There's a potential race before THRE/TEMT deasserts when DMA Tx is
starting up (or the next batch of continuous Tx is being submitted).
This can lead to misdetecting Tx empty condition.
It is entirely normal for THRE/TEMT to be set for some time after the
DMA Tx had been setup in serial8250_tx_dma(). As Tx side is definitely
not empty at that point, it seems incorrect for serial8250_tx_empty()
claim Tx is empty.
Fix the race by also checking in serial8250_tx_empty() whether there's
DMA Tx active.
Note: This fix only addresses in-kernel race mainly to make using
TCSADRAIN/FLUSH robust. Userspace can still cause other races but they
seem userspace concurrency control problems.
Fixes: 9ee4b83e51f74 ("serial: 8250: Add support for dmaengine")
Cc: stable(a)vger.kernel.org
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com>
---
drivers/tty/serial/8250/8250.h | 12 ++++++++++++
drivers/tty/serial/8250/8250_port.c | 7 ++++++-
2 files changed, 18 insertions(+), 1 deletion(-)
diff --git a/drivers/tty/serial/8250/8250.h b/drivers/tty/serial/8250/8250.h
index 287153d32536..1e8fe44a7099 100644
--- a/drivers/tty/serial/8250/8250.h
+++ b/drivers/tty/serial/8250/8250.h
@@ -365,6 +365,13 @@ static inline void serial8250_do_prepare_rx_dma(struct uart_8250_port *p)
if (dma->prepare_rx_dma)
dma->prepare_rx_dma(p);
}
+
+static inline bool serial8250_tx_dma_running(struct uart_8250_port *p)
+{
+ struct uart_8250_dma *dma = p->dma;
+
+ return dma && dma->tx_running;
+}
#else
static inline int serial8250_tx_dma(struct uart_8250_port *p)
{
@@ -380,6 +387,11 @@ static inline int serial8250_request_dma(struct uart_8250_port *p)
return -1;
}
static inline void serial8250_release_dma(struct uart_8250_port *p) { }
+
+static inline bool serial8250_tx_dma_running(struct uart_8250_port *p)
+{
+ return false;
+}
#endif
static inline int ns16550a_goto_highspeed(struct uart_8250_port *up)
diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c
index fa43df05342b..4954c4f15fb2 100644
--- a/drivers/tty/serial/8250/8250_port.c
+++ b/drivers/tty/serial/8250/8250_port.c
@@ -2006,17 +2006,22 @@ static unsigned int serial8250_tx_empty(struct uart_port *port)
{
struct uart_8250_port *up = up_to_u8250p(port);
unsigned long flags;
+ bool dma_tx_running;
u16 lsr;
serial8250_rpm_get(up);
spin_lock_irqsave(&port->lock, flags);
lsr = serial_lsr_in(up);
+ dma_tx_running = serial8250_tx_dma_running(up);
spin_unlock_irqrestore(&port->lock, flags);
serial8250_rpm_put(up);
- return uart_lsr_tx_empty(lsr) ? TIOCSER_TEMT : 0;
+ if (uart_lsr_tx_empty(lsr) && !dma_tx_running)
+ return TIOCSER_TEMT;
+
+ return 0;
}
unsigned int serial8250_do_get_mctrl(struct uart_port *port)
--
2.30.2
This is the start of the stable review cycle for the 5.4.237 release.
There are 55 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Sat, 18 Mar 2023 08:33:04 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.237-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.4.237-rc2
Stefan Haberland <sth(a)linux.ibm.com>
s390/dasd: add missing discipline function
Masahiro Yamada <masahiroy(a)kernel.org>
UML: define RUNTIME_DISCARD_EXIT
Tom Saeger <tom.saeger(a)oracle.com>
sh: define RUNTIME_DISCARD_EXIT
Masahiro Yamada <masahiroy(a)kernel.org>
s390: define RUNTIME_DISCARD_EXIT to fix link error with GNU ld < 2.36
Michael Ellerman <mpe(a)ellerman.id.au>
powerpc/vmlinux.lds: Don't discard .rela* for relocatable builds
Michael Ellerman <mpe(a)ellerman.id.au>
powerpc/vmlinux.lds: Define RUNTIME_DISCARD_EXIT
Masahiro Yamada <masahiroy(a)kernel.org>
arch: fix broken BuildID for arm64 and riscv
H.J. Lu <hjl.tools(a)gmail.com>
x86, vmlinux.lds: Add RUNTIME_DISCARD_EXIT to generic DISCARDS
John Harrison <John.C.Harrison(a)Intel.com>
drm/i915: Don't use BAR mappings for ring buffers with LLC
Corey Minyard <cminyard(a)mvista.com>
ipmi:watchdog: Set panic count to proper value on a panic
Yejune Deng <yejune.deng(a)gmail.com>
ipmi/watchdog: replace atomic_add() and atomic_sub()
Paul Elder <paul.elder(a)ideasonboard.com>
media: ov5640: Fix analogue gain control
Alvaro Karsz <alvaro.karsz(a)solid-run.com>
PCI: Add SolidRun vendor ID
Nathan Chancellor <nathan(a)kernel.org>
macintosh: windfarm: Use unsigned type for 1-bit bitfields
Edward Humes <aurxenon(a)lunos.org>
alpha: fix R_ALPHA_LITERAL reloc for large modules
xurui <xurui(a)kylinos.cn>
MIPS: Fix a compilation issue
Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org>
clk: qcom: mmcc-apq8084: remove spdm clocks
Jan Kara <jack(a)suse.cz>
ext4: Fix deadlock during directory rename
Alexandre Ghiti <alexghiti(a)rivosinc.com>
riscv: Use READ_ONCE_NOCHECK in imprecise unwinding stack mode
D. Wythe <alibuda(a)linux.alibaba.com>
net/smc: fix fallback failed while sendmsg with fastopen
Chandrakanth Patil <chandrakanth.patil(a)broadcom.com>
scsi: megaraid_sas: Update max supported LD IDs to 240
Lorenz Bauer <lorenz.bauer(a)isovalent.com>
btf: fix resolving BTF_KIND_VAR after ARRAY, STRUCT, UNION, PTR
Florian Westphal <fw(a)strlen.de>
netfilter: tproxy: fix deadlock due to missing BH disable
Michael Chan <michael.chan(a)broadcom.com>
bnxt_en: Avoid order-5 memory allocation for TPA data
Shigeru Yoshida <syoshida(a)redhat.com>
net: caif: Fix use-after-free in cfusbl_device_notify()
Yuiko Oshino <yuiko.oshino(a)microchip.com>
net: lan78xx: fix accessing the LAN7800's internal phy specific registers from the MAC driver
Lee Jones <lee.jones(a)linaro.org>
net: usb: lan78xx: Remove lots of set but unused 'ret' variables
Hangbin Liu <liuhangbin(a)gmail.com>
selftests: nft_nat: ensuring the listening side is up before starting the client
Eric Dumazet <edumazet(a)google.com>
ila: do not generate empty messages in ila_xlat_nl_cmd_get_mapping()
Kang Chen <void0red(a)gmail.com>
nfc: fdp: add null check of devm_kmalloc_array in fdp_nci_i2c_read_device_properties
Dmitry Baryshkov <dmitry.baryshkov(a)linaro.org>
drm/msm/a5xx: fix setting of the CP_PREEMPT_ENABLE_LOCAL register
Jan Kara <jack(a)suse.cz>
ext4: Fix possible corruption when moving a directory
Bart Van Assche <bvanassche(a)acm.org>
scsi: core: Remove the /proc/scsi/${proc_name} directory earlier
Volker Lendecke <vl(a)samba.org>
cifs: Fix uninitialized memory read in smb3_qfs_tcon()
Amir Goldstein <amir73il(a)gmail.com>
SMB3: Backup intent flag missing from some more ops
Jacob Pan <jacob.jun.pan(a)linux.intel.com>
iommu/vt-d: Fix PASID directory pointer coherency
Marc Zyngier <maz(a)kernel.org>
irqdomain: Fix domain registration race
Bixuan Cui <cuibixuan(a)huawei.com>
irqdomain: Change the type of 'size' in __irq_domain_add() to be consistent
Corey Minyard <cminyard(a)mvista.com>
ipmi:ssif: Add a timer between request retries
Corey Minyard <cminyard(a)mvista.com>
ipmi:ssif: Increase the message retry time
Corey Minyard <cminyard(a)mvista.com>
ipmi:ssif: Remove rtc_us_timer
Corey Minyard <cminyard(a)mvista.com>
ipmi:ssif: resend_msg() cannot fail
Liguang Zhang <zhangliguang(a)linux.alibaba.com>
ipmi:ssif: make ssif_i2c_send() void
Gavrilov Ilia <Ilia.Gavrilov(a)infotecs.ru>
iommu/amd: Add a length limitation for the ivrs_acpihid command-line parameter
Kim Phillips <kim.phillips(a)amd.com>
iommu/amd: Fix ill-formed ivrs_ioapic, ivrs_hpet and ivrs_acpihid options
Suravee Suthikulpanit <suravee.suthikulpanit(a)amd.com>
iommu/amd: Add PCI segment support for ivrs_[ioapic/hpet/acpihid] commands
Fedor Pchelkin <pchelkin(a)ispras.ru>
nfc: change order inside nfc_se_io error path
Zhihao Cheng <chengzhihao1(a)huawei.com>
ext4: zero i_disksize when initializing the bootloader inode
Ye Bin <yebin10(a)huawei.com>
ext4: fix WARNING in ext4_update_inline_data
Ye Bin <yebin10(a)huawei.com>
ext4: move where set the MAY_INLINE_DATA flag is set
Darrick J. Wong <djwong(a)kernel.org>
ext4: fix another off-by-one fsmap error on 1k block filesystems
Eric Whitney <enwlinux(a)gmail.com>
ext4: fix RENAME_WHITEOUT handling for inline directories
Harry Wentland <harry.wentland(a)amd.com>
drm/connector: print max_requested_bpc in state debugfs
Andrew Cooper <andrew.cooper3(a)citrix.com>
x86/CPU/AMD: Disable XSAVES on AMD family 0x17
Theodore Ts'o <tytso(a)mit.edu>
fs: prevent out-of-bounds array speculation when closing a file descriptor
-------------
Diffstat:
Documentation/admin-guide/kernel-parameters.txt | 51 ++++-
Makefile | 4 +-
arch/alpha/kernel/module.c | 4 +-
arch/mips/include/asm/mach-rc32434/pci.h | 2 +-
arch/powerpc/kernel/vmlinux.lds.S | 6 +-
arch/riscv/kernel/stacktrace.c | 2 +-
arch/s390/kernel/vmlinux.lds.S | 2 +
arch/sh/kernel/vmlinux.lds.S | 1 +
arch/um/kernel/vmlinux.lds.S | 2 +-
arch/x86/kernel/cpu/amd.c | 9 +
arch/x86/kernel/vmlinux.lds.S | 2 +
drivers/char/ipmi/ipmi_ssif.c | 146 +++++--------
drivers/char/ipmi/ipmi_watchdog.c | 8 +-
drivers/clk/qcom/mmcc-apq8084.c | 271 ------------------------
drivers/gpu/drm/drm_atomic.c | 1 +
drivers/gpu/drm/i915/gt/intel_ringbuffer.c | 4 +-
drivers/gpu/drm/msm/adreno/a5xx_gpu.c | 4 +-
drivers/iommu/amd_iommu_init.c | 105 ++++++---
drivers/iommu/intel-pasid.c | 7 +
drivers/macintosh/windfarm_lm75_sensor.c | 4 +-
drivers/macintosh/windfarm_smu_sensors.c | 4 +-
drivers/media/i2c/ov5640.c | 2 +-
drivers/net/ethernet/broadcom/bnxt/bnxt.c | 23 +-
drivers/net/phy/microchip.c | 32 +++
drivers/net/usb/lan78xx.c | 189 +++++++----------
drivers/nfc/fdp/i2c.c | 4 +
drivers/s390/block/dasd_diag.c | 7 +-
drivers/s390/block/dasd_fba.c | 7 +-
drivers/s390/block/dasd_int.h | 1 -
drivers/scsi/hosts.c | 2 +
drivers/scsi/megaraid/megaraid_sas.h | 2 +
drivers/scsi/megaraid/megaraid_sas_fp.c | 2 +-
fs/cifs/cifsacl.c | 14 +-
fs/cifs/cifsfs.c | 2 +-
fs/cifs/cifsglob.h | 6 +-
fs/cifs/cifsproto.h | 8 +
fs/cifs/connect.c | 2 +-
fs/cifs/dir.c | 5 +-
fs/cifs/file.c | 10 +-
fs/cifs/inode.c | 8 +-
fs/cifs/ioctl.c | 2 +-
fs/cifs/link.c | 18 +-
fs/cifs/smb1ops.c | 19 +-
fs/cifs/smb2inode.c | 9 +-
fs/cifs/smb2ops.c | 92 +++-----
fs/cifs/smb2proto.h | 2 +-
fs/ext4/fsmap.c | 2 +
fs/ext4/inline.c | 1 -
fs/ext4/inode.c | 7 +-
fs/ext4/ioctl.c | 1 +
fs/ext4/namei.c | 36 +++-
fs/ext4/xattr.c | 3 +
fs/file.c | 1 +
include/asm-generic/vmlinux.lds.h | 16 +-
include/linux/irqdomain.h | 2 +-
include/linux/pci_ids.h | 2 +
include/net/netfilter/nf_tproxy.h | 7 +
kernel/bpf/btf.c | 1 +
kernel/irq/irqdomain.c | 62 ++++--
net/caif/caif_usb.c | 3 +
net/ipv4/netfilter/nf_tproxy_ipv4.c | 2 +-
net/ipv6/ila/ila_xlat.c | 1 +
net/ipv6/netfilter/nf_tproxy_ipv6.c | 2 +-
net/nfc/netlink.c | 2 +-
net/smc/af_smc.c | 13 +-
tools/testing/selftests/netfilter/nft_nat.sh | 2 +
66 files changed, 558 insertions(+), 715 deletions(-)