Returning true from handle_rx_dma() without flushing DMA first creates
a data ordering hazard. If DMA Rx has handled any character at the
point when RLSI occurs, the non-DMA path handles any pending characters
jumping them ahead of those characters that are pending under DMA.

Fixes: 75df022b5f89 ("serial: 8250_dma: Fix RX handling")
Cc: <stable@vger.kernel.org>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
---
Cc: Gilles BULOZ <gilles.buloz@kontron.com>

 drivers/tty/serial/8250/8250_port.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c
index 92dd18716169..388172289627 100644
--- a/drivers/tty/serial/8250/8250_port.c
+++ b/drivers/tty/serial/8250/8250_port.c
@@ -1901,10 +1901,9 @@ static bool handle_rx_dma(struct uart_8250_port *up, unsigned int iir)
 		if (!up->dma->rx_running)
 			break;
 		fallthrough;
+	case UART_IIR_RLSI:
 	case UART_IIR_RX_TIMEOUT:
 		serial8250_rx_dma_flush(up);
-		fallthrough;
-	case UART_IIR_RLSI:
 		return true;
 	}
 	return up->dma->rx_dma(up);
-- 
2.30.2

On Mon, Nov 07, 2022 at 01:07:08PM +0200, Ilpo Järvinen wrote:
> Returning true from handle_rx_dma() without flushing DMA first creates
> a data ordering hazard. If DMA Rx has handled any character at the
> point when RLSI occurs, the non-DMA path handles any pending characters
> jumping them ahead of those characters that are pending under DMA.
> 
> Fixes: 75df022b5f89 ("serial: 8250_dma: Fix RX handling")
> Cc: <stable@vger.kernel.org>
> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
> ---
> Cc: Gilles BULOZ <gilles.buloz@kontron.com>

Maybe instead you can do --cc Guilles ... for entire series (and drop from
other commit messages)?

-- 
With Best Regards,
Andy Shevchenko