> serial: Add auart driver for i.MX23/28 > > Signed-off-by: Sascha Hauer <s.hauer@xxxxxxxxxxxxxx> You have a few things that need fixing, one of which is quite nasty > + * Freescale STMP37XX/STMP378X Application UART driver > + * > + * Author: dmitry pervushin <dimka@xxxxxxxxxxxxxxxxx> So its signed off by one person and without a signature from the author ? Is that intentional And it git we have Author: Sascha Hauer <s.hauer@xxxxxxxxxxxxxx> which from the header block appears to be untrue ? > +static void mxs_auart_rx_chars(struct mxs_auart_port *s) > +{ > + struct tty_struct *tty = s->port.state->port.tty; > + u32 stat = 0; tty may be NULL at this point, in which case your code will try and push bits through a NULL pointer and crash A user can seek to make tty NULL at the right moment by judicious use of vhangup, and a remote device can use carrier signals and bit timing to mount an attack. See tty_port_tty_get() and/or hold the port lock over the IRQ as other drivers do. For the uart stuff I'd hold the port lock as the rest of the code in the uart layer sort of assumes that > +static void mxs_auart_settermios(struct uart_port *u, > + struct ktermios *termios, > + struct ktermios *old) Minor things here - You need to set the termios bits to reflect the mode you actually set. So as you don't seem to support mark/space you need to clear the bit, ditto h/w flow control if not supported - You also need to report back the actual baud rate > +static irqreturn_t mxs_auart_irq_handle(int irq, void *context) > +{ > + u32 istatus, istat; > + struct mxs_auart_port *s = context; > + u32 stat = readl(s->port.membase + AUART_STAT); Your IRQ handler either needs to take the port lock or have the underlying methods do that or their own full locking, you aren't doing that. -- To unsubscribe from this list: send the line "unsubscribe linux-serial" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html