A port's virtqueue is not torn down immediately if the port itself is hot-unplugged (unplug_port() only nulls port->portdev; the vq callback stays registered until the whole device is removed). If in_intr() fires for a port in that window it dereferences port->portdev->vdev via is_rproc_serial(), crashing on the NULL portdev.
Bail out early when portdev has already been cleared. Assisted-by: gkh_clanker:t1000 Signed-off-by: Hari Mishal <[email protected]> --- drivers/char/virtio_console.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c index 198b97314168..faef362dae85 100644 --- a/drivers/char/virtio_console.c +++ b/drivers/char/virtio_console.c @@ -1720,6 +1720,11 @@ static void in_intr(struct virtqueue *vq) } spin_lock_irqsave(&port->inbuf_lock, flags); + if (!port->portdev) { + /* Port is being unplugged, ignore further data. */ + spin_unlock_irqrestore(&port->inbuf_lock, flags); + return; + } port->inbuf = get_inbuf(port); /* -- 2.43.0
