From nobody Mon Sep 28 08:07:06 2026 Received: from mx0b-0031df01.pphosted.com (mx0b-0031df01.pphosted.com [205.220.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D8D62377566 for ; Mon, 24 Aug 2026 14:32:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.180.131 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787581946; cv=none; b=TR/n76xwlM6ujEFL+TN8m8Ton8O0R/0uvxI3/USwdBEiQ5AQHi9WFaPjbzSFLi/N+iFJZYp1Sap8ZElMNLGXkpf375WuOiAMRVfI9LSlYy/Lhdlsu+KuQ61XcrWs5dt0lYXi7bEujiXZnELs+b/VRuyDZf6/dZIhWupgJ2fAcEs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787581946; c=relaxed/simple; bh=lZhPUxX46U8cz7NCrnERk6mwOihx4Cpq1wkLQOYWdvY=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:To:Cc; b=OTlZhHNUrL4BrAit6HuT9kh5HJdnnHdZKFPD6yJQwAjLvCb/6JlkeJ4KV8aXwgwohBMMG6Tlr4Q4MVzdF9OCsiLg0T54VpgmqfhCRvGUn0vkf600Wgg9nKJY5vkf2qU4dEWIcZI7oT+2CkRoghOiWgdKD86HqLc4kUSImM5Zp6M= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=cA17SWBa; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=djrBJpNh; arc=none smtp.client-ip=205.220.180.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="cA17SWBa"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="djrBJpNh" Received: from pps.filterd (m0279870.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 67OD9IBG3102861 for ; Mon, 24 Aug 2026 14:32:23 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:message-id :mime-version:subject:to; s=qcppdkim1; bh=lzgtT73adN8oD8okeoxk47 Ph58ooJDhQByvZ1BW01M0=; b=cA17SWBaeU54q1/NqbT96chGFfF4/0TdOB3r+G EFPhVoVvJzcQFz5Rx/Xc8YqruPTDgIWmNr7Om0MBzPTNF+iNYLFcyuBORb71EIyd xh8l53S90n+Rf4Xf4btDPkA6EDvFod3mTh7mtlkaDZHoQ6Z9sfAqr6hrwNj//w22 Rb40M5855TALhG9HhoZXevIj//Uc/eeFihBMeyoONk7D4b74IAgrt/znLd9Qpulb s3ylspud7JsG3IXwi4YtrmYmWx/SpEJ7pMvW1iMptJ/z5QyIbZfWldQhflwP0ZsG OOr4a6Ky9CPL8Q845SNpcicyLAVHEAwginSc37oTM+nQjGMA== Received: from mail-pf1-f198.google.com (mail-pf1-f198.google.com [209.85.210.198]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4g8pkdgay8-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Mon, 24 Aug 2026 14:32:23 +0000 (GMT) Received: by mail-pf1-f198.google.com with SMTP id d2e1a72fcca58-84a67b16217so6081472b3a.3 for ; Mon, 24 Aug 2026 07:32:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1787581943; x=1788186743; darn=vger.kernel.org; h=cc:to:message-id:content-transfer-encoding:content-type :mime-version:subject:date:from:from:to:cc:subject:date:message-id :reply-to:content-type; bh=lzgtT73adN8oD8okeoxk47Ph58ooJDhQByvZ1BW01M0=; b=djrBJpNhSU/1ZMRd/z35CMiA2Ef48gSiDvS2roLpeNN3EvybLDi1mH2u/qO7LKRKbY AFBoSkNf0eYyL9kG9Z2txsV+IFUHZAE9irVJ9+j6cklGkmxp7ZIkNPQIR0xnXw1Iy29F uyFxNWKiyT7AIAhz/a3nIVDtnh3vhslc/Jgnwku1pS9C2nc1RFIE2VVVDmHCs2jxnGfl ggTYBWrLFkcPeDpBs6qSuKV6cNr1bpqeBBYlcULVpbpfbT4sSrVrMBfFhi3tY6mDqoXy vw5VmtRt4DM9cJ53nyVpycOvN9mjJ5fr/sX3ldFnfKy97rvSLuBk2MHL82yOj1uxi8j5 SVcw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787581943; x=1788186743; h=cc:to:message-id:content-transfer-encoding:content-type :mime-version:subject:date:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to:content-type; bh=lzgtT73adN8oD8okeoxk47Ph58ooJDhQByvZ1BW01M0=; b=Etq+Zq9haTbbQWE4F2KVISf735ytiHQfUz7xym3lpL+9XWJIOZ65PiSGT/oSj7yath kuX8B2O77JwIs9sziw1QuYSpdkSCJUBCs6J4K/mNRHxsPLCbZThjq4C3GBiRJ5q3tTai 3DwBgePSC9VS7TS0WJ2h+bz43VzitmxvCIe/lx3o2IpmITwxU8CYWcmOnb51vNYCKTLQ muT3WPSHw9amATBNMfn7KgWYltSf7vIc1elG/DJqLdx7nCW0AFjw0GdAYLy5tl/83kvp kWZ/dsFltNzqIubTR09u255msjfFO5ujELlkGoOTGG+4x1/11f8/ucT43QuiOxGkJKym ITNw== X-Forwarded-Encrypted: i=1; AHgh+RqZBadYzP3INqd+lr32xGH8PSMyZ3liX8TijZnZT58FakhZAFrqr+OC2WrRZnSkIcvkBpXKDaBsiKupqlg=@vger.kernel.org X-Gm-Message-State: AFuF++l+wSfhi0aF1GGzw1PAVZWyCGP6yI5WdaHyhQRmHhlB/3RitD9p kCr6MLA6CD4Wla5NrgzKgnwJa/V0SMkAlCknHayizYdDxIyzxf5XpkAN8mFKBXPp3QnnJ8VEcxe 1nx9hm624OVdMViIqlvjt2ugxpYgTNF1nlW0Hvwx1TPegbM0j2hM7ranNMhHvl2IjfZg= X-Gm-Gg: AR+sD111YM+x6ZGVdMfdeWiPKdC94IubVGONpbrfiRaEM/RSm8Su35vumQtSbNzOl/r ZDOc2+dD//cXATNyzQSdBvdnrswjHLocU/KoEgQrptruxXTbInQQ7lB4eISGNouhPVBQHEDRhW3 Er0YXezrvMy/4DcjNArqiCgsdSaCs7ihZp0GOg6H0RZyQUjsIEdAW/c+WarpEnOxNRMXf3CYRQp zh7Ye+81pEupD3oKLNGEEpOd2uwfGwquBkOEW8s7iqZ11jz/xyOUQcziXKM2kPeoPYfcLRElH6q eChc+HtLK8dJgnUuKpdPaivorISWp+rwZMV8j9kugQ/lGhRhgpSpJpIZKO2pF1MajeCqOuqT5mF VycSiPFJGi+pJSX7+N+9FhR8l0PDfLfF9Nw== X-Received: by 2002:a05:6a00:2d02:b0:851:92fe:504b with SMTP id d2e1a72fcca58-8520b9fff6bmr26848330b3a.7.1787581942496; Mon, 24 Aug 2026 07:32:22 -0700 (PDT) X-Received: by 2002:a05:6a00:2d02:b0:851:92fe:504b with SMTP id d2e1a72fcca58-8520b9fff6bmr26848153b3a.7.1787581941732; Mon, 24 Aug 2026 07:32:21 -0700 (PDT) Received: from hu-ptalari-hyd.qualcomm.com ([202.46.22.19]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-8520f161e29sm2062684b3a.56.2026.08.24.07.30.30 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 24 Aug 2026 07:32:20 -0700 (PDT) From: Praveen Talari Date: Mon, 24 Aug 2026 20:00:17 +0530 Subject: [PATCH v2] serial: qcom-geni: Drop unsafe rx_buf realloc from setup_fifos() Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260824-drop-unsafe-rx-buf-realloc-from-setup-fifos-v2-1-9a1c8f711e98@oss.qualcomm.com> X-B4-Tracking: v=1; b=H4sIAHhVjGoC/5WOQQqDMBBFryJZd8RMtUhXvUdxYeKkpqixGSMW8 e6Nlh6gmw8PPv/9VTB5SyyuySo8zZatGyLgKRG6rYcHgW0iC8zwkpWI0Hg3Qhi4NgR+ARUMeKq 7zmkw3vXANIURjDWOAVWJpDKtiiYXcXH0ZOxy2O7VlzmoJ+lpV+yN1vLk/Pu4M8u99zPnf5lnC RIKbPAsdZlnJG+OOX2FutOu79MYotq27QNQUMA2/wAAAA== X-Change-ID: 20260822-drop-unsafe-rx-buf-realloc-from-setup-fifos-2b82eb0cb5d4 To: konrad.dybcio@oss.qualcomm.com, Greg Kroah-Hartman , Jiri Slaby Cc: chandana.chiluveru@oss.qualcomm.com, linux-arm-msm@vger.kernel.org, linux-kernel@vger.kernel.org, linux-serial@vger.kernel.org, Praveen Talari X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1787581830; l=2545; i=praveen.talari@oss.qualcomm.com; s=20251114; h=from:subject:message-id; bh=lZhPUxX46U8cz7NCrnERk6mwOihx4Cpq1wkLQOYWdvY=; b=E7kyAPaXnQwNN5xXNYO6MsOW+aTsbNY8/GnIHw2mXSJMp6Kere5IyvscSKX0NXvICgrQ4VLer JAQSMu/ZiGZCMncQ3Q7wiZPf52cp0oN4VHdcjneWInefRkt64LGLaAo X-Developer-Key: i=praveen.talari@oss.qualcomm.com; a=ed25519; pk=NGK/88fjyHXgfhIKwag7+uIytOmyOypvZ/hDFaYPEss= X-Proofpoint-Spam-Info: AW1haW4tMjYwODI0MDEyMiBTYWx0ZWRfX0Wswq2RcmwXA 6++Nmz847NcMuIioXp84VRJbFONESajRV6Zo/G9AJzFMJy49GtiZmBY6if+08jYFZm6g6Pa19EH Me1teL3sVUohbl+a7Z7agQcGyApSz50= X-Proofpoint-ORIG-GUID: LxdMJLZ4hy2fiFIvGW0steELmki64EV4 X-Proofpoint-GUID: LxdMJLZ4hy2fiFIvGW0steELmki64EV4 X-Authority-Analysis: v=2.4 cv=Kq19H2WN c=1 sm=1 tr=0 ts=6a8c55f7 cx=c_pps a=m5Vt/hrsBiPMCU0y4gIsQw==:117 a=fChuTYTh2wq5r3m49p7fHw==:17 a=IkcTkHD0fZMA:10 a=Sv0fKeRqtYgA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=gowsoOTTUOVcmtlkKump:22 a=bC-a23v3AAAA:8 a=EUspDBNiAAAA:8 a=rO80i1saf4kzB67oEq4A:9 a=QEXdDO2ut3YA:10 a=IoOABgeZipijB_acs4fv:22 a=FO4_E8m0qiDe52t0p3_H:22 X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwODI0MDEyMiBTYWx0ZWRfX97FdaZqI7wSs wJpn7kXUnM9HNaJxTrlCXqBD0rPL6NIbSGXWmOxvhMYRzs/1xvidLRvxIEQq3PRSwS4+SQ6xg9R 5nWlRXacFqGyOqulkK0vzkwLhhzFNUwWecRNyogQc4rSwq9Xq4weg3rMW5ACCGj99Shilud+tXC L77DddjJqdkiotgAhK6fqAkTpZN5QoYrn6X7r6VO41pqhZ2ZGb+FY0tch4e2i4TncXq/zUqgUjd N/DW9lfabxN7KCNXE5YJXT7JIrIqhquOc5qGbVN5mkfpabfPaVB0PeJP5MfqYTy7eIrLhNLcAVk 3ID4rNKo+UjMG/4g+C+Lv0zJ80S1i3Vg+C21HdIr/snn/FC2LXK5wYjHooeGz201igiEMYCH+r7 ++bxB8/T1XGG5bh/zg/aGwKXy3wQ/42K+XMjn1Sd0JZsSHo/29r7FfrjjZsUMQAnVY/wVhOH0P/ CPGZDJyuogTIuIOK+8Q== X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1176,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-08-24_04,2026-08-24_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 impostorscore=0 suspectscore=0 phishscore=0 bulkscore=0 clxscore=1015 adultscore=0 spamscore=0 priorityscore=1501 malwarescore=0 lowpriorityscore=0 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2608240122 The RX buffer is allocated once during probe using a fixed DMA_RX_BUF_SIZE and is DMA-mapped for the lifetime of the port. However, setup_fifos() attempts to reallocate rx_buf whenever the reported RX FIFO depth changes. Since the DMA mapping is not re-established after reallocation, the buffer pointer may change while the DMA engine continues using the stale DMA address. This can result in RX DMA targeting memory that no longer corresponds to the active buffer, leading to invalid DMA accesses and potential memory corruption. The RX FIFO depth is unrelated to the size of rx_buf. The buffer is allocated independently using DMA_RX_BUF_SIZE and all RX DMA paths consume it at that fixed size. As such, resizing the buffer based on FIFO depth changes provides no functional benefit. Signed-off-by: Praveen Talari --- Changes in v2: - Updated correct mail id. - Link to v1: https://patch.msgid.link/20260824-drop-unsafe-rx-buf-realloc-= from-setup-fifos-v1-1-52d231c840e1@oss.qualcomm.com --- drivers/tty/serial/qcom_geni_serial.c | 14 -------------- 1 file changed, 14 deletions(-) diff --git a/drivers/tty/serial/qcom_geni_serial.c b/drivers/tty/serial/qco= m_geni_serial.c index 3633723acef8..75b2e0b77d05 100644 --- a/drivers/tty/serial/qcom_geni_serial.c +++ b/drivers/tty/serial/qcom_geni_serial.c @@ -1291,7 +1291,6 @@ static irqreturn_t qcom_geni_serial_isr(int isr, void= *dev) static int setup_fifos(struct qcom_geni_serial_port *port) { struct uart_port *uport; - u32 old_rx_fifo_depth =3D port->rx_fifo_depth; =20 uport =3D &port->uport; port->tx_fifo_depth =3D geni_se_get_tx_fifo_depth(&port->se); @@ -1300,19 +1299,6 @@ static int setup_fifos(struct qcom_geni_serial_port = *port) uport->fifosize =3D (port->tx_fifo_depth * port->tx_fifo_width) / BITS_PER_BYTE; =20 - if (port->rx_buf && (old_rx_fifo_depth !=3D port->rx_fifo_depth) && port-= >rx_fifo_depth) { - /* - * Use krealloc rather than krealloc_array because rx_buf is - * accessed as 1 byte entries as well as 4 byte entries so it's - * not necessarily an array. - */ - port->rx_buf =3D devm_krealloc(uport->dev, port->rx_buf, - port->rx_fifo_depth * sizeof(u32), - GFP_KERNEL); - if (!port->rx_buf) - return -ENOMEM; - } - return 0; } =20 --- base-commit: 903c1cf6dff9964e71eda98a39e2e5d442050472 change-id: 20260822-drop-unsafe-rx-buf-realloc-from-setup-fifos-2b82eb0cb5d4 Best regards, -- =20 Praveen Talari