linux-stable.git/drivers/tty/serial/uartlite.c, branch linux-5.15.y

serial: uartlite: fix PM runtime usage count underflow on probe

2026-04-18T08:33:18+00:00

commit d54801cd509515f674a5aac1d3ea1401d2a05863 upstream.

ulite_probe() calls pm_runtime_put_autosuspend() at the end of probe
without holding a corresponding PM runtime reference for non-console
ports.

During ulite_assign(), uart_add_one_port() triggers uart_configure_port()
which calls ulite_pm() via uart_change_pm(). For non-console ports, the
UART core performs a balanced get/put cycle:

  uart_change_pm(ON)  -> ulite_pm() -> pm_runtime_get_sync()        +1
  uart_change_pm(OFF) -> ulite_pm() -> pm_runtime_put_autosuspend() -1

This leaves no spare reference for the pm_runtime_put_autosuspend() at
the end of probe. The PM runtime core prevents the count from actually
going below zero, and instead triggers a
"Runtime PM usage count underflow!" warning.

For console ports the bug is masked: the UART core skips the
uart_change_pm(OFF) call, so the UART core's unbalanced get happens to
pair with probe's trailing put.

Add pm_runtime_get_noresume() before pm_runtime_enable() to take an
explicit probe-owned reference that the trailing
pm_runtime_put_autosuspend() can release. This ensures a correct usage
count regardless of whether the port is a console.

Fixes: 5bbe10a6942d ("tty: serial: uartlite: Add runtime pm support")
Cc: stable 
Signed-off-by: Maciej Andrzejewski ICEYE 
Link: https://patch.msgid.link/20260305123746.4152800-1-maciej.andrzejewski@m-works.net
Signed-off-by: Greg Kroah-Hartman

tty: serial: uartlite: register uart driver in init

2025-07-10T13:57:33+00:00

[ Upstream commit 6bd697b5fc39fd24e2aa418c7b7d14469f550a93 ]

When two instances of uart devices are probing, a concurrency race can
occur. If one thread calls uart_register_driver function, which first
allocates and assigns memory to 'uart_state' member of uart_driver
structure, the other instance can bypass uart driver registration and
call ulite_assign. This calls uart_add_one_port, which expects the uart
driver to be fully initialized. This leads to a kernel panic due to a
null pointer dereference:

[    8.143581] BUG: kernel NULL pointer dereference, address: 00000000000002b8
[    8.156982] #PF: supervisor write access in kernel mode
[    8.156984] #PF: error_code(0x0002) - not-present page
[    8.156986] PGD 0 P4D 0
...
[    8.180668] RIP: 0010:mutex_lock+0x19/0x30
[    8.188624] Call Trace:
[    8.188629]  ? __die_body.cold+0x1a/0x1f
[    8.195260]  ? page_fault_oops+0x15c/0x290
[    8.209183]  ? __irq_resolve_mapping+0x47/0x80
[    8.209187]  ? exc_page_fault+0x64/0x140
[    8.209190]  ? asm_exc_page_fault+0x22/0x30
[    8.209196]  ? mutex_lock+0x19/0x30
[    8.223116]  uart_add_one_port+0x60/0x440
[    8.223122]  ? proc_tty_register_driver+0x43/0x50
[    8.223126]  ? tty_register_driver+0x1ca/0x1e0
[    8.246250]  ulite_probe+0x357/0x4b0 [uartlite]

To prevent it, move uart driver registration in to init function. This
will ensure that uart_driver is always registered when probe function
is called.

Signed-off-by: Jakub Lewalski 
Signed-off-by: Elodie Decerle 
Link: https://lore.kernel.org/r/20250331160732.2042-1-elodie.decerle@nokia.com
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin

tty: serial: uartlite: allow 64 bit address

2022-01-27T10:03:25+00:00

[ Upstream commit 3672fb65155530b5eea6225685c75329b6debec3 ]

The base address of uartlite registers could be 64 bit address which is from
device resource. When ulite_probe() calls ulite_assign(), this 64 bit
address is casted to 32-bit. The fix is to replace "u32" type with
"phys_addr_t" type for the base address in ulite_assign() argument list.

Fixes: 8fa7b6100693 ("[POWERPC] Uartlite: Separate the bus binding from the driver proper")
Signed-off-by: Lizhi Hou 
Link: https://lore.kernel.org/r/20211129202302.1319033-1-lizhi.hou@xilinx.com
Signed-off-by: Greg Kroah-Hartman 
Signed-off-by: Sasha Levin

tty: serial: uartlite: Use read_poll_timeout for a polling loop

2021-08-27T14:34:32+00:00

read_poll_timeout was recently introduced, and can be used to simplify
our console polling loop. This results in a slight reduction in code.
early_uartlite_putc can't get the same treatment, because it can be
called before udelay is set up.

Signed-off-by: Sean Anderson 
Link: https://lore.kernel.org/r/20210826192549.3203071-1-sean.anderson@seco.com
Signed-off-by: Greg Kroah-Hartman

tty: serial: uartlite: Use constants in early_uartlite_putc

2021-08-27T14:34:04+00:00

Use the constants defined at the beginning of this file instead of
integer literals when accessing registers. This makes this code easier
to read, and obviates the need for some explanatory comments.

Signed-off-by: Sean Anderson 
Link: https://lore.kernel.org/r/20210826194323.3209227-1-sean.anderson@seco.com
Signed-off-by: Greg Kroah-Hartman

tty: serial: uartlite: Add runtime pm support

2021-07-21T10:46:52+00:00

In the commit 07e5d4ff125a ("Revert serial-uartlite: Add runtime
support") the runtime pm support was reverted to aid reverting of
the other patches.

This patch adds the runtime PM support back.
The runtime pm calls are used to gate and enable the clocks.

Signed-off-by: Shubhrajyoti Datta 
Link: https://lore.kernel.org/r/20210713064835.27978-3-shubhrajyoti.datta@xilinx.com
Signed-off-by: Greg Kroah-Hartman

tty: serial: uartlite: Disable clocks in case of errors

2021-07-21T10:46:52+00:00

In case the uart registration fails the clocks are left enabled.
Disable the clock in case of errors.

Signed-off-by: Shubhrajyoti Datta 
Link: https://lore.kernel.org/r/20210713064835.27978-2-shubhrajyoti.datta@xilinx.com
Signed-off-by: Greg Kroah-Hartman

serial: tty: uartlite: fix console setup

2021-06-04T13:11:45+00:00

Remove the hack to assign the global console_port variable at probe time.
This assumption that cons->index is -1 is wrong for systems that specify
'console=' in the cmdline (or 'stdout-path' in dts). Hence, on such system
the actual console assignment is ignored, and the first UART that happens
to be probed is used as console instead.

Move the logic to console_setup() and map the console to the correct port
through the array of available ports instead.

Signed-off-by: Daniel Mack 
Link: https://lore.kernel.org/r/20210528133321.1859346-1-daniel@zonque.org
Signed-off-by: Greg Kroah-Hartman

tty: serial: uartlite: Support probe deferral

2020-12-04T15:51:40+00:00

Give uartlite a chance to be probed when IRQ controller will be finally
available and return potential -EPROBE_DEFER as-is. The condition "<="
has been changed to "<" to follow the recommendation in the header of
platform_get_irq().

Signed-off-by: Alexander Sverdlin 
Link: https://lore.kernel.org/r/20201127101953.23700-1-alexander.sverdlin@nokia.com
Signed-off-by: Greg Kroah-Hartman

tty: serial: uartlite: Replace HTTP links with HTTPS ones

2020-07-21T18:04:54+00:00

Rationale:
Reduces attack surface on kernel devs opening the links for MITM
as HTTPS traffic is much harder to manipulate.

Deterministic algorithm:
For each file:
  If not .svg:
    For each line:
      If doesn't contain `\bxmlns\b`:
        For each link, `\bhttp://[^# \t\r\n]*(?:\w|/)`:
	  If neither `\bgnu\.org/license`, nor `\bmozilla\.org/MPL\b`:
            If both the HTTP and HTTPS versions
            return 200 OK and serve the same content:
              Replace HTTP with HTTPS.

Signed-off-by: Alexander A. Klimov 
Link: https://lore.kernel.org/r/20200718100807.983-1-grandmaster@al2klimov.de
Signed-off-by: Greg Kroah-Hartman