There can be concurrent reads and writes to the console_rx variable so
it is prudent to use ACCESS_ONCE.

Signed-off-by: Stefano Stabellini <stefano.stabellini@amd.com>
Acked-by: Jan Beulich <jbeulich@suse.com>
---
 xen/drivers/char/console.c | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/xen/drivers/char/console.c b/xen/drivers/char/console.c
index 2bdb4d5fb4..35f541ca8e 100644
--- a/xen/drivers/char/console.c
+++ b/xen/drivers/char/console.c
@@ -518,11 +518,12 @@ static unsigned int __read_mostly console_rx = 0;
 struct domain *console_get_domain(void)
 {
     struct domain *d;
+    unsigned int rx = ACCESS_ONCE(console_rx);
 
-    if ( console_rx == 0 )
-            return NULL;
+    if ( rx == 0 )
+        return NULL;
 
-    d = rcu_lock_domain_by_id(console_rx - 1);
+    d = rcu_lock_domain_by_id(rx - 1);
     if ( !d )
         return NULL;
 
@@ -542,7 +543,7 @@ void console_put_domain(struct domain *d)
 
 static void console_switch_input(void)
 {
-    unsigned int next_rx = console_rx;
+    unsigned int next_rx = ACCESS_ONCE(console_rx);
 
     /*
      * Rotate among Xen, dom0 and boot-time created domUs while skipping
@@ -555,7 +556,7 @@ static void console_switch_input(void)
 
         if ( next_rx++ >= max_console_rx )
         {
-            console_rx = 0;
+            ACCESS_ONCE(console_rx) = 0;
             printk("*** Serial input to Xen");
             break;
         }
@@ -575,7 +576,7 @@ static void console_switch_input(void)
 
             rcu_unlock_domain(d);
 
-            console_rx = next_rx;
+            ACCESS_ONCE(console_rx) = next_rx;
             printk("*** Serial input to DOM%u", domid);
             break;
         }
@@ -592,7 +593,7 @@ static void __serial_rx(char c)
     struct domain *d;
     int rc = 0;
 
-    if ( console_rx == 0 )
+    if ( ACCESS_ONCE(console_rx) == 0 )
         return handle_keypress(c, false);
 
     d = console_get_domain();
@@ -1193,7 +1194,7 @@ void __init console_endboot(void)
      * a useful 'how to switch' message.
      */
     if ( opt_conswitch[1] == 'x' )
-        console_rx = max_console_rx;
+        ACCESS_ONCE(console_rx) = max_console_rx;
 
     register_keyhandler('w', conring_dump_keyhandler,
                         "synchronously dump console ring buffer (dmesg)", 0);
-- 
2.25.1

On Wed, Feb 04, 2026 at 03:37:08PM -0800, Stefano Stabellini wrote:
> There can be concurrent reads and writes to the console_rx variable so
> it is prudent to use ACCESS_ONCE.
> 
> Signed-off-by: Stefano Stabellini <stefano.stabellini@amd.com>
> Acked-by: Jan Beulich <jbeulich@suse.com>

Reviewed-by: Denis Mukhin <dmukhin@ford.com>