In the RX DMA completion handler, the hrtimer was restarted before DMA was set up. If DMA failed, for some reason, it would clean up and the hrtimer would run into a NULL-pointer. Restart the timer after DMA was successfully set up. Reported-by: Dirk Behme <dirk.behme@xxxxxxxxxxxx> Closes: https://lore.kernel.org/r/ee6c9e16-9f29-450e-81da-4a8dceaa8fc7@xxxxxxxxxxxx Fixes: 67f462b069e9 ("serial: sh-sci: Get rid of the workqueue to handle receive DMA requests") Signed-off-by: Wolfram Sang <wsa+renesas@xxxxxxxxxxxxxxxxxxxx> --- drivers/tty/serial/sh-sci.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c index e512eaa57ed5..1e3c26c11c49 100644 --- a/drivers/tty/serial/sh-sci.c +++ b/drivers/tty/serial/sh-sci.c @@ -1325,8 +1325,6 @@ static void sci_dma_rx_complete(void *arg) if (active >= 0) count = sci_dma_rx_push(s, s->rx_buf[active], s->buf_len_rx); - start_hrtimer_us(&s->rx_timer, s->rx_timeout); - if (count) tty_flip_buffer_push(&port->state->port); @@ -1346,6 +1344,8 @@ static void sci_dma_rx_complete(void *arg) dma_async_issue_pending(chan); + start_hrtimer_us(&s->rx_timer, s->rx_timeout); + uart_port_unlock_irqrestore(port, flags); dev_dbg(port->dev, "%s: cookie %d #%d, new active cookie %d\n", __func__, s->cookie_rx[active], active, s->active_rx); -- 2.43.0
