The Tangier and Denverton DMA timeout handlers call serial8250_rx_dma_flush() without holding the UART port lock. The helper pauses the transfer, copies received data, updates RX state and terminates the channel. The DMA completion callback accesses the same state under the port lock, so it can race an unlocked timeout flush. The IRQ-chain lock held by serial8250_interrupt() does not serialize the completion callback. Take the port lock around each timeout flush. Release it before handling the UART interrupt, since serial8250_handle_irq() acquires the port lock itself. Fixes: 692aa1905679 ("serial: 8250_mid: Read RX buffer on RX DMA timeout for DNV") Fixes: 4831e0d9054c ("serial: 8250_mid: handle interrupt correctly in DMA case") Cc: stable@vger.kernel.org Signed-off-by: James Hilliard --- Previously included in the DMA cancellation series v4: https://lore.kernel.org/r/20261023-submit-serial-8250-dma-cancel-v1-v4-0-e759de1839de@gmail.com --- drivers/tty/serial/8250/8250_mid.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/tty/serial/8250/8250_mid.c b/drivers/tty/serial/8250/8250_mid.c index 44b43163df51..83f928b1f643 100644 --- a/drivers/tty/serial/8250/8250_mid.c +++ b/drivers/tty/serial/8250/8250_mid.c @@ -94,7 +94,8 @@ static int tng_handle_irq(struct uart_port *p) /* Rx DMA */ err = hsu_dma_get_status(chip, mid->dma_index * 2 + 1, &status); if (err > 0) { - serial8250_rx_dma_flush(up); + scoped_guard(uart_port_lock_irqsave, p) + serial8250_rx_dma_flush(up); ret |= 1; } else if (err == 0) ret |= hsu_dma_do_irq(chip, mid->dma_index * 2 + 1, status); @@ -148,7 +149,8 @@ static int dnv_handle_irq(struct uart_port *p) if (fisr & BIT(2)) { err = hsu_dma_get_status(&mid->dma_chip, 1, &status); if (err > 0) { - serial8250_rx_dma_flush(up); + scoped_guard(uart_port_lock_irqsave, p) + serial8250_rx_dma_flush(up); ret |= 1; } else if (err == 0) ret |= hsu_dma_do_irq(&mid->dma_chip, 1, status); --- base-commit: 1184f87e2790e8af9be3116f608d2e86b4792d7d change-id: 20261024-submit-serial-8250-mid-rx-lock-v1-21c66e80df80 Best regards, -- James Hilliard