linux-stable.git/drivers/tty/vt, branch master

Merge tag 'tty-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty

2026-08-25T17:59:12+00:00

Pull TTY / serial driver updates from Greg KH:
 "Here is the "big" set of tty and serial driver updates for 7.3-rc1.

  Not really all that much happened this development cycle for this
  subsystem, changes in here are:

   - removal of the ipwireless driver as it's no longer used or needed

   - new 8250_mxpcie driver added

   - qcom serial driver updates and additions

   - vt mode validation addition

   - lots of other small serial driver updates and additions

  All of these have been in linux-next for weeks with no reported issues"

* tag 'tty-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (97 commits)
  serial: imx: serialize imx_uart_ports[] lifetime
  tty: clear cdev pointer after cdev_add() failure
  tty: skip cdev_del() when no cdev is registered
  serial: core: clear freed pointers on uart_register_driver() failure
  serial: core: do fallible allocations before the console can be registered
  serial: 8250_mxpcie: implement rx_trig_bytes callbacks via MUEx50 RTL
  serial: 8250_mxpcie: introduce per-port private data structure
  serial: 8250: allow UART drivers to override rx_trig_bytes handling
  serial: 8250_mxpcie: add break support for RS485 using MUEx50 features
  serial: 8250: allow low-level drivers to override break control
  serial: 8250_mxpcie: support serial interface mode switching
  serial: 8250_mxpcie: speed up TX using memory-mapped FIFO window
  serial: 8250_mxpcie: speed up RX using memory-mapped FIFO window
  serial: 8250_mxpcie: add custom handle_irq callback
  serial: 8250_mxpcie: offload XON/XOFF flow control to MUEx50 hardware
  serial: 8250_mxpcie: enable automatic RTS/CTS flow control
  serial: 8250_mxpcie: enable enhanced mode and program FIFO trigger levels
  serial: 8250: add Moxa MUEx50 UART port type
  serial: 8250: split Moxa PCIe serial board support out of 8250_pci
  serial: qcom-geni: Use geni_se_set_perf_level() for baud rate perf level
  ...

vt: add permission check for KDSKBMETA ioctl

2026-08-03T14:31:14+00:00

KDSKBMETA modifies keyboard meta mode but lacks the !perm check that all
other keyboard setter ioctls in vt_k_ioctl() enforce, allowing a process
to change meta mode on a non-controlling console without authorization.

Assisted-by: AISLE:Snapshot
Cc: stable 
Signed-off-by: Joshua Rogers 
Link: https://patch.msgid.link/20260731-tty-vt-stuff-v1-2-be99b9da8e30@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman

vt: stabilize tty reference in kbd_keycode with tty_port_tty_get

2026-08-03T14:31:12+00:00

kbd_keycode() reads vc->port.tty without acquiring a tty reference,
racing against con_shutdown() which clears port.tty under a different
lock. Use tty_port_tty_get()/tty_kref_put() to hold a proper reference
for the duration the tty pointer is needed.

Assisted-by: AISLE:Snapshot
Signed-off-by: Joshua Rogers 
Cc: stable 
Link: https://patch.msgid.link/20260731-tty-vt-stuff-v1-1-be99b9da8e30@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman

vt: add mode validation in vt_setactivate

2026-07-31T13:17:23+00:00

The vt_setactivate() function accepts any mode value without validation,
while VT_SETMODE correctly rejects invalid values (only VT_AUTO and
VT_PROCESS are valid).

This allows users to set invalid mode values (e.g., 0xFF) which bypasses
VT_PROCESS signal handling and causes undefined VT switching behavior.

Fix this by adding the same validation as VT_SETMODE.

Signed-off-by: Wang Zihan 
Link: https://patch.msgid.link/tencent_6A7DAE2E1288663D23AACBE2950D6E535007@qq.com
Signed-off-by: Greg Kroah-Hartman

Merge 7.2-rc3 into tty-next

2026-07-13T05:11:57+00:00

We need the tty/serial fixes in here as well.

Signed-off-by: Greg Kroah-Hartman

vt: fix spurious modifier in CSI/cursor key sequences

2026-07-10T12:46:00+00:00

csi_modifier_param() builds the xterm modifier parameter from
shift_state, counting KG_SHIFTL/KG_SHIFTR as Shift, KG_ALTGR as Alt
and KG_CTRLL/KG_CTRLR as Ctrl in addition to the canonical KG_SHIFT,
KG_ALT and KG_CTRL.

That is wrong when those weights are not plain modifiers. Keymaps
derived from XKB layouts (by kbd's xkbsupport, and by the
console-setup used in Debian, Ubuntu and others) encode the active
layout group using KG_SHIFTL/KG_SHIFTR:

	group 1: -
	group 2: shiftl
	group 3: shiftr
	group 4: shiftl | shiftr

So while a non-default layout group is selected, KG_SHIFTL and/or
KG_SHIFTR are set in shift_state with no Shift key held.
csi_modifier_param() then adds a spurious Shift to every cursor and
CSI key: pressing Up while group 2 is active emits ESC[1;2A (Shift+Up)
instead of ESC[A. KG_ALTGR has the same problem since it is the
standard third-level selector.

Normal keymaps bind the physical Shift/Ctrl/Alt keys to KG_SHIFT,
KG_CTRL and KG_ALT, leaving the left/right and AltGr weights free for
layout and level selection. Count only those canonical weights, so
genuine modifiers are still encoded while layout/level selectors are
not.

Fixes: 4af70f151671 ("vt: add modifier support to cursor keys")
Reported-by: Alexey Gladkov 
Closes: https://lore.kernel.org/kbd/aj2gR0Y7sM6i9s2G@example.org/
Cc: stable 
Signed-off-by: Nicolas Pitre 
Link: https://patch.msgid.link/20260626024833.3419086-1-nico@fluxnic.net
Signed-off-by: Greg Kroah-Hartman

vc_screen: replace __get_free_pages() with kmalloc()

2026-07-07T15:22:11+00:00

vcs_read() and vcs_write() allocate staging buffers with
__get_free_pages().

These buffers can be allocated with kmalloc() as there's nothing special
about them to go directly to the page allocator.

kmalloc() provides a better API that does not require ugly casts and it's a
modern way of saying "I need a page-sized buffer"

Replace use of __get_free_page() with kmalloc() and drop unused now
DEFINE_FREE(free_page_ptr ...)

Link: https://lore.kernel.org/all/700c5a5f-3128-4671-99aa-827ca73f5cdf@kernel.org
Link: https://lore.kernel.org/all/635405e4-9423-4a25-a6e7-e03c8ea0bcbe@redhat.com
Signed-off-by: Mike Rapoport (Microsoft) 
Reviewed-by: Jiri Slaby 
Link: https://patch.msgid.link/20260528-b4-tty-v1-4-9da9f7aec5f2@kernel.org
Signed-off-by: Greg Kroah-Hartman

Merge tag 'tty-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty

2026-06-22T18:51:49+00:00

Pull tty / serial driver updates from Greg KH:
 "Here is the big set of TTY and Serial driver updates for 7.2-rc1.

  Overall we end up removing more code than added, due to an obsolete
  synclink_gt driver being removed from the tree, always a nice thing to
  see happen.

  Other than that driver removal, major things included in here are:

   - max310x serial driver updates and fixes

   - 8250 driver updates and rework in places to make it more "modern"

   - dts file updates

   - serial driver core tweaks and updates

   - vt code cleanups

   - vc_screen crash fixes

   - other minor driver updates and cleanups

  All of these have been in linux-next for well over a week with no
  reported issues"

* tag 'tty-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (49 commits)
  serial: 8250_pci: Don't specify conflicting values to pci_device_id members
  vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write
  serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero
  vt: merge ucs_is_zero_width()/ucs_is_double_width() into ucs_get_width()
  serial: 8250: fix possible ISR soft lockup
  dt-bindings: serial: rs485: remove deprecated .txt binding stub
  serial: qcom-geni: trace: Add tracepoint support for Qualcomm GENI serial
  tty: serial: Use named initializers for arrays of i2c_device_data
  serial: 8250_dw: remove clock-notifier infrastructure
  serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails
  amba/serial: amba-pl011: Bring back zx29 UART support
  serial: 8250: Add support for console flow control
  serial: 8250: Check LSR timeout on console flow control
  serial: 8250: Set cons_flow on port registration
  tty: serial: 8250: protect against NULL uart->port.dev in register
  arm64: dts: add support for A9 based Amlogic BY401
  dt-bindings: arm: amlogic: add A311Y3 support
  serial: max310x: fix compile errors if CONFIG_SPI_MASTER is disabled
  serial: qcom-geni: Avoid probing debug console UART without console support
  serial: max310x: add comments for PLL limits
  ...

vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write

2026-06-12T09:55:37+00:00

A KASAN null-ptr-deref was observed in vcs_notifier():

BUG: KASAN: null-ptr-deref in vcs_notifier+0x98/0x130
Read of size 2 at addr qmp_cmd_name: qmp_capabilities, arguments: {}

The issue is a race condition in vcs_write(). When the console_lock is
temporarily dropped (to copy data from userspace), the vc_data pointer
obtained from vcs_vc() may become stale. After re-acquiring the lock,
vcs_vc() is called again to re-validate the pointer. If the vc has been
deallocated in the meantime, vcs_vc() returns NULL, and the while loop
breaks (with written > 0). However, after the loop, vcs_scr_updated(vc)
is still called with the now-NULL vc pointer, leading to a null pointer
dereference in the notifier chain (vcs_notifier dereferences param->vc).

Fix this by adding a NULL check for vc before calling vcs_scr_updated().

Fixes: 8fb9ea65c9d1 ("vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF")
Cc: stable@vger.kernel.org
Signed-off-by: Yi Yang 
Reviewed-by: Jiri Slaby 
Link: https://patch.msgid.link/20260604060734.2914976-1-yiyang13@huawei.com
Signed-off-by: Greg Kroah-Hartman

vt: merge ucs_is_zero_width()/ucs_is_double_width() into ucs_get_width()

2026-05-22T09:47:33+00:00

The hot path in vc_process_ucs() asks two independent questions about the
same code point -- "is it double-width?" and "is it zero-width?" -- and
was answering each with its own bsearch over its own table. For anything
past the leading bounds check that meant two scans of the BMP width
tables back to back for what is logically a single lookup.

Replace both with one ucs_get_width(cp) returning 0, 1, or 2 in a single
bsearch, while keeping the total table footprint at the same 2384 B as
before.

To do so, merge the zero-width and double-width ranges per region into
one sorted-by-`first` table. BMP entries stay 4 bytes; per-entry width
is hosted in spare bits of the non-BMP table's `last` field. Non-BMP
code points use only 20 of 32 bits, so each u32 has 12 unused high bits.
Store first/last shifted left by 12 and use the low 12 bits of `last`
for metadata: bit 11 is this entry's own width flag, bits 0..7 host an
8-bit chunk of the BMP double-width bitmap. Because the metadata bits
sit strictly below the lowest cp-scale bit, the bsearch comparator
remains a plain u32 compare on shifted keys with no masking.

In vc_process_ucs() the overwhelmingly common single-width path now
collapses to a single predicted branch:

	if (likely(w == 1))
		return 1;

Note: scripts/checkpatch.pl complains about "Macros with complex values
      should be enclosed in parentheses" for the BMP_*WIDTH and
      RANGE_*WIDTH macros. They are deliberately defined to expand to a
      comma-separated (first, last) pair so they can populate the two
      adjacent fields of a struct initializer; wrapping them in
      parentheses would turn that into a comma-expression and defeat
      the whole construction. Please ignore.

Signed-off-by: Nicolas Pitre 
Link: https://patch.msgid.link/20260515034857.2514225-1-nico@fluxnic.net
Signed-off-by: Greg Kroah-Hartman