Re: [PATCH 04/24] serial: 8250: don't report a wakeup to a closed tty

[Ilpo Järvinen]

On Tue, 27 Oct 2026, Greg Kroah-Hartman wrote:

> From: Josef Bacik <josef@xxxxxxxxxxxxxx>
> 
> If its interrupt is a wakeup source, serial8250_handle_irq_locked()
> reports the characters which arrive as a wakeup event of
> tport->tty->dev.  That pointer is only set while the port is open.  The
> port of a console is not shut down by the last close, so its interrupt
> handler goes on running without a tty.  If the system is then woken up
> by a character on the console, the handler dereferences a NULL pointer.
> 
> Take a reference to the tty, and leave the event out if there is none.
> 
> Fixes: 0ba9e3a13c6a ("serial: 8250: Add missing wakeup event reporting")
> Cc: stable <stable@xxxxxxxxxx>
> Cc: Jiri Slaby <jirislaby@xxxxxxxxxx>
> Cc: Andy Shevchenko <andriy.shevchenko@xxxxxxxxxxxxxxx>
> Cc: John Ogness <john.ogness@xxxxxxxxxxxxx>
> Cc: "Ilpo Järvinen" <ilpo.jarvinen@xxxxxxxxxxxxxxx>
> Cc: Petr Mladek <pmladek@xxxxxxxx>
> Cc: Crescent Hsieh <crescentcy.hsieh@xxxxxxxx>
> Cc: Hugo Villeneuve <hvilleneuve@xxxxxxxxxxxx>
> Cc: Florian Fainelli <f.fainelli@xxxxxxxxx>
> Signed-off-by: Josef Bacik <josef@xxxxxxxxxxxxxx>
> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
> ---
>  drivers/tty/serial/8250/8250_port.c | 11 +++++++++--
>  1 file changed, 9 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c
> index 3d47f535d6f1..4afebd96e062 100644
> --- a/drivers/tty/serial/8250/8250_port.c
> +++ b/drivers/tty/serial/8250/8250_port.c
> @@ -1900,8 +1900,15 @@ void serial8250_handle_irq_locked(struct uart_port *port, unsigned int iir)
>  		struct irq_data *d;
>  
>  		d = irq_get_irq_data(port->irq);
> -		if (d && irqd_is_wakeup_set(d))
> -			pm_wakeup_event(tport->tty->dev, 0);
> +		if (d && irqd_is_wakeup_set(d)) {
> +			struct tty_struct *tty = tty_port_tty_get(tport);
> +
> +			/* A console goes on receiving after the last close */
> +			if (tty) {
> +				pm_wakeup_event(tty->dev, 0);
> +				tty_kref_put(tty);
> +			}
> +		}
>  		if (!up->dma || handle_rx_dma(up, iir))
>  			status = serial8250_rx_chars(up, status);
>  	}

Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@xxxxxxxxxxxxxxx>

-- 
 i.