Re: [PATCH v3 0/3] serial: tegra: fix DMA descriptor use-after-free and stale completions

[Karl Mehltretter]

On Thu, Oct 22, 2026 at 05:10:23PM -0400, Austin Schlegel wrote:
> Patch 2 (TX) fixes the same ordering bug in tegra_uart_stop_tx().
> It also fixes tegra_uart_flush_buffer(), which terminated the TX
> channel without clearing tx_in_progress, so a later
> tegra_uart_stop_tx() acked the freed descriptor.
>
> The bugs fixed by patches 2 and 3 were found in review (Sashiko, on v2)
> and have not been reproduced on hardware.
...
> Testing was done on Tegra234 (Jetson AGX Orin) with GPC DMA only. The
> APB DMA driver (Tegra20-Tegra210) recycles descriptors only after they
> are acked; the series keeps every ack but has not been tested there.

Tested on Jetson Nano (Tegra210, 70006040.serial with tegra20-apb-dma)
in TIOCM_LOOP internal loopback mode on v7.3-rc2 (5b0764a53235):

- Unpatched: queuing a 4096-byte TX DMA transfer at 115200 baud and
  calling tcflush(fd, TCOFLUSH) 5 ms later leaves tup->tx_in_progress
  set to TEGRA_UART_TX_DMA. Subsequent write() calls see
  tup->tx_in_progress != 0 in tegra_uart_start_tx() and never start TX
  (0/48 bytes received on loopback, TIOCSER_TEMT == 0).
- With v3 applied: tcflush(fd, TCOFLUSH) during in-flight TX DMA clears
  tx_in_progress and the follow-up write() transmits (48/48 bytes
  received, TIOCSER_TEMT == 1). Twenty rounds of 3 Mbaud loopback
  transfers with mid-transfer TCOFLUSH and port close/reopen completed
  with no warnings.

Tested-by: Karl Mehltretter <kmehltretter@xxxxxxxxx>

Thanks,
Karl