From nobody Fri Oct 2 13:10:58 2026 Received: from zg8tmtyylji0my4xnjqumte4.icoremail.net (zg8tmtyylji0my4xnjqumte4.icoremail.net [162.243.164.118]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 8D47213A258; Fri, 31 Jul 2026 09:00:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=162.243.164.118 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785488428; cv=none; b=mtyg4fs8ri8ibixezJbU3Ru6JDzkfR3VlPExtafnvGEw72b3SkFS30ryD4V0OMLcIoZ2YVNs/OAE2lutcys9QJ/YzorLdrplUk/pGEqqPMglAH97KIfmQgIF3N+dhYEd+t3vgSJD8DxNcoo7+fmwEiCC4kVWAwGIOJL27BQvSV8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785488428; c=relaxed/simple; bh=RAvzM+hyqhMET+0kh2pL2XKORp71JrMeYeQ8Hkkl8dY=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=HyX5csHYY82rDJjs4CR72LCfy+q46gE305SO4JvRnY+ZFuiCkueXhry2JK3qP3bjtoRplJf2gcl/bHktLE7B50KOJQDDBtWe7W6QtDttwu4nFlrcjBcvgr3/M3a9NyRbSCvcWOQB++ETFFF1McnEkH+Cz6b5w/VccuBQN5YHgkA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=zju.edu.cn; spf=pass smtp.mailfrom=zju.edu.cn; arc=none smtp.client-ip=162.243.164.118 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=zju.edu.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=zju.edu.cn Received: from zju.edu.cn (unknown [10.98.66.117]) by mtasvr (Coremail) with SMTP id _____wAHIX0dZGxqJ2pTAA--.3293S3; Fri, 31 Jul 2026 17:00:13 +0800 (CST) Received: from localhost.localdomain (unknown [10.98.66.117]) by mail-app4 (Coremail) with SMTP id zi_KCgB3fDYaZGxqvp_CAg--.43373S3; Fri, 31 Jul 2026 17:00:12 +0800 (CST) From: Fan Wu To: linux@armlinux.org.uk, gregkh@linuxfoundation.org Cc: jirislaby@kernel.org, linux-serial@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, Fan Wu Subject: [PATCH v2 1/3] serial: amba-pl011: fix indefinite RS485 post-send delay Date: Fri, 31 Jul 2026 08:59:13 +0000 Message-Id: <20260731085915.326775-2-fanwu01@zju.edu.cn> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260731085915.326775-1-fanwu01@zju.edu.cn> References: <2026073047-unsorted-stick-b16f@gregkh> <20260731085915.326775-1-fanwu01@zju.edu.cn> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-CM-TRANSID: zi_KCgB3fDYaZGxqvp_CAg--.43373S3 X-CM-SenderInfo: qrstjiaswqq6lmxovvfxof0/ X-CM-DELIVERINFO: =?B?t1IxGgXKKxbFmtjJiESix3B1w3vZ3A9ovKVTomAyoQazvoRs/NHSP8GI2EvgeEEW7R sfnXz+g1OQfMo27QHy5TwQyZzZ0ZzJ4V0ypg1/R1cPfCk3LJLLPouM96QrQijSMggK2hMq l8kLwkGb+F/+Z/18/iap9E6mavGmQbzmcFsnzP86 X-Coremail-Antispam: 1Uk129KBj93XoW7KrW3uw17tFW7Zw47XF4xGrX_yoW8uryfpr 4kCrZFkFW0qa10qF47ZFW8WFWFqasxJwsI9FWUKa4rA3W3trn5GwnxJFZFgrZ7Z398WayY yryYyrs8GayIgagCm3ZEXasCq-sJn29KB7ZKAUJUUUUU529EdanIXcx71UUUUU7KY7ZEXa sCq-sGcSsGvfJ3Ic02F40EFcxC0VAKzVAqx4xG6I80ebIjqfuFe4nvWSU5nxnvy29KBjDU 0xBIdaVrnRJUUU9Gb4IE77IF4wAFF20E14v26r4j6ryUM7CY07I20VC2zVCF04k26cxKx2 IYs7xG6rWj6s0DM7CIcVAFz4kK6r106r15M28lY4IEw2IIxxk0rwA2F7IY1VAKz4vEj48v e4kI8wA2z4x0Y4vE2Ix0cI8IcVAFwI0_tr0E3s1l84ACjcxK6xIIjxv20xvEc7CjxVAFwI 0_Gr1j6F4UJwA2z4x0Y4vEx4A2jsIE14v26rxl6s0DM28EF7xvwVC2z280aVCY1x0267AK xVW0oVCq3wAac4AC62xK8xCEY4vEwIxC4wAS0I0E0xvYzxvE52x082IY62kv0487Mc804V CY07AIYIkI8VC2zVCFFI0UMc02F40EFcxC0VAKzVAqx4xG6I80ewAv7VC0I7IYx2IY67AK xVWUJVWUGwAv7VC2z280aVAFwI0_Jr0_Gr1lOx8S6xCaFVCjc4AY6r1j6r4UM4x0Y48Icx kI7VAKI48JM4x0Y48IcxkI7VAKI48G6xCjnVAKz4kxMxAIw28IcxkI7VAKI48JMxC20s02 6xCaFVCjc4AY6r1j6r4UMI8I3I0E5I8CrVAFwI0_Jr0_Jr4lx2IqxVCjr7xvwVAFwI0_Jr I_JrWlx4CE17CEb7AF67AKxVWUAVWUtwCIc40Y0x0EwIxGrwCI42IY6xIIjxv20xvE14v2 6r1j6r1xMIIF0xvE2Ix0cI8IcVCY1x0267AKxVWUJVW8JwCI42IY6xAIw20EY4v20xvaj4 0_Jr0_JF4lIxAIcVC2z280aVAFwI0_Jr0_Gr1lIxAIcVC2z280aVCY1x0267AKxVW8JVW8 JrUvcSsGvfC2KfnxnUUI43ZEXa7IU8D5r7UUUUU== Content-Type: text/plain; charset="utf-8" The RS485 stop hrtimer is used both to drain the transmitter and to wait out delay_rts_after_send. The callback cannot tell the two apart, so it restarts the post-send delay on every expiry and the timer never stops. Add a WAIT_AFTER_SEND_DELAY state so its expiry ends the stop sequence instead of restarting the delay. Fixes: 2c1fd53af21b ("serial: amba-pl011: Fix RTS handling in RS485 mode") Cc: stable@vger.kernel.org Assisted-by: Codex:gpt-5.6 Signed-off-by: Fan Wu --- drivers/tty/serial/amba-pl011.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl01= 1.c index 7f17d288c807..b212e2bcd41a 100644 --- a/drivers/tty/serial/amba-pl011.c +++ b/drivers/tty/serial/amba-pl011.c @@ -253,6 +253,7 @@ enum pl011_rs485_tx_state { WAIT_AFTER_RTS, SEND, WAIT_AFTER_SEND, + WAIT_AFTER_SEND_DELAY, }; =20 /* @@ -1285,6 +1286,7 @@ static void pl011_rs485_tx_stop(struct uart_amba_port= *uap) return; } if (port->rs485.delay_rts_after_send > 0) { + uap->rs485_tx_state =3D WAIT_AFTER_SEND_DELAY; hrtimer_start(&uap->trigger_stop_tx, ms_to_ktime(port->rs485.delay_rts_after_send), HRTIMER_MODE_REL); @@ -1350,7 +1352,8 @@ static void pl011_rs485_tx_start(struct uart_amba_por= t *uap) uap->rs485_tx_state =3D SEND; return; } - if (uap->rs485_tx_state =3D=3D WAIT_AFTER_SEND) { + if (uap->rs485_tx_state =3D=3D WAIT_AFTER_SEND || + uap->rs485_tx_state =3D=3D WAIT_AFTER_SEND_DELAY) { hrtimer_try_to_cancel(&uap->trigger_stop_tx); uap->rs485_tx_state =3D SEND; return; @@ -1417,7 +1420,8 @@ static enum hrtimer_restart pl011_trigger_stop_tx(str= uct hrtimer *t) unsigned long flags; =20 uart_port_lock_irqsave(&uap->port, &flags); - if (uap->rs485_tx_state =3D=3D WAIT_AFTER_SEND) + if (uap->rs485_tx_state =3D=3D WAIT_AFTER_SEND || + uap->rs485_tx_state =3D=3D WAIT_AFTER_SEND_DELAY) pl011_rs485_tx_stop(uap); uart_port_unlock_irqrestore(&uap->port, flags); =20 --=20 2.34.1 From nobody Fri Oct 2 13:10:58 2026 Received: from azure-sdnproxy.icoremail.net (azure-sdnproxy.icoremail.net [40.65.178.148]) by smtp.subspace.kernel.org (Postfix) with ESMTP id EDE60311C2C; Fri, 31 Jul 2026 09:00:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=40.65.178.148 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785488427; cv=none; b=Sgtvsdw7WGbenF7nXx+tG7RartQZEzJjn9tbb/vluMDyEg5NtTX3AvP5fI9SGk8c1ARoKoL8VOqVhxbRkpMlOPaWl3US+wj0PnUP8w6jY69cW3knef1b1uAjxgNsx6yTeONRx0hA1pEhHZ6M2j5P9bDKsU5UBM28euGLNUU93rA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785488427; c=relaxed/simple; bh=02sX0rKTtEOBC+vjlisHqKfWmTZEapicdyQ5ZRTxPKY=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=YAEMT5cBJ3/88xFSFr1wv2TD/j0mJDctky/7zdcDnSBxLOBlEbTx23fs3u58icUQ+5pOyjEe58+05tp9t7sRBqGFy5LU6XyzzQUvQXUrcXl+W4jtgbJ2CtOjkbpyRGdTA6T35Cspv5X7JOOzUReKCY//UkFYW8YCmZrzlkEl9m0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=zju.edu.cn; spf=pass smtp.mailfrom=zju.edu.cn; arc=none smtp.client-ip=40.65.178.148 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=zju.edu.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=zju.edu.cn Received: from zju.edu.cn (unknown [10.98.66.117]) by mtasvr (Coremail) with SMTP id _____wBXBD4dZGxqKGpTAA--.789S3; Fri, 31 Jul 2026 17:00:13 +0800 (CST) Received: from localhost.localdomain (unknown [10.98.66.117]) by mail-app4 (Coremail) with SMTP id zi_KCgB3fDYaZGxqvp_CAg--.43373S4; Fri, 31 Jul 2026 17:00:12 +0800 (CST) From: Fan Wu To: linux@armlinux.org.uk, gregkh@linuxfoundation.org Cc: jirislaby@kernel.org, linux-serial@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, Fan Wu Subject: [PATCH v2 2/3] serial: amba-pl011: cancel RS485 hrtimers after freeing IRQ Date: Fri, 31 Jul 2026 08:59:14 +0000 Message-Id: <20260731085915.326775-3-fanwu01@zju.edu.cn> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260731085915.326775-1-fanwu01@zju.edu.cn> References: <2026073047-unsorted-stick-b16f@gregkh> <20260731085915.326775-1-fanwu01@zju.edu.cn> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-CM-TRANSID: zi_KCgB3fDYaZGxqvp_CAg--.43373S4 X-CM-SenderInfo: qrstjiaswqq6lmxovvfxof0/ X-CM-DELIVERINFO: =?B?4ubHZQXKKxbFmtjJiESix3B1w3vZ3A9ovKVTomAyoQazvoRs/NHSP8GI2EvgeEEW7R sfnXz+g1OQfMo27QHy5TwQyZzn0nZMIneE74XNUApPxMArLJLLPouM96QrQijSMggK2oV2 +xkMrP3buNJLDZ648tup9E6mavGmQbzmcFsnzP86 X-Coremail-Antispam: 1Uk129KBj93XoWxGr45AF4UCF1UXrWkXr4fZwc_yoW5uFW8pr 4vkrZ8ArW0qa10vFsFvFW8WFW5trn3try7GrW7K3WFka47trn5G3W5AFZavFZxZaykXay2 kFn0yFs8GryxuFbCm3ZEXasCq-sJn29KB7ZKAUJUUUUU529EdanIXcx71UUUUU7KY7ZEXa sCq-sGcSsGvfJ3Ic02F40EFcxC0VAKzVAqx4xG6I80ebIjqfuFe4nvWSU5nxnvy29KBjDU 0xBIdaVrnRJUUU9Gb4IE77IF4wAFF20E14v26r4j6ryUM7CY07I20VC2zVCF04k26cxKx2 IYs7xG6rWj6s0DM7CIcVAFz4kK6r1Y6r17M28lY4IEw2IIxxk0rwA2F7IY1VAKz4vEj48v e4kI8wA2z4x0Y4vE2Ix0cI8IcVAFwI0_tr0E3s1l84ACjcxK6xIIjxv20xvEc7CjxVAFwI 0_Gr1j6F4UJwA2z4x0Y4vEx4A2jsIE14v26rxl6s0DM28EF7xvwVC2z280aVCY1x0267AK xVW0oVCq3wAac4AC62xK8xCEY4vEwIxC4wAS0I0E0xvYzxvE52x082IY62kv0487Mc804V CY07AIYIkI8VC2zVCFFI0UMc02F40EFcxC0VAKzVAqx4xG6I80ewAv7VC0I7IYx2IY67AK xVWUGVWUXwAv7VC2z280aVAFwI0_Jr0_Gr1lOx8S6xCaFVCjc4AY6r1j6r4UM4x0Y48Icx kI7VAKI48JM4x0Y48IcxkI7VAKI48G6xCjnVAKz4kxMxAIw28IcxkI7VAKI48JMxC20s02 6xCaFVCjc4AY6r1j6r4UMI8I3I0E5I8CrVAFwI0_Jr0_Jr4lx2IqxVCjr7xvwVAFwI0_Jr I_JrWlx4CE17CEb7AF67AKxVWUAVWUtwCIc40Y0x0EwIxGrwCI42IY6xIIjxv20xvE14v2 6r1j6r1xMIIF0xvE2Ix0cI8IcVCY1x0267AKxVW8JVWxJwCI42IY6xAIw20EY4v20xvaj4 0_Jr0_JF4lIxAIcVC2z280aVAFwI0_Jr0_Gr1lIxAIcVC2z280aVCY1x0267AKxVW8JVW8 JrUvcSsGvfC2KfnxnUUI43ZEXa7IU8zc_3UUUUU== Content-Type: text/plain; charset="utf-8" The RS485 trigger hrtimers are embedded in the devm-managed port and can fire after it is freed. The IRQ handler can arm a timer, so free the IRQ first and then cancel both timers. Complete the RS485 stop without arming a timer, and cancel the timers in remove() for the suspend-then-unbind path, where shutdown is not called. This issue was found by an in-house static analysis tool. Fixes: 2c1fd53af21b ("serial: amba-pl011: Fix RTS handling in RS485 mode") Cc: stable@vger.kernel.org Assisted-by: Codex:gpt-5.6 Signed-off-by: Fan Wu --- drivers/tty/serial/amba-pl011.c | 52 ++++++++++++++++++++++----------- 1 file changed, 35 insertions(+), 17 deletions(-) diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl01= 1.c index b212e2bcd41a..e686835d5150 100644 --- a/drivers/tty/serial/amba-pl011.c +++ b/drivers/tty/serial/amba-pl011.c @@ -1269,11 +1269,30 @@ static inline bool pl011_dma_rx_running(struct uart= _amba_port *uap) #define pl011_dma_flush_buffer NULL #endif =20 -static void pl011_rs485_tx_stop(struct uart_amba_port *uap) +static void pl011_rs485_tx_stop_now(struct uart_amba_port *uap) { struct uart_port *port =3D &uap->port; u32 cr; =20 + cr =3D pl011_read(uap, REG_CR); + + if (port->rs485.flags & SER_RS485_RTS_AFTER_SEND) + cr &=3D ~UART011_CR_RTS; + else + cr |=3D UART011_CR_RTS; + + /* Disable the transmitter and reenable the transceiver */ + cr &=3D ~UART011_CR_TXE; + cr |=3D UART011_CR_RXE; + pl011_write(cr, uap, REG_CR); + + uap->rs485_tx_state =3D OFF; +} + +static void pl011_rs485_tx_stop(struct uart_amba_port *uap) +{ + struct uart_port *port =3D &uap->port; + if (uap->rs485_tx_state =3D=3D SEND) uap->rs485_tx_state =3D WAIT_AFTER_SEND; =20 @@ -1297,19 +1316,7 @@ static void pl011_rs485_tx_stop(struct uart_amba_por= t *uap) hrtimer_try_to_cancel(&uap->trigger_start_tx); } =20 - cr =3D pl011_read(uap, REG_CR); - - if (port->rs485.flags & SER_RS485_RTS_AFTER_SEND) - cr &=3D ~UART011_CR_RTS; - else - cr |=3D UART011_CR_RTS; - - /* Disable the transmitter and reenable the transceiver */ - cr &=3D ~UART011_CR_TXE; - cr |=3D UART011_CR_RXE; - pl011_write(cr, uap, REG_CR); - - uap->rs485_tx_state =3D OFF; + pl011_rs485_tx_stop_now(uap); } =20 static void pl011_stop_tx(struct uart_port *port) @@ -2019,11 +2026,20 @@ static void pl011_shutdown(struct uart_port *port) =20 pl011_dma_shutdown(uap); =20 - if ((port->rs485.flags & SER_RS485_ENABLED && uap->rs485_tx_state !=3D OF= F)) - pl011_rs485_tx_stop(uap); - free_irq(uap->port.irq, uap); =20 + /* + * free_irq() drains the UART interrupt handler, which can arm either + * timer. Cancel the timers afterwards to drain their callbacks too. + */ + hrtimer_cancel(&uap->trigger_start_tx); + hrtimer_cancel(&uap->trigger_stop_tx); + + uart_port_lock_irq(port); + if (uap->rs485_tx_state !=3D OFF) + pl011_rs485_tx_stop_now(uap); + uart_port_unlock_irq(port); + pl011_disable_uart(uap); =20 /* @@ -2941,6 +2957,8 @@ static void pl011_remove(struct amba_device *dev) struct uart_amba_port *uap =3D amba_get_drvdata(dev); =20 uart_remove_one_port(&amba_reg, &uap->port); + hrtimer_cancel(&uap->trigger_start_tx); + hrtimer_cancel(&uap->trigger_stop_tx); pl011_unregister_port(uap); } =20 --=20 2.34.1 From nobody Fri Oct 2 13:10:58 2026 Received: from zg8tmtyylji0my4xnjqumte4.icoremail.net (zg8tmtyylji0my4xnjqumte4.icoremail.net [162.243.164.118]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 4D98C489896; Fri, 31 Jul 2026 09:00:15 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=162.243.164.118 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785488423; cv=none; b=rRvc1JJWMPsTodguDwz98qkM5ubJ5rlpn+d3hzMWYhtGWgvXFzc4FsYdVl8fcR6rIWzaFUJuPA04svVIxF/cEAyFmFhQrQ6qlwpn7l97APVk7xiUBvT7T0hy49MgFRRRL8X1JhRF4K3IgiWyZj4VzXcdw1Ll9o0cc13TAuuP3Ok= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785488423; c=relaxed/simple; bh=AxsT2z8wWjyFihVEBwh/2GOjbF6qQMnKxOAeKMwldYA=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=LrN08n8qYgrizBu3r6Wi9l/f11BprQa7B7tdm3jBVr+s3UY8CJfqTi8TWXQ5yTxdumHGjrx+oFQi5WSV7wCXgkaPD0qnCNgevyi3hPA2V9H/hQwhQkxwp856btJUw2RYMzfQygvp8im+HSDfZG2Y72z07TLbi2dJ32+7AjNo7og= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=zju.edu.cn; spf=pass smtp.mailfrom=zju.edu.cn; arc=none smtp.client-ip=162.243.164.118 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=zju.edu.cn Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=zju.edu.cn Received: from zju.edu.cn (unknown [10.98.66.117]) by mtasvr (Coremail) with SMTP id _____wCnpCkdZGxqKWpTAA--.3261S3; Fri, 31 Jul 2026 17:00:13 +0800 (CST) Received: from localhost.localdomain (unknown [10.98.66.117]) by mail-app4 (Coremail) with SMTP id zi_KCgB3fDYaZGxqvp_CAg--.43373S5; Fri, 31 Jul 2026 17:00:12 +0800 (CST) From: Fan Wu To: linux@armlinux.org.uk, gregkh@linuxfoundation.org Cc: jirislaby@kernel.org, linux-serial@vger.kernel.org, linux-kernel@vger.kernel.org, stable@vger.kernel.org, Fan Wu Subject: [PATCH v2 3/3] serial: amba-pl011: synchronize DMA teardown Date: Fri, 31 Jul 2026 08:59:15 +0000 Message-Id: <20260731085915.326775-4-fanwu01@zju.edu.cn> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260731085915.326775-1-fanwu01@zju.edu.cn> References: <2026073047-unsorted-stick-b16f@gregkh> <20260731085915.326775-1-fanwu01@zju.edu.cn> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-CM-TRANSID: zi_KCgB3fDYaZGxqvp_CAg--.43373S5 X-CM-SenderInfo: qrstjiaswqq6lmxovvfxof0/ X-CM-DELIVERINFO: =?B?hsjDNwXKKxbFmtjJiESix3B1w3vZ3A9ovKVTomAyoQazvoRs/NHSP8GI2EvgeEEW7R sfnXz+g1OQfMo27QHy5TwQyZxObGrMKbtNjHLQTE9kB5hqLJLLPouM96QrQijSMggK2pMV yr2XpFSs59mqEOZRcuWp9E6mavGmQbzmcFsnzP86 X-Coremail-Antispam: 1Uk129KBj93XoW7tF45WryUAFWfCrW5Xr45XFc_yoW8Cr13pr Z3ArZFyFy0qFW7Aay3uF48WFy8A3yrtryfGaykA3W0g3W5Xry8WF45C3s0vFZrAws7Jr1j yF4Dta1ruF9xKFgCm3ZEXasCq-sJn29KB7ZKAUJUUUUU529EdanIXcx71UUUUU7KY7ZEXa sCq-sGcSsGvfJ3Ic02F40EFcxC0VAKzVAqx4xG6I80ebIjqfuFe4nvWSU5nxnvy29KBjDU 0xBIdaVrnRJUUU9Gb4IE77IF4wAFF20E14v26r4j6ryUM7CY07I20VC2zVCF04k26cxKx2 IYs7xG6rWj6s0DM7CIcVAFz4kK6r1Y6r17M28lY4IEw2IIxxk0rwA2F7IY1VAKz4vEj48v e4kI8wA2z4x0Y4vE2Ix0cI8IcVAFwI0_tr0E3s1l84ACjcxK6xIIjxv20xvEc7CjxVAFwI 0_Gr1j6F4UJwA2z4x0Y4vEx4A2jsIE14v26rxl6s0DM28EF7xvwVC2z280aVCY1x0267AK xVW0oVCq3wAac4AC62xK8xCEY4vEwIxC4wAS0I0E0xvYzxvE52x082IY62kv0487Mc804V CY07AIYIkI8VC2zVCFFI0UMc02F40EFcxC0VAKzVAqx4xG6I80ewAv7VC0I7IYx2IY67AK xVWUXVWUAwAv7VC2z280aVAFwI0_Jr0_Gr1lOx8S6xCaFVCjc4AY6r1j6r4UM4x0Y48Icx kI7VAKI48JM4x0Y48IcxkI7VAKI48G6xCjnVAKz4kxMxAIw28IcxkI7VAKI48JMxC20s02 6xCaFVCjc4AY6r1j6r4UMI8I3I0E5I8CrVAFwI0_Jr0_Jr4lx2IqxVCjr7xvwVAFwI0_Jr I_JrWlx4CE17CEb7AF67AKxVWUAVWUtwCIc40Y0x0EwIxGrwCI42IY6xIIjxv20xvE14v2 6r1j6r1xMIIF0xvE2Ix0cI8IcVCY1x0267AKxVW8JVWxJwCI42IY6xAIw20EY4v20xvaj4 0_Jr0_JF4lIxAIcVC2z280aVAFwI0_Jr0_Gr1lIxAIcVC2z280aVCY1x0267AKxVW8JVW8 JrUvcSsGvfC2KfnxnUUI43ZEXa7IU8SeHDUUUUU== Content-Type: text/plain; charset="utf-8" dmaengine_terminate_all() does not wait for a running callback, so the TX callback can still touch the TX buffer after it is freed. The RX poll timer reads the RX buffers without the port lock. Switch to dmaengine_terminate_sync() and delete the RX timer before freeing the buffers. Fixes: ead76f329f77 ("ARM: 6763/1: pl011: add optional RX DMA to PL011 v2") Cc: stable@vger.kernel.org Assisted-by: Codex:gpt-5.6 Signed-off-by: Fan Wu --- drivers/tty/serial/amba-pl011.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl01= 1.c index e686835d5150..9bfccb021383 100644 --- a/drivers/tty/serial/amba-pl011.c +++ b/drivers/tty/serial/amba-pl011.c @@ -1182,7 +1182,7 @@ static void pl011_dma_shutdown(struct uart_amba_port = *uap) =20 if (uap->using_tx_dma) { /* In theory, this should already be done by pl011_dma_flush_buffer */ - dmaengine_terminate_all(uap->dmatx.chan); + dmaengine_terminate_sync(uap->dmatx.chan); if (uap->dmatx.queued) { dma_unmap_single(uap->dmatx.chan->device->dev, uap->dmatx.dma, uap->dmatx.len, @@ -1195,12 +1195,12 @@ static void pl011_dma_shutdown(struct uart_amba_por= t *uap) } =20 if (uap->using_rx_dma) { - dmaengine_terminate_all(uap->dmarx.chan); + if (uap->dmarx.poll_rate) + timer_delete_sync(&uap->dmarx.timer); + dmaengine_terminate_sync(uap->dmarx.chan); /* Clean up the RX DMA */ pl011_dmabuf_free(uap->dmarx.chan, &uap->dmarx.dbuf_a, DMA_FROM_DEVICE); pl011_dmabuf_free(uap->dmarx.chan, &uap->dmarx.dbuf_b, DMA_FROM_DEVICE); - if (uap->dmarx.poll_rate) - timer_delete_sync(&uap->dmarx.timer); uap->using_rx_dma =3D false; } } --=20 2.34.1