[PATCH v3 2/3] serial: tegra: fix TX DMA descriptor use-after-free

[Austin Schlegel via B4 Relay <devnull+schlegelas.outlook.com@kernel.org>]

From: Austin Schlegel <schlegelas@outlook.com>

tegra_uart_stop_tx() calls dmaengine_terminate_all() and then
async_tx_ack(tup->tx_dma_desc) on the descriptor that was just
terminated. With the GPC DMA driver, dmaengine_terminate_all() frees
the active descriptor immediately, so the ack call that follows
touches freed memory.

This is the same use-after-free pattern fixed for the RX path in
tegra_uart_terminate_rx_dma() ("serial: tegra: fix RX DMA descriptor
use-after-free"). dmaengine clients must not touch a descriptor once
dmaengine_terminate_all() has returned.

Move the ack before dmaengine_terminate_all(), while the descriptor
is still valid.

tegra_uart_flush_buffer() reaches the same freed descriptor by another
route. It terminates the TX channel but leaves tx_in_progress set to
TEGRA_UART_TX_DMA, so a later tegra_uart_stop_tx() still sees a DMA
transfer in flight and acks the descriptor that
dmaengine_terminate_all() freed. Ack the descriptor before terminating
there too, and clear tx_in_progress so that nothing touches it
afterwards. Only clear it for a DMA transfer: a PIO transfer still has
the THRI interrupt enabled and is finished by the ISR.

Acking before terminating keeps descriptors reusable on APB DMA, which
only recycles a descriptor once it has been acked.

Found by code inspection while fixing the analogous RX bug and through
Sashiko automated review (see Link below); not reproduced on hardware,
since triggering it requires stopping or flushing an in-flight TX DMA
transfer at the right moment.

The ordering has been wrong since the driver was added; it became a
use-after-free once serial-tegra could use the GPC DMA driver,
which frees descriptors on terminate.

Fixes: e9ea096dd225 ("serial: tegra: add serial driver")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/all/sashiko-outbox-172211@kernel.org/
Assisted-by: LLM
Signed-off-by: Austin Schlegel <schlegelas@outlook.com>
---
v3:
 - Also fix tegra_uart_flush_buffer(), which terminated the TX channel
   without clearing tx_in_progress, so a later tegra_uart_stop_tx()
   acked the freed descriptor (reported by Sashiko review of v2
   https://lore.kernel.org/all/sashiko-outbox-172211@kernel.org/).
 - The tegra_uart_tx_dma_complete() race reported in the same review
   is fixed separately in new patch 3/3.

v2:
 - Reworded commit: Removed inaccurate flush example
 - Switched to personal email (v1 sent from austin.schlegel@arthrex.com)

v1: https://lore.kernel.org/all/20261001-tty-linus-v1-2-ecb8576c802d@arthrex.com/
---
 drivers/tty/serial/serial-tegra.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/drivers/tty/serial/serial-tegra.c b/drivers/tty/serial/serial-tegra.c
index a23a92cebe0d..c179a09b8fe2 100644
--- a/drivers/tty/serial/serial-tegra.c
+++ b/drivers/tty/serial/serial-tegra.c
@@ -639,9 +639,9 @@ static void tegra_uart_stop_tx(struct uart_port *u)
 
 	dmaengine_pause(tup->tx_dma_chan);
 	dmaengine_tx_status(tup->tx_dma_chan, tup->tx_cookie, &state);
+	async_tx_ack(tup->tx_dma_desc);
 	dmaengine_terminate_all(tup->tx_dma_chan);
 	count = tup->tx_bytes_requested - state.residue;
-	async_tx_ack(tup->tx_dma_desc);
 	uart_xmit_advance(&tup->uport, count);
 	tup->tx_in_progress = 0;
 }
@@ -1275,8 +1275,14 @@ static void tegra_uart_flush_buffer(struct uart_port *u)
 	struct tegra_uart_port *tup = to_tegra_uport(u);
 
 	tup->tx_bytes = 0;
-	if (tup->tx_dma_chan)
+	if (tup->tx_dma_chan) {
+		if (tup->tx_in_progress == TEGRA_UART_TX_DMA) {
+			async_tx_ack(tup->tx_dma_desc);
+			tup->tx_in_progress = 0;
+		}
+
 		dmaengine_terminate_all(tup->tx_dma_chan);
+	}
 }
 
 static void tegra_uart_shutdown(struct uart_port *u)

-- 
2.53.0