serial: sh-sci: Fix crash in rx_timer_fn() on PIO fallback

BugLink: https://bugs.launchpad.net/bugs/1855787
[ Upstream commit 2e948218b7c1262a3830823d6620eb227e3d4e3a ]

When falling back to PIO, active_rx must be set to a different value
than cookie_rx[i], else sci_dma_rx_find_active() will incorrectly find a
match, leading to a NULL pointer dereference in rx_timer_fn() later.

Use zero instead, which is the same value as after driver
initialization.

Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>

diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c
index 89aa71c9df205a44d9e37c6cba37540045a4f2b6..4ed1d95093431014f7ef4dc07c4ed358623cc4c7 100644 (file)
--- a/drivers/tty/serial/sh-sci.c
+++ b/drivers/tty/serial/sh-sci.c
@@ -1325,7 +1325,7 @@ fail:
                dmaengine_terminate_all(chan);
        for (i = 0; i < 2; i++)
                s->cookie_rx[i] = -EINVAL;
-       s->active_rx = -EINVAL;
+       s->active_rx = 0;
        sci_rx_dma_release(s, true);
 }