linux-kernel - Re: [PATCH] serial: 8250: fix panic due to PSLVERR

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Z-56wshiZz_1wU__@smile.fi.intel.com>
Date: Thu, 3 Apr 2025 15:10:42 +0300
From: Andy Shevchenko <andriy.shevchenko@...ux.intel.com>
To: John Ogness <john.ogness@...utronix.de>
Cc: Yunhui Cui <cuiyunhui@...edance.com>, gregkh@...uxfoundation.org,
	jirislaby@...nel.org, pmladek@...e.com, arnd@...db.de,
	namcao@...utronix.de, benjamin.larsson@...exis.eu,
	schnelle@...ux.ibm.com, linux-kernel@...r.kernel.org,
	linux-serial@...r.kernel.org
Subject: Re: [PATCH] serial: 8250: fix panic due to PSLVERR

On Thu, Apr 03, 2025 at 02:03:58PM +0206, John Ogness wrote:
> On 2025-04-03, Yunhui Cui <cuiyunhui@...edance.com> wrote:
> > When the PSLVERR_RESP_EN parameter is set to 1, the device generates
> > an error response if an attempt is made to read an empty RBR (Receive
> > Buffer Register) while the FIFO is enabled.
> >
> > In serial8250_do_startup, calling serial_port_out(port, UART_LCR,
> > UART_LCR_WLEN8) triggers dw8250_check_lcr(), which invokes
> > dw8250_force_idle() and serial8250_clear_and_reinit_fifos(). The latter
> > function enables the FIFO via serial_out(p, UART_FCR, p->fcr).
> > Execution proceeds to the dont_test_tx_en label:
> > ...
> > serial_port_in(port, UART_RX);
> > This satisfies the PSLVERR trigger condition.
> >
> > Because another CPU(e.g., using printk) is accessing the UART (UART
> > is busy), the current CPU fails the check (value & ~UART_LCR_SPAR) ==
> > (lcr & ~UART_LCR_SPAR), causing it to enter dw8250_force_idle().
> 
> Didn't this[0] patch resolve this exact issue?

I see it applied (in v6.0), but version in the traceback seems from v6.12.
I think this is about race condition so only locking parts should suffice.

> [0] https://lore.kernel.org/lkml/20220713131722.2316829-1-vamshigajjela@google.com

-- 
With Best Regards,
Andy Shevchenko