Null pointer dereference in tegra_uart_rx_error_handle_timer

Full Rx tty buffer handling escalates to kernel panic because of an error in tegra_uart_rx_error_handle_timer.

“RxData DMA copy to tty layer failed” should simply indicate that received bytes are not read by the application and the tty buffer is full. However when the error_timer expires after 0.5s there is a NULL pointer dereference, see attached log:
We use prebuilt image from JetPack 5.1.1, Jetson Linux 35.3.1, Xavier NX and a custom carrier board but same devicetree

To replicate it is easier to limit the TTYB_DEFAULT_MEM_LIMIT to fill the buffer faster

Fix would be to simply use the corresponding field name in

static void tegra_uart_rx_error_handle_timer(struct timer_list * _data)
-struct tegra_uart_port *tup = from_timer(tup,_data,timer);
+struct tegra_uart_port *tup = from_timer(tup,_data,error_timer);

Can NVIDIA confirm this please?
console.log (3.6 KB)

Hi ykoveos1,

Are you using the devkit or custom board for Xavier NX?

Could you help to verify with the latest JP5.1.2(R35.4.1)?
There’s a change fixed the UART kernel panic issue due to error handler.

It is a custom board, same devicetree. No other problems with UART signal integrity though.
Will give JP5.1.2 a try today

Reviewing JP5.1.2(R35.4.1) changes it seems the null pointer derefence is fixed. It would really help to update the release notes and include those fixes.

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.