[PATCH v2] tty: serial: lpuart: Add port lock for registers read in lpuart32_set_termios()

[PATCH v2] tty: serial: lpuart: Add port lock for registers read in lpuart32_set_termios()

[Sherry Sun (OSS)]

From: Sherry Sun <sherry.sun@nxp.com>

lpuart32_set_termios() reads UARTCTRL at function entry without holding
the port lock. lpuart32_console_write() can run concurrently on another
CPU and temporarily clears the RIE (Receiver Interrupt Enable) bit while
it polls characters out. If the unlocked read in set_termios lands inside
that window, the stale snapshot is written back, permanently clearing
RIE. Once lost, no normal code path re-enables them, so the UART stops
receiving characters and becomes unresponsive.

Need to add port lock for the registers read in lpuart32_set_termios() to
avoid the unlocked snapshot captured. Since neither uart_get_baud_rate()
nor lpuart_dma_rx_free() uses ctrl, old_ctrl, bd, or modem, the register
reads and bit manipulations could be moved into the existing
uart_port_lock_irqsave() critical section after lpuart_dma_rx_free().

Please note that this only fix the normal printk path, in the
oops_in_progress path of lpuart32_console_write(), when trylock fails,
RIE is cleared and old_cr restored without the port lock held, there is
still a risk of stale snapshot, but it's acceptable for the post-oops
state and the trylock-fail window.

Fixes: 380c966c093e ("tty: serial: fsl_lpuart: add 32-bit register interface support")
Signed-off-by: Sherry Sun <sherry.sun@nxp.com>
---
Changes in v2:
- As suggested by Sashiko, since neither uart_get_baud_rate() nor
  lpuart_dma_rx_free() uses ctrl, old_ctrl, bd, or modem, move the
  register reads and bit manipulations into the existing
  uart_port_lock_irqsave() critical section after lpuart_dma_rx_free().
- Link to v1: https://lore.kernel.org/r/20261111-lpuart_port_lock-v1-1-5d332c51edfe@nxp.com
---
 drivers/tty/serial/fsl_lpuart.c | 29 ++++++++++++++---------------
 1 file changed, 14 insertions(+), 15 deletions(-)

diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
index cd2575a3aef7..074bd9d42f84 100644
--- a/drivers/tty/serial/fsl_lpuart.c
+++ b/drivers/tty/serial/fsl_lpuart.c
@@ -2241,6 +2241,20 @@ lpuart32_set_termios(struct uart_port *port, struct ktermios *termios,
 	unsigned int  baud;
 	unsigned int old_csize = old ? old->c_cflag & CSIZE : CS8;
 
+	/* ask the core to calculate the divisor */
+	baud = uart_get_baud_rate(port, termios, old, 50, port->uartclk / 4);
+
+	/*
+	 * Need to update the Ring buffer length according to the selected
+	 * baud rate and restart Rx DMA path.
+	 *
+	 * Since timer function acqures port->lock, need to stop before
+	 * acquring same lock because otherwise timer_delete_sync() can deadlock.
+	 */
+	if (old && sport->lpuart_dma_rx_use)
+		lpuart_dma_rx_free(port);
+
+	uart_port_lock_irqsave(port, &flags);
 	ctrl = old_ctrl = lpuart32_read(port, UARTCTRL);
 	bd = lpuart32_read(port, UARTBAUD);
 	modem = lpuart32_read(port, UARTMODIR);
@@ -2320,21 +2334,6 @@ lpuart32_set_termios(struct uart_port *port, struct ktermios *termios,
 		ctrl &= ~UARTCTRL_PE;
 	}
 
-	/* ask the core to calculate the divisor */
-	baud = uart_get_baud_rate(port, termios, old, 50, port->uartclk / 4);
-
-	/*
-	 * Need to update the Ring buffer length according to the selected
-	 * baud rate and restart Rx DMA path.
-	 *
-	 * Since timer function acqures port->lock, need to stop before
-	 * acquring same lock because otherwise timer_delete_sync() can deadlock.
-	 */
-	if (old && sport->lpuart_dma_rx_use)
-		lpuart_dma_rx_free(port);
-
-	uart_port_lock_irqsave(port, &flags);
-
 	port->read_status_mask = 0;
 	if (termios->c_iflag & INPCK)
 		port->read_status_mask |= UARTSTAT_FE | UARTSTAT_PE;

---
base-commit: 793807ca13bf3072fc6d16ce6d90e9ab9beff2a5
change-id: 20261111-lpuart_port_lock-01f7deab451a

Best regards,
-- 
Sherry Sun <sherry.sun@nxp.com>

Re: [PATCH v2] tty: serial: lpuart: Add port lock for registers read in lpuart32_set_termios()

[Daniel Baluta]

On 11/12/26 05:19, Sherry Sun (OSS) wrote:
> From: Sherry Sun <sherry.sun@nxp.com>
> 
> lpuart32_set_termios() reads UARTCTRL at function entry without holding
> the port lock. lpuart32_console_write() can run concurrently on another
> CPU and temporarily clears the RIE (Receiver Interrupt Enable) bit while
> it polls characters out. If the unlocked read in set_termios lands inside
> that window, the stale snapshot is written back, permanently clearing
> RIE. Once lost, no normal code path re-enables them, so the UART stops
> receiving characters and becomes unresponsive.
> 
> Need to add port lock for the registers read in lpuart32_set_termios() to
> avoid the unlocked snapshot captured. Since neither uart_get_baud_rate()
> nor lpuart_dma_rx_free() uses ctrl, old_ctrl, bd, or modem, the register
> reads and bit manipulations could be moved into the existing
> uart_port_lock_irqsave() critical section after lpuart_dma_rx_free().
> 
> Please note that this only fix the normal printk path, in the
> oops_in_progress path of lpuart32_console_write(), when trylock fails,
> RIE is cleared and old_cr restored without the port lock held, there is
> still a risk of stale snapshot, but it's acceptable for the post-oops
> state and the trylock-fail window.
> 
> Fixes: 380c966c093e ("tty: serial: fsl_lpuart: add 32-bit register interface support")
> Signed-off-by: Sherry Sun <sherry.sun@nxp.com>
> ---
> Changes in v2:
> - As suggested by Sashiko, since neither uart_get_baud_rate() nor
>   lpuart_dma_rx_free() uses ctrl, old_ctrl, bd, or modem, move the
>   register reads and bit manipulations into the existing
>   uart_port_lock_irqsave() critical section after lpuart_dma_rx_free().
> - Link to v1: https://lore.kernel.org/r/20261111-lpuart_port_lock-v1-1-5d332c51edfe@nxp.com
> ---
>  drivers/tty/serial/fsl_lpuart.c | 29 ++++++++++++++---------------
>  1 file changed, 14 insertions(+), 15 deletions(-)
> 
> diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
> index cd2575a3aef7..074bd9d42f84 100644
> --- a/drivers/tty/serial/fsl_lpuart.c
> +++ b/drivers/tty/serial/fsl_lpuart.c
> @@ -2241,6 +2241,20 @@ lpuart32_set_termios(struct uart_port *port, struct ktermios *termios,
>  	unsigned int  baud;
>  	unsigned int old_csize = old ? old->c_cflag & CSIZE : CS8;
>  
> +	/* ask the core to calculate the divisor */
> +	baud = uart_get_baud_rate(port, termios, old, 50, port->uartclk / 4);
> +
> +	/*
> +	 * Need to update the Ring buffer length according to the selected
> +	 * baud rate and restart Rx DMA path.

While you are here please fix the typo. s/acqures/acquires.> +	 *
> +	 * Since timer function acqures port->lock, need to stop before
> +	 * acquring same lock because otherwise timer_delete_sync() can deadlock.
> +	 */
> +	if (old && sport->lpuart_dma_rx_use)
> +		lpuart_dma_rx_free(port);
> +
> +	uart_port_lock_irqsave(port, &flags);
>  	ctrl = old_ctrl = lpuart32_read(port, UARTCTRL);
>  	bd = lpuart32_read(port, UARTBAUD);
>  	modem = lpuart32_read(port, UARTMODIR);
> @@ -2320,21 +2334,6 @@ lpuart32_set_termios(struct uart_port *port, struct ktermios *termios,
>  		ctrl &= ~UARTCTRL_PE;
>  	}
>  
> -	/* ask the core to calculate the divisor */
> -	baud = uart_get_baud_rate(port, termios, old, 50, port->uartclk / 4);
> -
> -	/*
> -	 * Need to update the Ring buffer length according to the selected
> -	 * baud rate and restart Rx DMA path.
> -	 *
> -	 * Since timer function acqures port->lock, need to stop before
> -	 * acquring same lock because otherwise timer_delete_sync() can deadlock.
> -	 */
> -	if (old && sport->lpuart_dma_rx_use)
> -		lpuart_dma_rx_free(port);
> -
> -	uart_port_lock_irqsave(port, &flags);
> -
>  	port->read_status_mask = 0;
>  	if (termios->c_iflag & INPCK)
>  		port->read_status_mask |= UARTSTAT_FE | UARTSTAT_PE;
> 
> ---
> base-commit: 793807ca13bf3072fc6d16ce6d90e9ab9beff2a5
> change-id: 20261111-lpuart_port_lock-01f7deab451a
> 
> Best regards,