This is a note to let you know that I've just added the patch titled
serial: 8250: fix potential deadlock in rs485-mode
to the 4.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
serial-8250-fix-potential-deadlock-in-rs485-mode.patch
and it can be found in the queue-4.14 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
commit 0c2d60da50179b7cf9fd2482e1e4083aa6de969a
Author: Tomas Melin <tomas.melin@xxxxxxxxxxx>
Date: Fri Oct 27 15:16:30 2017 +0300
serial: 8250: fix potential deadlock in rs485-mode
[ Upstream commit b86f86e8e7c5264bb8f5835d60f9ec840d9f5a7a ]
Canceling hrtimer when holding uart spinlock can deadlock.
CPU0: syscall write
-> get uart port spinlock
-> write uart
-> start_tx_rs485
-> hrtimer_cancel
-> wait for hrtimer callback to finish
CPU1: hrtimer IRQ
-> run hrtimer
-> em485_handle_stop_tx
-> get uart port spinlock
CPU0 is waiting for the hrtimer callback to finish, but the hrtimer
callback running on CPU1 is waiting to get the uart port spinlock.
This deadlock can be avoided by not canceling the hrtimers in these paths.
Setting active_timer=NULL can be done without accessing hrtimer,
and that will effectively cancel operations that would otherwise have been
performed by the hrtimer callback.
Signed-off-by: Tomas Melin <tomas.melin@xxxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>
diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c
index 9880a50d664f..25e8ccd6865a 100644
--- a/drivers/tty/serial/8250/8250_port.c
+++ b/drivers/tty/serial/8250/8250_port.c
@@ -1527,7 +1527,6 @@ static inline void __stop_tx(struct uart_8250_port *p)
return;
em485->active_timer = NULL;
- hrtimer_cancel(&em485->start_tx_timer);
__stop_tx_rs485(p);
}
@@ -1591,8 +1590,6 @@ static inline void start_tx_rs485(struct uart_port *port)
serial8250_stop_rx(&up->port);
em485->active_timer = NULL;
- if (hrtimer_is_queued(&em485->stop_tx_timer))
- hrtimer_cancel(&em485->stop_tx_timer);
mcr = serial8250_in_MCR(up);
if (!!(up->port.rs485.flags & SER_RS485_RTS_ON_SEND) !=
