serial: sh-sci: Fix TX DMA buffer flushing and workqueue races [Linux 4.9.187]

This Linux kernel change "serial: sh-sci: Fix TX DMA buffer flushing and workqueue races" is included in the Linux 4.9.187 release. This change is authored by Geert Uytterhoeven <geert+renesas [at]> on Mon Jun 24 14:35:39 2019 +0200. The commit for this change in Linux stable tree is 7e55003 (patch) which is from upstream commit 8493eab. The same Linux upstream change may have been applied to various maintained Linux releases and you can find all Linux releases containing changes from upstream 8493eab.

serial: sh-sci: Fix TX DMA buffer flushing and workqueue races

[ Upstream commit 8493eab02608b0e82f67b892aa72882e510c31d0 ]

When uart_flush_buffer() is called, the .flush_buffer() callback zeroes
the tx_dma_len field.  This may race with the work queue function
handling transmit DMA requests:

  1. If the buffer is flushed before the first DMA API call,
     dmaengine_prep_slave_single() may be called with a zero length,
     causing the DMA request to never complete, leading to messages

        rcar-dmac e7300000.dma-controller: Channel Address Error happen

     and, with debug enabled:

    sh-sci e6e88000.serial: sci_dma_tx_work_fn: ffff800639b55000: 0...0, cookie 126

     and DMA timeouts.

  2. If the buffer is flushed after the first DMA API call, but before
     the second, dma_sync_single_for_device() may be called with a zero
     length, causing the transmit data not to be flushed to RAM, and
     leading to stale data being output.

Fix this by:
  1. Letting sci_dma_tx_work_fn() return immediately if the transmit
     buffer is empty,
  2. Extending the critical section to cover all DMA preparational work,
     so tx_dma_len stays consistent for all of it,
  3. Using local copies of circ_buf.head and circ_buf.tail, to make sure
     they match the actual operation above.

Reported-by: Eugeniu Rosca <[email protected]>
Suggested-by: Yoshihiro Shimoda <[email protected]>
Signed-off-by: Geert Uytterhoeven <[email protected]>
Reviewed-by: Eugeniu Rosca <[email protected]>
Tested-by: Eugeniu Rosca <[email protected]>
Link:[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>

There are 22 lines of Linux source code added/deleted in this change. Code changes to Linux kernel are as follows.

 drivers/tty/serial/sh-sci.c | 22 +++++++++++++++-------
 1 file changed, 15 insertions(+), 7 deletions(-)

diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
index 8ec8b3b..ea35f51 100644
--- a/drivers/tty/serial/sh-sci.c
+++ b/drivers/tty/serial/sh-sci.c
@@ -1291,6 +1291,7 @@ static void work_fn_tx(struct work_struct *work)
    struct uart_port *port = &s->port;
    struct circ_buf *xmit = &port->state->xmit;
    dma_addr_t buf;
+   int head, tail;

     * DMA is idle now.
@@ -1300,16 +1301,23 @@ static void work_fn_tx(struct work_struct *work)
     * consistent xmit buffer state.
-   buf = s->tx_dma_addr + (xmit->tail & (UART_XMIT_SIZE - 1));
+   head = xmit->head;
+   tail = xmit->tail;
+   buf = s->tx_dma_addr + (tail & (UART_XMIT_SIZE - 1));
    s->tx_dma_len = min_t(unsigned int,
-       CIRC_CNT(xmit->head, xmit->tail, UART_XMIT_SIZE),
-       CIRC_CNT_TO_END(xmit->head, xmit->tail, UART_XMIT_SIZE));
-   spin_unlock_irq(&port->lock);
+       CIRC_CNT(head, tail, UART_XMIT_SIZE),
+       CIRC_CNT_TO_END(head, tail, UART_XMIT_SIZE));
+   if (!s->tx_dma_len) {
+       /* Transmit buffer has been flushed */
+       spin_unlock_irq(&port->lock);
+       return;
+   }

    desc = dmaengine_prep_slave_single(chan, buf, s->tx_dma_len,
                       DMA_PREP_INTERRUPT | DMA_CTRL_ACK);
    if (!desc) {
+       spin_unlock_irq(&port->lock);
        dev_warn(port->dev, "Failed preparing Tx DMA descriptor\n");
        /* switch to PIO */
        sci_tx_dma_release(s, true);
@@ -1319,20 +1327,20 @@ static void work_fn_tx(struct work_struct *work)
    dma_sync_single_for_device(chan->device->dev, buf, s->tx_dma_len,

-   spin_lock_irq(&port->lock);
    desc->callback = sci_dma_tx_complete;
    desc->callback_param = s;
-   spin_unlock_irq(&port->lock);
    s->cookie_tx = dmaengine_submit(desc);
    if (dma_submit_error(s->cookie_tx)) {
+       spin_unlock_irq(&port->lock);
        dev_warn(port->dev, "Failed submitting Tx DMA descriptor\n");
        /* switch to PIO */
        sci_tx_dma_release(s, true);

+   spin_unlock_irq(&port->lock);
    dev_dbg(port->dev, "%s: %p: %d...%d, cookie %d\n",
-       __func__, xmit->buf, xmit->tail, xmit->head, s->cookie_tx);
+       __func__, xmit->buf, tail, head, s->cookie_tx);


Leave a Reply

Your email address will not be published. Required fields are marked *