From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793099224; b=LMVII0CnX9/cBvUvNWCN5Ta44w+26TAttyP5SD5a8f4l6UU+EjoWNL3Iu5thaD+8IrB4 fcHLpIJAzGC/Qb8fEuxUBnUv+lh/DtNgscZjgxBdLv/jmzrO8L/rZJOi3j28NAMfdve53 R6pQs6ZHsusXh4orO32pu9DpF+JbBztVjMu824k9Mzv5NPP+xJrZjJvZkvPmQNfUuYH4z 1yp752hya/UxX0FW5qxGmATiIoqZp2AhFPpNBRdsMKU+eq65pNvuya4/xTj68ECQOcvbM 1ZSCnXPcqJsQMvTxlxumgKv0TTwb+yjq19LS/xZDdAbR1p57s1aPtgj7YUPSuZZR51g== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793099224; h=Received:DKIM-Signature:From:Date:Subject:MIME-Version:Content-Type: Content-Transfer-Encoding:Message-Id:References:In-Reply-To:To:Cc: X-Mailer:X-Developer-Signature:X-Developer-Key; bh=0BxhNABijuEYtfvBMCNZDK1Q2xJ35VU9HWCHtBe1cHc=; b=Zp01CzuW1A6PnYKxB2CRi7EToJ0nDiMj30jHrAso+BY5jH9so9ftstK1YL0Mh7UUjxVJ uGvljRrdpj5MzpPWd3+muwOdppHC51Wkbx0fwT9gzfZEpmkv/xOhz8Z7jad2e4ZG0I18P afzbnZ0AY7Dm0W8eiTVX59lpJRS7vQP+FrfBXhsOS8aKmhW7dYgb9XGlDeuinFPojw6sL Sz0kXGi6byQk1yrsMKpaalvZiMSDrd26neS/yMR0onCyIt+BuXoSVG0qcn1KSuK64tbOW N7m2CjwFbH7flFhrfeW/jEvbpRHQZRKaX3WavZFqZQHVbMbUsxLho19QFfRtEqT7OUw== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=fNKAKxKW; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1AA7960A5BD2; Tue, 27 Oct 2026 11:07:04 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key, unprotected) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=fNKAKxKW Received: by smtp.kernel.org (Postfix) with ESMTPSA id 506181F031F3; Tue, 27 Oct 2026 11:07:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1793099224; bh=0BxhNABijuEYtfvBMCNZDK1Q2xJ35VU9HWCHtBe1cHc=; h=From:Date:Subject:References:In-Reply-To:To:Cc; b=fNKAKxKW2vorbJpI9f+vQjNQ2+G6vKaT8L8ksTv3BhXM04jNWgPeccCJOEI7jlCq8 T4BcoXJTVgq9jBicgNiOQn8Pqu45SEMeWpVC6VLnDcH9UFqpfgL9PrpQrMFDUWAsag pgmk/LXJpnn397kYEBhubYCZ9QKPAzGoKYmPxIao= From: Greg Kroah-Hartman Date: Tue, 27 Oct 2026 12:06:34 +0100 Subject: [PATCH 08/24] serial: 8250: cancel overrun backoff work on port shutdown and unregister X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit Message-Id: <20261027-tty-llm-v1-8-99b0202ae546@linuxfoundation.org> References: <20261027-tty-llm-v1-0-99b0202ae546@linuxfoundation.org> In-Reply-To: <20261027-tty-llm-v1-0-99b0202ae546@linuxfoundation.org> To: Jiri Slaby , Joshua Rogers , Chris Mason , Josef Bacik Cc: Tony Lindgren , Rafael Gago Castano , Florian Fainelli , =?utf-8?q?Ilpo_J=C3=A4rvinen?= , Andy Shevchenko , Peter Hurley , Heikki Krogerus , Crescent Hsieh , Frank Li , Sherry Sun , Sascha Hauer , Pengutronix Kernel Team , Fabio Estevam , Manivannan Sadhasivam , Olof Johansson , =?utf-8?q?Andreas_F=C3=A4rber?= , Arnd Bergmann , Krzysztof Kozlowski , Peter Griffin , Alim Akhtar , Robert Baldyga , Thomas Abraham , Kukjin Kim , Patrice Chotard , Srinivas Kandagatla , Maxime Coquelin , Alexandre Torgue , Andy Shevchenko , Vladimir Zapolskiy , Al Cooper , linux-kernel@vger.kernel.org, linux-serial@vger.kernel.org, Greg Kroah-Hartman , John Ogness , Fushuai Wang , =?utf-8?q?Uwe_Kleine-K=C3=B6nig_=28The_Capable_Hub=29?= , Moteen Shah , Kendall Willis , Hugo Villeneuve , stable X-Mailer: b4 0.17-dev-e5168 X-Developer-Signature: v=1; a=openpgp-sha256; l=3183; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=wsoFdOYqQYtg024AcXoqOIpLWYt/kp1qgch/Dt5u0z8=; b=owGbwMvMwCRo6H6F97bub03G02pJDFkPWveJlWT9/Sr6NHvyt+Krr+caS4TH6d69bcpqqSQq9 ZyhpGRTRywLgyATg6yYIsuXbTxH91ccUvQytD0NM4eVCWQIAxenAExk8ySGBQ0yi3hbI1svizo9 5Fv0buPRO08MVzDMZLRoziicn9YuIyv8bq7vRutSu2NFAA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 From: Joshua Rogers The overrun_backoff delayed work can be scheduled from IRQ handlers in 8250_fsl.c and 8250_omap.c via schedule_delayed_work(). However, this work is never canceled in the shutdown or unregister paths, so it can fire after the port has been torn down, causing stale hardware access or use-after-free. The existing synchronize_irq() calls in the shutdown path only synchronize with the IRQ handler itself, not with workqueue callbacks that the handler has already enqueued. Add cancel_delayed_work_sync() after the IRQ is quiesced in serial8250_do_shutdown() (the generic shutdown path used by FSL and others), omap_8250_shutdown() (the OMAP-specific shutdown path), and serial8250_unregister_port() (the module unload / hot-unplug path). Cc: Jiri Slaby Cc: John Ogness Cc: Joshua Rogers Cc: Fushuai Wang Cc: Crescent Hsieh Cc: "Uwe Kleine-König (The Capable Hub)" Cc: Moteen Shah Cc: Kendall Willis Cc: Frank Li Cc: Andy Shevchenko Cc: "Ilpo Järvinen" Cc: Josef Bacik Cc: Hugo Villeneuve Cc: stable Signed-off-by: Joshua Rogers Signed-off-by: Greg Kroah-Hartman --- drivers/tty/serial/8250/8250_core.c | 3 +++ drivers/tty/serial/8250/8250_omap.c | 3 +++ drivers/tty/serial/8250/8250_port.c | 3 +++ 3 files changed, 9 insertions(+) diff --git a/drivers/tty/serial/8250/8250_core.c b/drivers/tty/serial/8250/8250_core.c index 5730ef97f836..af94ed4e633e 100644 --- a/drivers/tty/serial/8250/8250_core.c +++ b/drivers/tty/serial/8250/8250_core.c @@ -950,6 +950,9 @@ void serial8250_unregister_port(struct uart_8250_port *uart) serial8250_em485_free(uart); + if (uart->overrun_backoff_time_ms) + cancel_delayed_work_sync(&uart->overrun_backoff); + uart_remove_one_port(&serial8250_reg, &uart->port); if (serial8250_isa_devs) { uart->port.flags &= ~UPF_BOOT_AUTOCONF; diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c index 29a203ed93fd..07ebed6ac6c9 100644 --- a/drivers/tty/serial/8250/8250_omap.c +++ b/drivers/tty/serial/8250/8250_omap.c @@ -786,6 +786,9 @@ static void omap_8250_shutdown(struct uart_port *port) disable_irq_nosync(port->irq); + if (up->overrun_backoff_time_ms) + cancel_delayed_work_sync(&up->overrun_backoff); + serial8250_release_dma(up); up->dma = NULL; diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c index 4afebd96e062..710d2a28b918 100644 --- a/drivers/tty/serial/8250/8250_port.c +++ b/drivers/tty/serial/8250/8250_port.c @@ -2497,6 +2497,9 @@ void serial8250_do_shutdown(struct uart_port *port) synchronize_irq(port->irq); + if (up->overrun_backoff_time_ms) + cancel_delayed_work_sync(&up->overrun_backoff); + if (up->dma) serial8250_release_dma(up); -- 2.56.0