[PATCH 3/4] virtio_console: avoid NULL portdev dereference in in_intr()
From: Hari Mishal
Date: Wed Jul 15 2026 - 10:39:07 EST
A port's virtqueue is not torn down immediately if the port itself is
hot-unplugged (unplug_port() only nulls port->portdev; the vq
callback stays registered until the whole device is removed).
If in_intr() fires for a port in that window it dereferences
port->portdev->vdev via is_rproc_serial(), crashing on the NULL
portdev.
Bail out early when portdev has already been cleared.
Assisted-by: gkh_clanker:t1000
Signed-off-by: Hari Mishal <harimishal1@xxxxxxxxx>
---
drivers/char/virtio_console.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c
index 198b97314168..faef362dae85 100644
--- a/drivers/char/virtio_console.c
+++ b/drivers/char/virtio_console.c
@@ -1720,6 +1720,11 @@ static void in_intr(struct virtqueue *vq)
}
spin_lock_irqsave(&port->inbuf_lock, flags);
+ if (!port->portdev) {
+ /* Port is being unplugged, ignore further data. */
+ spin_unlock_irqrestore(&port->inbuf_lock, flags);
+ return;
+ }
port->inbuf = get_inbuf(port);
/*
--
2.43.0