linux-kernel - Re: [PATCH] serial: imx: fix tx statemachine deadlock

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20231004102008.giyogvnsc26ucx4k@pengutronix.de>
Date:   Wed, 4 Oct 2023 12:20:08 +0200
From:   Uwe Kleine-König <u.kleine-koenig@...gutronix.de>
To:     Paul Geurts <paul_geurts@...e.nl>
Cc:     gregkh@...uxfoundation.org, jirislaby@...nel.org,
        shawnguo@...nel.org, s.hauer@...gutronix.de, kernel@...gutronix.de,
        festevam@...il.com, linux-imx@....com,
        linux-kernel@...r.kernel.org, linux-serial@...r.kernel.org,
        linux-arm-kernel@...ts.infradead.org
Subject: Re: [PATCH] serial: imx: fix tx statemachine deadlock

Hello Paul,

On Wed, Oct 04, 2023 at 11:57:22AM +0200, Paul Geurts wrote:
> When using the serial port as RS485 port, the tx statemachine is used to
> control the RTS pin to drive the RS485 transceiver TX_EN pin. When the
> TTY port is closed in the middle of a transmission (for instance during
> userland application crash), imx_uart_shutdown disables the interface
> and disables the Transmission Complete interrupt. afer that,
> imx_uart_stop_tx bails on an incomplete transmission, to be retriggered
> by the TC interrupt. This interrupt is disabled and therefore the tx
> statemachine never transitions out of SEND. The statemachine is in
> deadlock now, and the TX_EN remains low, making the interface useless.
> 
> imx_uart_stop_tx now checks for incomplete transmission AND whether TC
> interrupts are enabled before bailing to be retriggered. This makes sure
> the state machine handling is reached, and is properly set to
> WAIT_AFTER_SEND.

Sounds reasonable.

A Fixes: line would be nice.

> Signed-off-by: Paul Geurts <paul_geurts@...e.nl>
> ---
>  drivers/tty/serial/imx.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c
> index 13cb78340709..90a4b7841030 100644
> --- a/drivers/tty/serial/imx.c
> +++ b/drivers/tty/serial/imx.c
> @@ -421,13 +421,13 @@ static void imx_uart_stop_tx(struct uart_port *port)
>  	ucr1 = imx_uart_readl(sport, UCR1);
>  	imx_uart_writel(sport, ucr1 & ~UCR1_TRDYEN, UCR1);
>  
> +	ucr4 = imx_uart_readl(sport, UCR4);
>  	usr2 = imx_uart_readl(sport, USR2);
> -	if (!(usr2 & USR2_TXDC)) {
> +	if ((!(usr2 & USR2_TXDC)) && (ucr4 & UCR4_TCEN)) {
>  		/* The shifter is still busy, so retry once TC triggers */
>  		return;
>  	}

So the new thing is: If the hardware is still busy sending stuff but
/dev/ttymxcX isn't open any more (i.e. .shutdown was called), the
transmitter gets disabled. I wonder if in this case disabling the
transmitter should be delayed until the shifter is empty? Or maybe this
should be handled in .shutdown, that is only disable TCEN once the
shifter is empty?

Best regards
Uwe

-- 
Pengutronix e.K.                           | Uwe Kleine-König            |
Industrial Linux Solutions                 | https://www.pengutronix.de/ |

Download attachment "signature.asc" of type "application/pgp-signature" (489 bytes)