[PATCH] serial: imx: cancel RS485 trigger hrtimers in shutdown and remove

[Greg Kroah-Hartman]

On Wed, Aug 19, 2026 at 02:19:16AM +0000, Fan Wu wrote:
> The rs485 delay hrtimers trigger_start_tx and trigger_stop_tx are
> embedded in the devm allocated struct imx_port, and their callbacks
> reach the port through container_of() and touch registers under the
> port lock.  Nothing cancels them synchronously: the tx paths only
> call hrtimer_try_to_cancel(), which does not wait for a running
> callback, and the bounded wait in imx_uart_shutdown() can give up,
> force tx_state to OFF, and leave a timer armed.  After
> imx_uart_remove() returns, devm frees the port and a late callback
> dereferences freed memory.
> 
> Cancel both timers at the end of imx_uart_shutdown(), after the port
> lock is dropped and before the clocks are disabled, and again in
> imx_uart_remove() before the devm free: serial core does not call the
> driver shutdown on every path that reaches remove().
> 
> This issue was found by an in-house static analysis tool.
> 
> Fixes: bd78ecd6056d ("serial: imx: use hrtimers for rs485 delays")
> Cc: stable at vger.kernel.org
> Assisted-by: Codex:gpt-5.6
> Signed-off-by: Fan Wu <fanwu01 at zju.edu.cn>
> ---
>  drivers/tty/serial/imx.c | 8 ++++++++
>  1 file changed, 8 insertions(+)

How was this tested?

thanks,

greg k-h