Hi KR, thank for submitting the patches
They have been uploaded to mainline and are under review https://github.com/apache/nuttx/pull/16466 Best regards Alin ________________________________ Från: kr....@kerogit.eu <kr....@kerogit.eu> Skickat: den 1 juni 2025 22:42 Till: dev@nuttx.apache.org <dev@nuttx.apache.org> Ämne: RFC: fix race conditions in drivers/serial/serial.c While going through the code in drivers/serial/serial. c, I noticed this comment: The head and tail pointers are 16-bit values. The only time that the following could be unsafe is if the CPU made two non-atomic 8-bit accesses to obtain the 16-bit While going through the code in drivers/serial/serial.c, I noticed this comment: The head and tail pointers are 16-bit values. The only time that the following could be unsafe is if the CPU made two non-atomic 8-bit accesses to obtain the 16-bit head index. This is what happens for (at least) AVR architecture. These are 8bit microcontrollers and as such, they will fetch the 16-bit value in two 8-bit load instructions; interrupt routine may execute between those and change the value being read. This will result in corrupted read (one byte of the value will be from pre-interrupt state and the other from post-interrupt state.) This patch introduces CONFIG_ARCH_LD_16BIT_NOT_ATOMIC configuration option, which is automatically selected for architectures known to be unable to load 16bit values in one instruction. (It is currently only set for AVR. I presume it might be also useful for Z80 but I do not have any experience with that architecture so I did no changes there.) When this configuration option is set, reads of recv.head and xmit.tail are enclosed with enter_critical_section and leave_critical_section calls to prevent interrupt handlers from running, if needed. Not all reads need to be protected this way - some are already in existing critical sections and some happen with the UART-specific interrupt disabled. If the configuration option is not set, the code simply loads the value into a local variable. Subsequent direct uses of the unprotected volatile variable are replaced with the local variables for both cases. There is also a related change that only applies when CONFIG_SERIAL_IFLOWCONTROL_WATERMARKS is set. Aside from the protection selected by CONFIG_ARCH_LD_16BIT_NOT_ATOMIC, this patch also fixes calculation of the nbuffered value. This calculation is not running with interrupts disabled and value of rxbuf->head can change between the condition and actual computation. Even if the load itself is atomic, this leads to TOCTOU error. Impact: this change should not impact architectures that do not benefit from this change at all unless CONFIG_SERIAL_IFLOWCONTROL is set. If CONFIG_SERIAL_IFLOWCONTROL is set, the only change that remains in effect is the fix of the TOCTOU error. Testing: Patch was tested with rv-virt:nsh - disassembly of functions from drivers/serial/serial.c was compared and did not change after the patch was applied - with one exception. The exception was an address of a global variable, I assume it was caused by change of g_version length (which notes that the tree is dirty) and is therefore inconsequential. CONFIG_SERIAL_IFLOWCONTROL was not set in this test. Configuration with CONFIG_SERIAL_IFLOWCONTROL set was tested by building it for AVR DA/DB. Configuration with CONFIG_SERIAL_IFLOWCONTROL unset was tested by custom echo application running on AVR128DA28 for a few hours. I also ran CI test: 1044 passed, 10 skipped, 14 deselected, 3 warnings in 2463.23s (0:41:03) On a related note, it seems to me that there may be a bug in echo handling in uart_readv. If dev->tc_lflag & ECHO is true, then uart_putxmitchar is called. This function adds the received character to transmit buffer and increments xmit.head value. However, uart_putxmitchar is also called from uart_writev; this function states "Only one user can access dev->xmit.head at a time" and takes the dev->xmit.lock. As far as I can see, uart_readv does not take the lock and may interfere with uart_writev. Evaluating and solving this properly is currently above my skillset though. (If this is even considered serious enough to warrant a fix.) The patch series also fixes a typo in drivers/serial/serial.c Both patches are attached to this message and also available in a git repository nuttx.git at git.kerogit.eu accessible through HTTP/S. (Trying to prevent bot traffic by not posting the URL in machine-readable form.) The relevant branch is called uart_fixes_rfc1. If the patches are acceptable, I would like to ask someone with GitHub account to open a PR (I don't have a GH account.) Any comments or suggestions are welcome.
