[PATCH v2 0/3] serial: amba-pl011: fix RS485 and DMA teardown

[Fan Wu]

Hi Greg,

v2 shortens the changelogs and reworks the RS485 fix as you asked.

  1: fix an indefinite RS485 post-send-delay hrtimer rearm
  2: fix a use-after-free of the RS485 trigger hrtimers on teardown
  3: fix a use-after-free of the DMA buffers on teardown

The hrtimers are embedded in the devm-managed port. The IRQ handler can
arm a timer, so patch 2 frees the IRQ before cancelling them. Patch 1
goes first because the rearm it fixes is what keeps the timer armed.

I read the sashiko.dev review [1]. All six points it raises are valid;
this series addresses each:

  - the lockless pl011_rs485_tx_stop() in shutdown racing the hrtimer
    callback, and a TX interrupt re-arming a timer after it was cancelled:
    patch 2 stops under the port lock and frees the IRQ first.
  - cancelling the timer before it fires left rs485_tx_state stuck at
    WAIT_AFTER_SEND, so the next open skipped the RS485 TX setup: patch 2
    finishes the stop with pl011_rs485_tx_stop_now(), resetting the state.
  - the post-send-delay timer rearming indefinitely: patch 1.
  - the RX poll timer and the TX DMA callback touching freed buffers:
    patch 3.

Changes since v1:
  - split into three patches and shortened the changelogs
  - free the IRQ before cancelling the hrtimers (v1 cancelled first)
  - add the post-send-delay (1) and DMA (3) fixes

v1: https://lore.kernel.org/all/20260721042858.3187311-1-fanwu01@xxxxxxxxxx/

[1] https://sashiko.dev/#/patchset/20260721042858.3187311-1-fanwu01@xxxxxxxxxx

---

 drivers/tty/serial/amba-pl011.c | 45 +++++++++++++++++++++++++++---------------
 1 file changed, 45 insertions(+), 23 deletions(-)

--
2.34.1