstractions")
Reported-by: Sashiko Bot <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/linux-serial/20260905000836.C8FC91F00A3D@smtp.kernel.org/
Closes: https://lore.kernel.org/linux-serial/20260903222159.70A911F000E9@smtp.kernel.org/
Signed-off-by: Markus Probst <markus.probst@posteo.de>
---
I will submit a patch (for the next merge cycle) soon, which will
address this issue and make the probe and unbind code less convoluted.
---
Changes in v3:
- mitigate it
- Link to v2: https://patch.msgid.link/20260905-rust_serdev_fix-v2-0-35dfcd06ef2e@posteo.de

Changes in v2:
- also fix race condition on unbind
- Link to v1: https://patch.msgid.link/20260905-rust_serdev_fix-v1-1-2ea92b154a6b@posteo.de
---
 rust/kernel/serdev.rs              | 7 ++++++-
 samples/rust/rust_driver_serdev.rs | 6 +++---
 2 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/rust/kernel/serdev.rs b/rust/kernel/serdev.rs
index 17ca504b7f8d..63b489404558 100644
--- a/rust/kernel/serdev.rs
+++ b/rust/kernel/serdev.rs
@@ -148,10 +148,14 @@ fn drop(self: Pin<&mut Self>) {
 
 impl<T: Driver> Adapter<T> {
     const OPS: &'static bindings::serdev_device_ops = &bindings::serdev_device_ops {
-        receive_buf: if T::HAS_RECEIVE {
+        /* receive_buf: if T::HAS_RECEIVE {
             Some(Self::receive_buf_callback)
         } else {
             None
+        }, */
+        receive_buf: {
+            const_assert!(!T::HAS_RECEIVE);
+            None
         },
         write_wakeup: Some(bindings::serdev_device_write_wakeup),
     };
@@ -233,6 +237,7 @@ extern "C" fn remove_callback(sdev: *mut bindings::serdev_device) {
         T::unbind(sdev, data_pinned);
     }
 
+    #[expect(dead_code)]
     extern "C" fn receive_buf_callback(
         sdev: *mut bindings::serdev_device,
         buf: *const u8,
diff --git a/samples/rust/rust_driver_serdev.rs b/samples/rust/rust_driver_serdev.rs
index 51b4898cd855..863db75d3b5a 100644
--- a/samples/rust/rust_driver_serdev.rs
+++ b/samples/rust/rust_driver_serdev.rs
@@ -5,7 +5,7 @@
 use kernel::{
     acpi,
     device::{
-        Bound,
+        // Bound,
         Core, //
     },
     of,
@@ -61,13 +61,13 @@ fn probe<'bound>(
         Ok(Self { sdev: sdev.into() })
     }
 
-    fn receive<'bound>(
+    /*fn receive<'bound>(
         sdev: &'bound serdev::Device<Bound>,
         _this: Pin<&Self>,
         data: &[u8],
     ) -> usize {
         sdev.write(data).unwrap_or_default() as usize
-    }
+    }*/
 }
 
 impl Drop for SampleDriver {

---
base-commit: e5e04726cdd043e309677071ab1b65a4b18f422b
change-id: 20260904-rust_serdev_fix-be3ff9c8a5e8

Re: [PATCH v3] rust: serdev: Mitigate race conditions

[Miguel Ojeda]

On Sat, Sep 5, 2026 at 8:33 PM Markus Probst <markus.probst@posteo.de> wrote:
>
> +        /* receive_buf: if T::HAS_RECEIVE {
>              Some(Self::receive_buf_callback)
>          } else {
>              None
> +        }, */

> +        // Bound,

> +    /*fn receive<'bound>(
>          sdev: &'bound serdev::Device<Bound>,
>          _this: Pin<&Self>,
>          data: &[u8],
>      ) -> usize {
>          sdev.write(data).unwrap_or_default() as usize
> -    }
> +    }*/

Please don't comment code out -- it is fine to just remove it even if
it is a temporary measure. The code will still be there in Git.

Thanks!

Cheers,
Miguel