Re: [PATCH 1/2] serial: core: do not hold the port mutex while waiting for references

[Johan Hovold <johan@kernel.org>]

On Wed, Nov 04, 2026 at 10:27:15AM +0000, Tapio Reijonen wrote:
> serial_core_remove_one_port() takes the port mutex and then waits for
> the uart_port_ref() holders to drop their references. Since commit
> 8ca59f7baee7 ("serial: fix ioctl hangup race") uart_wait_until_sent()
> takes the port mutex on every poll iteration to check for the hangup
> before it touches the hardware, while holding its reference for the
> whole wait. A tcdrain() in flight when the port is removed therefore
> deadlocks: the removal holds the mutex and waits for the reference,
> the drain holds the reference and waits for the mutex. Both tasks sit
> uninterruptible, and the port is unusable until a reboot.
> 
> Reproduced by unbinding a UART driver while a process drains a few
> kilobytes at 300 baud: the unbind blocks in wait_event() under the
> mutex, the drain in mutex_lock(), and reading the driver's proc file
> blocks on the same mutex.
> 
> Drop the mutex around the decrement and the wait. The decrement is an
> atomic paired with uart_port_ref() and uart_port_deref(), which never
> take the mutex; the clearing of the port pointer stays under it, where
> uart_port_check() readers expect it. Between the hangup and this wait
> the removal already runs without the mutex, so a mutex holder seeing
> the released port is not a new state.
> uart_wait_modem_status() takes a reference and then the mutex in the
> same way, with a smaller window, and is covered by the same change.

Thanks for catching this. I can reproduce it here as well, and we should
fix it even this is hardly something anyone would hit during any kind of
normal use.

> Stable trees before the guard() conversion of this function need the
> same change with explicit calls: mutex_unlock() before the
> wait_event(), mutex_lock() around the store of the port pointer.
> 7.3.y has the guard() form and takes the patch with a three-way
> merge.

Right, the guard conversion makes any backport a bit harder, but that's
something for the stable team to deal with. So you can drop this
paragraph.

> Fixes: 8ca59f7baee7 ("serial: fix ioctl hangup race")
> Cc: <stable@vger.kernel.org> # 6.18.y and older need the open-coded form, see below

And just drop the comment here, and if you want to help, send a backport
when the fix fails to apply to older trees.

> Signed-off-by: Tapio Reijonen <tapio.reijonen@vaisala.com>

Reviewed-by: Johan Hovold <johan@kernel.org>
Tested-by: Johan Hovold <johan@kernel.org>

Johan