From: Dirk Behme <dirk.behme@de.bosch.com>
To: Linux-Renesas <linux-renesas-soc@vger.kernel.org>
Cc: Biju Das <biju.das.jz@bp.renesas.com>,
Geert Uytterhoeven <geert+renesas@glider.be>
Subject: tty: serial: sh-sci: hrtimer not properly canceled on chan_rx invalidation?
Date: Thu, 11 Apr 2024 14:41:24 +0200 [thread overview]
Message-ID: <ee6c9e16-9f29-450e-81da-4a8dceaa8fc7@de.bosch.com> (raw)
Hi,
using drivers/tty/serial/sh-sci.c (on 4.14.x Renesas BSP) what is quite
similar to [1] we got [2].
Analyzing this we found that in sci_dma_rx_timer_fn() s->chan_rx is NULL.
Is there any chance that there is a race condition where the timer
function sci_dma_rx_timer_fn() is called while s->chan_rx is
invalidated, already. E.g. via
sci_dma_rx_chan_invalidate()/sci_dma_rx_release()? Or anything else?
Any idea?
Best regards
Dirk
[1]
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/drivers/tty/serial/sh-sci.c
[2]
Unable to handle kernel NULL pointer dereference at virtual address 00000000
Mem abort info:
Exception class = DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
Data abort info:
ISV = 0, ISS = 0x00000006
CM = 0, WnR = 0
user pgtable: 4k pages, 48-bit VAs, pgd = ffff80061f6ba000
[0000000000000000] *pgd=000000065f6c0003, *pud=000000065f6bf003,
*pmd=0000000000000000
Internal error: Oops: 96000006 [#1] PREEMPT SMP
Process (pid: 3983, stack limit = 0xffff000009540000)
CPU: 2 PID: 3983 Tainted: G C 4.14.327-ltsi #1
Hardware name: Bosch custom board based on r8a7796 (DT)
pc : sci_dma_rx_timer_fn+0x64/0x194
lr : sci_dma_rx_timer_fn+0x3c/0x194
sp : ffff000008013df0 pstate : 600001c5
x29: ffff000008013df0 x28: ffff0000084055e8
x27: 00000060cce93e4e x26: 0000000000000003
x25: ffff000008c48b38 x24: 0000000000000000
x23: 00000000000001c0 x22: ffff000008d98708
x21: ffff000008999000 x20: 0000000000000000
x19: ffff000008d98810 x18: 00004000362715f6
x17: 00000039f1fc5610 x16: 00000039f22bd748
x15: 000007b1e26dc9d4 x14: 000112a7eb4cd8a2
x13: 00000000631508c6 x12: 0000000000000028
x11: 0101010101010101 x10: 0000000000000000
x9 : 00000000000000cc x8 : ffff800696c04500
x7 : 0000000000000064 x6 : ffff000008d98b08
x5 : ffff00000a923e31 x4 : ffff80069ff09580
x3 : ffff00000a923e30 x2 : 0000000000000000
x1 : 00000000ffffffea x0 : 0000000000000000
Call trace:
sci_dma_rx_timer_fn+0x64/0x194
__hrtimer_run_queues+0x19c/0x2f8
hrtimer_interrupt+0xa0/0x1b0
arch_timer_handler_phys+0x28/0x3c
handle_percpu_devid_irq+0xbc/0x268
generic_handle_irq+0x18/0x2c
__handle_domain_irq+0xa8/0xac
gic_handle_irq+0x68/0xa8
el0_irq_naked+0x50/0x5c
Code: 6b00003f 54000101 52800034 f941aac0 (f9400002)
---[ end trace 07c3c96aa9b5135e ]---
Kernel panic - not syncing: Fatal exception in interrupt
SMP: stopping secondary CPUs
Kernel Offset: disabled
CPU features: 0x61002004
Memory Limit: 6016 MB
Rebooting in 3 seconds..
next reply other threads:[~2024-04-11 12:41 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-04-11 12:41 Dirk Behme [this message]
2024-04-11 12:54 ` tty: serial: sh-sci: hrtimer not properly canceled on chan_rx invalidation? Biju Das
2024-04-12 4:53 ` Dirk Behme
2024-04-12 6:36 ` Wolfram Sang
2024-04-12 7:50 ` Biju Das
2024-04-16 11:49 ` Wolfram Sang
2024-04-24 9:57 ` Geert Uytterhoeven
2024-04-24 12:12 ` Wolfram Sang
2024-05-02 17:42 ` Wolfram Sang
[not found] <20240502174257.gfmk7al3qkv7jiyj () ninjato>
2024-05-06 5:27 ` Dirk Behme
2024-05-06 6:56 ` Wolfram Sang
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ee6c9e16-9f29-450e-81da-4a8dceaa8fc7@de.bosch.com \
--to=dirk.behme@de.bosch.com \
--cc=biju.das.jz@bp.renesas.com \
--cc=geert+renesas@glider.be \
--cc=linux-renesas-soc@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).