Null pointer dereference in tegra_uart_rx_error_handle_timer

[ykoveos1]

Full Rx tty buffer handling escalates to kernel panic because of an error in tegra_uart_rx_error_handle_timer.

“RxData DMA copy to tty layer failed” should simply indicate that received bytes are not read by the application and the tty buffer is full. However when the error_timer expires after 0.5s there is a NULL pointer dereference, see attached log:
We use prebuilt image from JetPack 5.1.1, Jetson Linux 35.3.1, Xavier NX and a custom carrier board but same devicetree

To replicate it is easier to limit the TTYB_DEFAULT_MEM_LIMIT to fill the buffer faster

Fix would be to simply use the corresponding field name in

static void tegra_uart_rx_error_handle_timer(struct timer_list * _data)
-struct tegra_uart_port *tup = from_timer(tup,_data,timer);
+struct tegra_uart_port *tup = from_timer(tup,_data,error_timer);

Can NVIDIA confirm this please?
console.log (3.6 KB)

[KevinFFF]

Hi ykoveos1,

Are you using the devkit or custom board for Xavier NX?

Could you help to verify with the latest JP5.1.2(R35.4.1)?
There’s a change fixed the UART kernel panic issue due to error handler.

[ykoveos1]

It is a custom board, same devicetree. No other problems with UART signal integrity though.
Will give JP5.1.2 a try today

[ykoveos1]

Reviewing JP5.1.2(R35.4.1) changes it seems the null pointer derefence is fixed. It would really help to update the release notes and include those fixes.
Thanks