[PATCH v3 0/3] serial: tegra: fix DMA descriptor use-after-free and stale completions

[PATCH v3 0/3] serial: tegra: fix DMA descriptor use-after-free and stale completions

[Austin Schlegel via B4 Relay]

Patches 1 and 2 fix the same bug pattern in
drivers/tty/serial/serial-tegra.c: async_tx_ack() is called on a DMA
descriptor after dmaengine_terminate_all() has terminated it. With the
GPC DMA driver (tegra186-gpc-dma.c, used on Tegra186 and later),
terminating a channel frees the active descriptor synchronously via
vchan_dma_desc_free_list(), so the ack touches freed memory. dmaengine
clients are not allowed to touch a descriptor once it has been
terminated.

Patch 1 (RX) was found via a KFENCE use-after-free report on a Jetson
AGX Orin (Tegra234) under UART loopback traffic. It keeps the
descriptor-leak fix from commit b31245b94207 ("serial: tegra: ack the
rx dma desc after transfer terminated") intact: the ack still happens
for every terminated RX transfer, just before the descriptor is freed
instead of after.

Patch 2 (TX) fixes the same ordering bug in tegra_uart_stop_tx().
It also fixes tegra_uart_flush_buffer(), which terminated the TX
channel without clearing tx_in_progress, so a later
tegra_uart_stop_tx() acked the freed descriptor.

Patch 3 is new in v3. It makes the TX and RX DMA completion callbacks
return early when the transfer they were raised for has already been
stopped, flushed or terminated, instead of accounting for it a second
time.

The bugs fixed by patches 2 and 3 were found in review (Sashiko, on v2)
and have not been reproduced on hardware. In a 10-minute loopback test
with KFENCE sampling every 1 ms, which also stops and flushes TX during
DMA, the unfixed kernel produced 1635 use-after-free KFENCE
errors, all from RX. With this patch series applied there were none.

Testing was done on Tegra234 (Jetson AGX Orin) with GPC DMA only. The
APB DMA driver (Tegra20-Tegra210) recycles descriptors only after they
are acked; the series keeps every ack but has not been tested there.

Signed-off-by: Austin Schlegel <schlegelas@outlook.com>
---
Changes in v3:
- Patch 2: also fix tegra_uart_flush_buffer(), which left
  tx_in_progress set after terminating TX DMA (Sashiko review).
- New patch 3: ignore TX/RX DMA completion callbacks for transfers that
  were already stopped or terminated (Sashiko review).
- Patch 1: no code changes.
- Link to v2: https://lore.kernel.org/r/20261014-serial-tegra-dma-uaf-v2-0-b142b31b67e3@outlook.com

Changes in v2:
- Commit message updates only; no code changes.
- Patch 1: removed an inaccurate statement that the freed descriptor
  is accessed in tegra_uart_rx_dma_complete(); updated the soak test
  duration to 24+ hours.
- Patch 2: removed an inaccurate flush example; added Fixes: tag.
- Switched to my personal email address (v1 was sent from
  austin.schlegel@arthrex.com).
- Link to v1: https://lore.kernel.org/r/20261001-tty-linus-v1-0-ecb8576c802d@arthrex.com

---
Austin Schlegel (3):
      serial: tegra: fix RX DMA descriptor use-after-free
      serial: tegra: fix TX DMA descriptor use-after-free
      serial: tegra: ignore stale DMA completion callbacks

 drivers/tty/serial/serial-tegra.c | 56 +++++++++++++++++++++++++++++++++++----
 1 file changed, 51 insertions(+), 5 deletions(-)
---
base-commit: a90ee4305c4a5df72c11b31dacfdc76e00fcf78a
change-id: 20261014-serial-tegra-dma-uaf-39ed62701ab6

Best regards,
-- 
Austin Schlegel <schlegelas@outlook.com>

[PATCH v3 1/3] serial: tegra: fix RX DMA descriptor use-after-free

[Austin Schlegel via B4 Relay]

From: Austin Schlegel <schlegelas@outlook.com>

tegra_uart_terminate_rx_dma() calls dmaengine_terminate_all() and then
tegra_uart_rx_buffer_push(), which calls async_tx_ack(tup->rx_dma_desc)
on the just-terminated descriptor. With the GPC DMA driver,
dmaengine_terminate_all() frees the active descriptor immediately, so
the subsequent async_tx_ack() touches freed memory. dmaengine clients
are not allowed to touch a descriptor once it has been terminated.

Move the ack into the two call sites that still own a live descriptor:
tegra_uart_rx_dma_complete() (before the completion callback hands the
descriptor back) and tegra_uart_terminate_rx_dma() (before terminating),
and drop it from tegra_uart_rx_buffer_push() itself, since that function
no longer has a descriptor it's safe to ack.

The ack was originally added in commit b31245b94207 ("serial: tegra:
ack the rx dma desc after transfer terminated") to avoid a descriptor
leak with the Tegra20 APB DMA driver. Keep that fix intact: the ack
still happens for every terminated RX transfer, just before the
descriptor is freed instead of after.

KFENCE reports the use-after-free on a Jetson AGX Orin (Tegra234) under
UART loopback traffic:

BUG: KFENCE: use-after-free read in tegra_uart_rx_buffer_push+0x38/0x168
 tegra_uart_rx_buffer_push+0x38/0x168
 tegra_uart_terminate_rx_dma+0x88/0xf8
 tegra_uart_isr+0x380/0x470

allocated by task 0 on cpu 0 (~9 ms earlier):
 tegra_dma_prep_slave_sg+0x134/0x3c0
 tegra_uart_start_rx_dma.isra.0+0xc4/0x138
 tegra_uart_isr+0x340/0x470

freed by task 0 on cpu 0:
 tegra_dma_desc_free+0x1c/0x30
 vchan_dma_desc_free_list+0x10c/0x160
 tegra_dma_terminate_all+0x21c/0x290
 tegra_uart_terminate_rx_dma+0x7c/0xf8

Soak tested on Tegra234 (Jetson AGX Orin) for 24+ hours with
kfence.sample_interval=1 and continuous UART loopback traffic: zero
KFENCE reports, tx/rx byte counts in /proc/tty/driver/tegra_hsuart
remained equal throughout with no framing or break errors.

Fixes: b31245b94207 ("serial: tegra: ack the rx dma desc after transfer terminated")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Austin Schlegel <schlegelas@outlook.com>
---
v3:
 - No code changes.
 - Re-tested the series: in the same 10-minute UART loopback test with
   KFENCE sampling every 1 ms, the unfixed kernel gave 1635 KFENCE
   use-after-free error reports, and none with the series applied.

v2:
 - Reworded commit: Removed inaccurate statement claiming the freed-descriptor
   is accessed in tegra_uart_rx_dma_complete().
 - Reworded commit: Soak test ran for 24+ hours, so updated from 13 to 24.
 - Switched to personal email (v1 sent from austin.schlegel@arthrex.com)

v1: https://lore.kernel.org/all/20261001-tty-linus-v1-1-ecb8576c802d@arthrex.com/
---
 drivers/tty/serial/serial-tegra.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/tty/serial/serial-tegra.c b/drivers/tty/serial/serial-tegra.c
index b0fc4ae3686f..a23a92cebe0d 100644
--- a/drivers/tty/serial/serial-tegra.c
+++ b/drivers/tty/serial/serial-tegra.c
@@ -730,7 +730,6 @@ static void tegra_uart_rx_buffer_push(struct tegra_uart_port *tup,
 	struct tty_port *port = &tup->uport.state->port;
 	unsigned int count;
 
-	async_tx_ack(tup->rx_dma_desc);
 	count = tup->rx_bytes_requested - residue;
 
 	/* If we are here, DMA is stopped */
@@ -761,6 +760,7 @@ static void tegra_uart_rx_dma_complete(void *args)
 		set_rts(tup, false);
 
 	tup->rx_dma_active = false;
+	async_tx_ack(tup->rx_dma_desc);
 	tegra_uart_rx_buffer_push(tup, 0);
 	tegra_uart_start_rx_dma(tup);
 
@@ -783,6 +783,7 @@ static void tegra_uart_terminate_rx_dma(struct tegra_uart_port *tup)
 
 	dmaengine_pause(tup->rx_dma_chan);
 	dmaengine_tx_status(tup->rx_dma_chan, tup->rx_cookie, &state);
+	async_tx_ack(tup->rx_dma_desc);
 	dmaengine_terminate_all(tup->rx_dma_chan);
 
 	tegra_uart_rx_buffer_push(tup, state.residue);

-- 
2.53.0

[PATCH v3 2/3] serial: tegra: fix TX DMA descriptor use-after-free

[Austin Schlegel via B4 Relay]

From: Austin Schlegel <schlegelas@outlook.com>

tegra_uart_stop_tx() calls dmaengine_terminate_all() and then
async_tx_ack(tup->tx_dma_desc) on the descriptor that was just
terminated. With the GPC DMA driver, dmaengine_terminate_all() frees
the active descriptor immediately, so the ack call that follows
touches freed memory.

This is the same use-after-free pattern fixed for the RX path in
tegra_uart_terminate_rx_dma() ("serial: tegra: fix RX DMA descriptor
use-after-free"). dmaengine clients must not touch a descriptor once
dmaengine_terminate_all() has returned.

Move the ack before dmaengine_terminate_all(), while the descriptor
is still valid.

tegra_uart_flush_buffer() reaches the same freed descriptor by another
route. It terminates the TX channel but leaves tx_in_progress set to
TEGRA_UART_TX_DMA, so a later tegra_uart_stop_tx() still sees a DMA
transfer in flight and acks the descriptor that
dmaengine_terminate_all() freed. Ack the descriptor before terminating
there too, and clear tx_in_progress so that nothing touches it
afterwards. Only clear it for a DMA transfer: a PIO transfer still has
the THRI interrupt enabled and is finished by the ISR.

Acking before terminating keeps descriptors reusable on APB DMA, which
only recycles a descriptor once it has been acked.

Found by code inspection while fixing the analogous RX bug and through
Sashiko automated review (see Link below); not reproduced on hardware,
since triggering it requires stopping or flushing an in-flight TX DMA
transfer at the right moment.

The ordering has been wrong since the driver was added; it became a
use-after-free once serial-tegra could use the GPC DMA driver,
which frees descriptors on terminate.

Fixes: e9ea096dd225 ("serial: tegra: add serial driver")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/all/sashiko-outbox-172211@kernel.org/
Assisted-by: LLM
Signed-off-by: Austin Schlegel <schlegelas@outlook.com>
---
v3:
 - Also fix tegra_uart_flush_buffer(), which terminated the TX channel
   without clearing tx_in_progress, so a later tegra_uart_stop_tx()
   acked the freed descriptor (reported by Sashiko review of v2
   https://lore.kernel.org/all/sashiko-outbox-172211@kernel.org/).
 - The tegra_uart_tx_dma_complete() race reported in the same review
   is fixed separately in new patch 3/3.

v2:
 - Reworded commit: Removed inaccurate flush example
 - Switched to personal email (v1 sent from austin.schlegel@arthrex.com)

v1: https://lore.kernel.org/all/20261001-tty-linus-v1-2-ecb8576c802d@arthrex.com/
---
 drivers/tty/serial/serial-tegra.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/drivers/tty/serial/serial-tegra.c b/drivers/tty/serial/serial-tegra.c
index a23a92cebe0d..c179a09b8fe2 100644
--- a/drivers/tty/serial/serial-tegra.c
+++ b/drivers/tty/serial/serial-tegra.c
@@ -639,9 +639,9 @@ static void tegra_uart_stop_tx(struct uart_port *u)
 
 	dmaengine_pause(tup->tx_dma_chan);
 	dmaengine_tx_status(tup->tx_dma_chan, tup->tx_cookie, &state);
+	async_tx_ack(tup->tx_dma_desc);
 	dmaengine_terminate_all(tup->tx_dma_chan);
 	count = tup->tx_bytes_requested - state.residue;
-	async_tx_ack(tup->tx_dma_desc);
 	uart_xmit_advance(&tup->uport, count);
 	tup->tx_in_progress = 0;
 }
@@ -1275,8 +1275,14 @@ static void tegra_uart_flush_buffer(struct uart_port *u)
 	struct tegra_uart_port *tup = to_tegra_uport(u);
 
 	tup->tx_bytes = 0;
-	if (tup->tx_dma_chan)
+	if (tup->tx_dma_chan) {
+		if (tup->tx_in_progress == TEGRA_UART_TX_DMA) {
+			async_tx_ack(tup->tx_dma_desc);
+			tup->tx_in_progress = 0;
+		}
+
 		dmaengine_terminate_all(tup->tx_dma_chan);
+	}
 }
 
 static void tegra_uart_shutdown(struct uart_port *u)

-- 
2.53.0

[PATCH v3 3/3] serial: tegra: ignore stale DMA completion callbacks

[Austin Schlegel via B4 Relay]

From: Austin Schlegel <schlegelas@outlook.com>

The TX and RX DMA completion callbacks run from the DMA engine's
tasklet. tegra_uart_stop_tx(), tegra_uart_flush_buffer() and
tegra_uart_terminate_rx_dma() can stop the same transfer under the port
lock, and dmaengine_terminate_all() does not wait for a callback that
is already running. A callback can therefore be waiting on the port
lock for a transfer that the driver has already stopped and accounted
for.

tegra_uart_tx_dma_complete() reads the DMA status and acks the
descriptor before it takes the port lock, then advances the xmit FIFO
by the whole transfer and starts the next one unconditionally. If
tegra_uart_stop_tx() got there first, the bytes it already accounted
for are advanced a second time, skipping data that was never sent.
After tegra_uart_flush_buffer() the FIFO is empty and the advance runs
past it. If a new transfer was started in between, the stale callback
reads the new transfer's cookie, acks its descriptor and clears
tx_in_progress while that transfer is still running.

tegra_uart_rx_dma_complete() has the same problem: after
tegra_uart_terminate_rx_dma() has pushed the received data and cleared
rx_dma_active, the callback pushes the whole buffer again and restarts
RX DMA, even if RX has been stopped.

Take the port lock before looking at the transfer in the TX callback,
and in both callbacks return early unless the transfer is still the
driver's current one: tx_in_progress is still TEGRA_UART_TX_DMA and the
cookie is complete for TX, rx_dma_active is still set for RX. The stop
paths clear these flags under the port lock, and a transfer started
after them is normally still in progress, so the existing
DMA_IN_PROGRESS check in the RX callback and the new DMA_COMPLETE check
in the TX callback skip it. If it has already completed, the stale
callback handles it, and its own callback then finds it is no longer
current.

Found by Sashiko automated review (see Link below). Not reproduced on
hardware. Tested together with the rest of the series on Tegra234
(Jetson AGX Orin) with a UART loopback test that also stops and flushes
TX while DMA is running: no KFENCE reports and no data mismatches in a
10-minute run with kfence.sample_interval=1.

Fixes: e9ea096dd225 ("serial: tegra: add serial driver")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/all/sashiko-outbox-172211@kernel.org/
Assisted-by: LLM
Signed-off-by: Austin Schlegel <schlegelas@outlook.com>
---
v3:
 - New patch, addressing the Sashiko review of v2:
   https://sashiko.dev/#/patchset/20261014-serial-tegra-dma-uaf-v2-0-b142b31b67e3@outlook.com?part=1
---
 drivers/tty/serial/serial-tegra.c | 43 +++++++++++++++++++++++++++++++++++++--
 1 file changed, 41 insertions(+), 2 deletions(-)

diff --git a/drivers/tty/serial/serial-tegra.c b/drivers/tty/serial/serial-tegra.c
index c179a09b8fe2..6e1a67d83e0e 100644
--- a/drivers/tty/serial/serial-tegra.c
+++ b/drivers/tty/serial/serial-tegra.c
@@ -532,16 +532,39 @@ static void tegra_uart_tx_dma_complete(void *args)
 	struct dma_tx_state state;
 	unsigned long flags;
 	unsigned int count;
+	enum dma_status status;
+
+	uart_port_lock_irqsave(&tup->uport, &flags);
+
+	/*
+	 * dmaengine_terminate_all() does not wait for a callback that is
+	 * already running. If tegra_uart_stop_tx() or
+	 * tegra_uart_flush_buffer() stopped this transfer while we were
+	 * waiting for the port lock, they have already handled it and
+	 * cleared tx_in_progress, so there is nothing left to do.
+	 */
+	if (tup->tx_in_progress != TEGRA_UART_TX_DMA)
+		goto out;
+
+	/*
+	 * A new transfer may have been started after this one was stopped.
+	 * Its cookie is normally still in progress, so leave it to its own
+	 * callback. If it has already completed, handling it here is fine:
+	 * its own callback will then find it is no longer current.
+	 */
+	status = dmaengine_tx_status(tup->tx_dma_chan, tup->tx_cookie, &state);
+	if (status != DMA_COMPLETE)
+		goto out;
 
-	dmaengine_tx_status(tup->tx_dma_chan, tup->tx_cookie, &state);
 	count = tup->tx_bytes_requested - state.residue;
 	async_tx_ack(tup->tx_dma_desc);
-	uart_port_lock_irqsave(&tup->uport, &flags);
 	uart_xmit_advance(&tup->uport, count);
 	tup->tx_in_progress = 0;
 	if (kfifo_len(&tport->xmit_fifo) < WAKEUP_CHARS)
 		uart_write_wakeup(&tup->uport);
 	tegra_uart_start_next_tx(tup);
+
+out:
 	uart_port_unlock_irqrestore(&tup->uport, flags);
 }
 
@@ -748,6 +771,22 @@ static void tegra_uart_rx_dma_complete(void *args)
 
 	uart_port_lock_irqsave(u, &flags);
 
+	/*
+	 * dmaengine_terminate_all() does not wait for a callback that is
+	 * already running. If tegra_uart_terminate_rx_dma() stopped this
+	 * transfer while we were waiting for the port lock, it has already
+	 * pushed the received data and cleared rx_dma_active, so there is
+	 * nothing left to do.
+	 */
+	if (!tup->rx_dma_active)
+		goto done;
+
+	/*
+	 * A new transfer may have been started after this one was stopped.
+	 * Its cookie is normally still in progress, so leave it to its own
+	 * callback. If it has already completed, handling it here is fine:
+	 * its own callback will then find it is no longer current.
+	 */
 	status = dmaengine_tx_status(tup->rx_dma_chan, tup->rx_cookie, &state);
 
 	if (status == DMA_IN_PROGRESS) {

-- 
2.53.0

Re: [PATCH v3 0/3] serial: tegra: fix DMA descriptor use-after-free and stale completions

[Karl Mehltretter]

On Thu, Oct 22, 2026 at 05:10:23PM -0400, Austin Schlegel wrote:
> Patch 2 (TX) fixes the same ordering bug in tegra_uart_stop_tx().
> It also fixes tegra_uart_flush_buffer(), which terminated the TX
> channel without clearing tx_in_progress, so a later
> tegra_uart_stop_tx() acked the freed descriptor.
>
> The bugs fixed by patches 2 and 3 were found in review (Sashiko, on v2)
> and have not been reproduced on hardware.
...
> Testing was done on Tegra234 (Jetson AGX Orin) with GPC DMA only. The
> APB DMA driver (Tegra20-Tegra210) recycles descriptors only after they
> are acked; the series keeps every ack but has not been tested there.

Tested on Jetson Nano (Tegra210, 70006040.serial with tegra20-apb-dma)
in TIOCM_LOOP internal loopback mode on v7.3-rc2 (5b0764a53235):

- Unpatched: queuing a 4096-byte TX DMA transfer at 115200 baud and
  calling tcflush(fd, TCOFLUSH) 5 ms later leaves tup->tx_in_progress
  set to TEGRA_UART_TX_DMA. Subsequent write() calls see
  tup->tx_in_progress != 0 in tegra_uart_start_tx() and never start TX
  (0/48 bytes received on loopback, TIOCSER_TEMT == 0).
- With v3 applied: tcflush(fd, TCOFLUSH) during in-flight TX DMA clears
  tx_in_progress and the follow-up write() transmits (48/48 bytes
  received, TIOCSER_TEMT == 1). Twenty rounds of 3 Mbaud loopback
  transfers with mid-transfer TCOFLUSH and port close/reopen completed
  with no warnings.

Tested-by: Karl Mehltretter <kmehltretter@gmail.com>

Thanks,
Karl