On Tue, 27 Oct 2026, Greg Kroah-Hartman wrote:

> From: Josef Bacik <josef@toxicpanda.com>
> 
> If its interrupt is a wakeup source, serial8250_handle_irq_locked()
> reports the characters which arrive as a wakeup event of
> tport->tty->dev.  That pointer is only set while the port is open.  The
> port of a console is not shut down by the last close, so its interrupt
> handler goes on running without a tty.  If the system is then woken up
> by a character on the console, the handler dereferences a NULL pointer.
> 
> Take a reference to the tty, and leave the event out if there is none.
> 
> Fixes: 0ba9e3a13c6a ("serial: 8250: Add missing wakeup event reporting")
> Cc: stable <stable@kernel.org>
> Cc: Jiri Slaby <jirislaby@kernel.org>
> Cc: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
> Cc: John Ogness <john.ogness@linutronix.de>
> Cc: "Ilpo Järvinen" <ilpo.jarvinen@linux.intel.com>
> Cc: Petr Mladek <pmladek@suse.com>
> Cc: Crescent Hsieh <crescentcy.hsieh@moxa.com>
> Cc: Hugo Villeneuve <hvilleneuve@dimonoff.com>
> Cc: Florian Fainelli <f.fainelli@gmail.com>
> Signed-off-by: Josef Bacik <josef@toxicpanda.com>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> ---
>  drivers/tty/serial/8250/8250_port.c | 11 +++++++++--
>  1 file changed, 9 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c
> index 3d47f535d6f1..4afebd96e062 100644
> --- a/drivers/tty/serial/8250/8250_port.c
> +++ b/drivers/tty/serial/8250/8250_port.c
> @@ -1900,8 +1900,15 @@ void serial8250_handle_irq_locked(struct uart_port *port, unsigned int iir)
>  		struct irq_data *d;
>  
>  		d = irq_get_irq_data(port->irq);
> -		if (d && irqd_is_wakeup_set(d))
> -			pm_wakeup_event(tport->tty->dev, 0);
> +		if (d && irqd_is_wakeup_set(d)) {
> +			struct tty_struct *tty = tty_port_tty_get(tport);
> +
> +			/* A console goes on receiving after the last close */
> +			if (tty) {
> +				pm_wakeup_event(tty->dev, 0);
> +				tty_kref_put(tty);
> +			}
> +		}
>  		if (!up->dma || handle_rx_dma(up, iir))
>  			status = serial8250_rx_chars(up, status);
>  	}

Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>

-- 
 i.