The LPC32xx UART can latch an RX character-timeout interrupt while the
RX FIFO is empty: IIR reports UART_IIR_RX_TIMEOUT (0x0c) but LSR.DR is
clear. A character timeout is only cleared by reading RHR, but
serial8250_rx_chars() reads RHR only when LSR.DR is set, so nothing ever
clears the condition. The interrupt is level-triggered and re-fires
immediately, so on a single-core ARM926 the resulting interrupt
storm livelocks the CPU.

It is reproducible when userspace repeatedly opens the front-panel port
(ttyS1): serial8250_do_set_termios() re-enables interrupts on unlock and
the handler then spins forever with iir=0xcc lsr=0x60 ier=0x05, tripping
the soft-lockup detector in serial8250_handle_irq_locked().

Fix this by doing one throwaway RHR read to clear the timeout. It is gated
on PORT_LPC3220 and only fires when the FIFO is empty (LSR.DR clear), so
no real received data is ever discarded, and it is a no-op on healthy
UARTs which never report a timeout with DR==0.

This is the same class of bug already worked around for other 8250 cores;
see commit 424d79183af0 ("serial: 8250_dw: Avoid "too much work" from bogus rx timeout interrupt")
which reports the identical iir=0xcc/lsr=0x60. See also
UART_RX_TIMEOUT_QUIRK in 8250_omap, and the note in 8250_bcm7271.

Cc: stable@vger.kernel.org
Signed-off-by: Ryan Wilbur <rwilbur633@gmail.com>
---
 drivers/tty/serial/8250/8250_port.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c
index 8c241ec7f4f2..20014f54637b 100644
--- a/drivers/tty/serial/8250/8250_port.c
+++ b/drivers/tty/serial/8250/8250_port.c
@@ -1803,6 +1803,20 @@ void serial8250_handle_irq_locked(struct uart_port *port, unsigned int iir)
 	if (!(status & UART_LSR_DR) && (status & UART_LSR_FIFOE))
 		serial8250_clear_and_reinit_fifos(up);
 
+	/*
+	 * On PORT_LPC3220 the UART can raise an RX character-timeout
+	 * interrupt with an empty RX FIFO (IIR reports RX_TIMEOUT but
+	 * LSR.DR is clear). The timeout is only cleared by reading RHR,
+	 * but the RX path below is skipped when the FIFO is empty, so
+	 * nothing clears it. IRQ then re-fires immediately and livelocks
+	 * this single-core. Do one throwaway RHR read to clear it.
+	 * Same bug worked around for other 8250 cores (8250_dw, 8250_omap, 8250_bcm7271).
+	 */
+	if (port->type == PORT_LPC3220 &&
+	    (iir & UART_IIR_RX_TIMEOUT) == UART_IIR_RX_TIMEOUT &&
+	    !(status & UART_LSR_DR))
+		serial_in(up, UART_RX);
+
 	/*
 	 * If port is stopped and there are no error conditions in the
 	 * FIFO, then don't drain the FIFO, as this may lead to TTY buffer

base-commit: da7b5fd4e17f8e44c5590f2d603c01d499f056e6
-- 
2.25.1

On Fri, Jul 17, 2026 at 09:35:30AM -0300, Ryan Wilbur wrote:
> The LPC32xx UART can latch an RX character-timeout interrupt while the
> RX FIFO is empty: IIR reports UART_IIR_RX_TIMEOUT (0x0c) but LSR.DR is
> clear. A character timeout is only cleared by reading RHR, but
> serial8250_rx_chars() reads RHR only when LSR.DR is set, so nothing ever
> clears the condition. The interrupt is level-triggered and re-fires
> immediately, so on a single-core ARM926 the resulting interrupt
> storm livelocks the CPU.
> 
> It is reproducible when userspace repeatedly opens the front-panel port
> (ttyS1): serial8250_do_set_termios() re-enables interrupts on unlock and
> the handler then spins forever with iir=0xcc lsr=0x60 ier=0x05, tripping
> the soft-lockup detector in serial8250_handle_irq_locked().
> 
> Fix this by doing one throwaway RHR read to clear the timeout. It is gated
> on PORT_LPC3220 and only fires when the FIFO is empty (LSR.DR clear), so
> no real received data is ever discarded, and it is a no-op on healthy
> UARTs which never report a timeout with DR==0.
> 
> This is the same class of bug already worked around for other 8250 cores;
> see commit 424d79183af0 ("serial: 8250_dw: Avoid "too much work" from bogus rx timeout interrupt")
> which reports the identical iir=0xcc/lsr=0x60. See also
> UART_RX_TIMEOUT_QUIRK in 8250_omap, and the note in 8250_bcm7271.

...

> +	/*
> +	 * On PORT_LPC3220 the UART can raise an RX character-timeout
> +	 * interrupt with an empty RX FIFO (IIR reports RX_TIMEOUT but
> +	 * LSR.DR is clear). The timeout is only cleared by reading RHR,
> +	 * but the RX path below is skipped when the FIFO is empty, so
> +	 * nothing clears it. IRQ then re-fires immediately and livelocks
> +	 * this single-core. Do one throwaway RHR read to clear it.

> +	 * Same bug worked around for other 8250 cores (8250_dw, 8250_omap, 8250_bcm7271).

This is 8250-port.c.

> +	 */
> +	if (port->type == PORT_LPC3220 &&

Why do we have this then?

> +	    (iir & UART_IIR_RX_TIMEOUT) == UART_IIR_RX_TIMEOUT &&
> +	    !(status & UART_LSR_DR))
> +		serial_in(up, UART_RX);

-- 
With Best Regards,
Andy Shevchenko

On Fri, Jul 17, 2026 at 20:54:02 +0300, Andy Shevchenko wrote:
> > +      * Same bug worked around for other 8250 cores (8250_dw, 8250_omap, 8250_bcm7271).
>
> This is 8250-port.c.
>
> > +   if (port->type == PORT_LPC3220 &&
>
> Why do we have this then?

dw/omap/bcm7271 handle their variants of this in their
own drivers. LPC32xx (PORT_LPC3220) has no dedicated 8250 glue driver.
  
I gated it on port->type because LPC32xx is the only hardware I can test
on, and I wanted to avoid changing behaviour on 8250 variants I can't
verify. That said, the read only fires on a bogus IIR=RX_TIMEOUT with LSR.DR
clear, which a healthy 16550 never reports, so it's harmless on other
parts. Unless you object, I'll drop the PORT_LPC3220 gate to allow for generic
handling.