linux.git/drivers/tty/vt, branch master

Merge tag 'tty-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty

2026-06-22T18:51:49+00:00

Pull tty / serial driver updates from Greg KH:
 "Here is the big set of TTY and Serial driver updates for 7.2-rc1.

  Overall we end up removing more code than added, due to an obsolete
  synclink_gt driver being removed from the tree, always a nice thing to
  see happen.

  Other than that driver removal, major things included in here are:

   - max310x serial driver updates and fixes

   - 8250 driver updates and rework in places to make it more "modern"

   - dts file updates

   - serial driver core tweaks and updates

   - vt code cleanups

   - vc_screen crash fixes

   - other minor driver updates and cleanups

  All of these have been in linux-next for well over a week with no
  reported issues"

* tag 'tty-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (49 commits)
  serial: 8250_pci: Don't specify conflicting values to pci_device_id members
  vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write
  serial: qcom_geni: Fix RX DMA stall when SE_DMA_RX_LEN_IN is zero
  vt: merge ucs_is_zero_width()/ucs_is_double_width() into ucs_get_width()
  serial: 8250: fix possible ISR soft lockup
  dt-bindings: serial: rs485: remove deprecated .txt binding stub
  serial: qcom-geni: trace: Add tracepoint support for Qualcomm GENI serial
  tty: serial: Use named initializers for arrays of i2c_device_data
  serial: 8250_dw: remove clock-notifier infrastructure
  serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails
  amba/serial: amba-pl011: Bring back zx29 UART support
  serial: 8250: Add support for console flow control
  serial: 8250: Check LSR timeout on console flow control
  serial: 8250: Set cons_flow on port registration
  tty: serial: 8250: protect against NULL uart->port.dev in register
  arm64: dts: add support for A9 based Amlogic BY401
  dt-bindings: arm: amlogic: add A311Y3 support
  serial: max310x: fix compile errors if CONFIG_SPI_MASTER is disabled
  serial: qcom-geni: Avoid probing debug console UART without console support
  serial: max310x: add comments for PLL limits
  ...

vc_screen: fix null-ptr-deref in vcs_notifier() during concurrent vcs_write

2026-06-12T09:55:37+00:00

A KASAN null-ptr-deref was observed in vcs_notifier():

BUG: KASAN: null-ptr-deref in vcs_notifier+0x98/0x130
Read of size 2 at addr qmp_cmd_name: qmp_capabilities, arguments: {}

The issue is a race condition in vcs_write(). When the console_lock is
temporarily dropped (to copy data from userspace), the vc_data pointer
obtained from vcs_vc() may become stale. After re-acquiring the lock,
vcs_vc() is called again to re-validate the pointer. If the vc has been
deallocated in the meantime, vcs_vc() returns NULL, and the while loop
breaks (with written > 0). However, after the loop, vcs_scr_updated(vc)
is still called with the now-NULL vc pointer, leading to a null pointer
dereference in the notifier chain (vcs_notifier dereferences param->vc).

Fix this by adding a NULL check for vc before calling vcs_scr_updated().

Fixes: 8fb9ea65c9d1 ("vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF")
Cc: stable@vger.kernel.org
Signed-off-by: Yi Yang 
Reviewed-by: Jiri Slaby 
Link: https://patch.msgid.link/20260604060734.2914976-1-yiyang13@huawei.com
Signed-off-by: Greg Kroah-Hartman

vt: merge ucs_is_zero_width()/ucs_is_double_width() into ucs_get_width()

2026-05-22T09:47:33+00:00

The hot path in vc_process_ucs() asks two independent questions about the
same code point -- "is it double-width?" and "is it zero-width?" -- and
was answering each with its own bsearch over its own table. For anything
past the leading bounds check that meant two scans of the BMP width
tables back to back for what is logically a single lookup.

Replace both with one ucs_get_width(cp) returning 0, 1, or 2 in a single
bsearch, while keeping the total table footprint at the same 2384 B as
before.

To do so, merge the zero-width and double-width ranges per region into
one sorted-by-`first` table. BMP entries stay 4 bytes; per-entry width
is hosted in spare bits of the non-BMP table's `last` field. Non-BMP
code points use only 20 of 32 bits, so each u32 has 12 unused high bits.
Store first/last shifted left by 12 and use the low 12 bits of `last`
for metadata: bit 11 is this entry's own width flag, bits 0..7 host an
8-bit chunk of the BMP double-width bitmap. Because the metadata bits
sit strictly below the lowest cp-scale bit, the bsearch comparator
remains a plain u32 compare on shifted keys with no masking.

In vc_process_ucs() the overwhelmingly common single-width path now
collapses to a single predicted branch:

	if (likely(w == 1))
		return 1;

Note: scripts/checkpatch.pl complains about "Macros with complex values
      should be enclosed in parentheses" for the BMP_*WIDTH and
      RANGE_*WIDTH macros. They are deliberately defined to expand to a
      comma-separated (first, last) pair so they can populate the two
      adjacent fields of a struct initializer; wrapping them in
      parentheses would turn that into a comma-expression and defeat
      the whole construction. Please ignore.

Signed-off-by: Nicolas Pitre 
Link: https://patch.msgid.link/20260515034857.2514225-1-nico@fluxnic.net
Signed-off-by: Greg Kroah-Hartman

console: mdacon: remove this obsolete driver

2026-05-20T18:23:32+00:00

The mdacon driver supports using ISA MDA or Hercules-compatible display
adapters as a secondary text console. This was commonly used in the
1990s and earlier for debugging software which took over the primary
display. It is highly unlikely anyone is doing so nowadays because
serial consoles and much better methods of debugging exist.

The driver is not enabled by any defconfig, nor any of the
dozens of distro configs collected at [1]. It has been relegated to VTs
13-16 since commit 0b9cf3aa6b1e ("mdacon messing up default vc's - set
default to vc13-16 again") in Linux 2.6.27 (and before Linux 2.5.53 -
see the link in the message of the above commit). The change in 2.6.27
was done because it was incorrectly detecting non-MDA adapters as MDA
and taking over all VTs, rendering them unusable.

Furthermore, vgacon supports using MDA/Hercules-compatible adapters as
the primary text console, so any systems with only one of these
adapters were already using vgacon and will not experience any loss in
functionality from the removal of this driver.

Given all of these factors, the mdacon driver is likely entirely
unused. Remove it.

[1] https://github.com/nyrahul/linux-kernel-configs/tree/f0bee86a135a0406ea427855f52702dd00d770f9

Signed-off-by: Ethan Nelson-Moore 
Signed-off-by: Helge Deller

Merge tag 'tty-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty

2026-04-19T15:44:41+00:00

Pull tty/serial updates from Greg KH:
 "Here is the set of tty and serial driver changes for 7.1-rc1.

  Not much here this cycle, biggest thing is the removal of an old
  driver that never got any actual hardware support (esp32), and the
  second try to moving the tty ports to their own workqueues (first try
  was in 7.0-rc1 but was reverted due to problems)

  Otherwise it's just a small set of driver updates and some vt modifier
  key enhancements.

  All have been in linux-next for a while with no reported issues"

* tag 'tty-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (35 commits)
  tty: serial: ip22zilog: Fix section mispatch warning
  hvc/xen: Check console connection flag
  serial: sh-sci: Add support for RZ/G3L RSCI
  dt-bindings: serial: renesas,rsci: Document RZ/G3L SoC
  tty: atmel_serial: update outdated reference to atmel_tasklet_func()
  serial: xilinx_uartps: Drop unused include
  serial: qcom-geni: drop stray newline format specifier
  serial: 8250: loongson: Enable building on MIPS Loongson64
  dt-bindings: serial: 8250: Add Loongson 3A4000 uart compatible
  serial: 8250_fintek: Add support for F81214E
  tty: tty_port: add workqueue to flip TTY buffer
  vt: support ITU-T T.416 color subparameters
  serial: qcom-geni: Fix RTS behavior with flow control
  tty: serial: imx: keep dma request disabled before dma transfer setup
  tty: serial: 8250: Add SystemBase Multi I/O cards
  serial: pic32_uart: allow driver to be compiled on all architectures with COMPILE_TEST
  serial: tegra: remove Kconfig dependency on APB DMA controller
  dt-bindings: serial: amlogic,meson-uart: Add compatible string for A9
  dt-bindings: serial: atmel,at91-usart: add microchip,lan9691-usart
  serial: auart: check clk_enable() return in console write
  ...

Merge tag 'fbdev-for-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev

2026-04-15T15:37:45+00:00

Pull fbdev updates from Helge Deller:
 "A major refactorization by Thomas Zimmermann from SUSE regarding
  handling of console font data, addition of helpers for console font
  rotation and split into individual components for glyphs, fonts and
  the overall fbcon state.

  And there is the round of usual code cleanups and fixes:

  Cleanups:
   - atyfb: Remove unused fb_list (Geert Uytterhoeven)
   - goldfishfb, wmt_ge_rops: use devm_platform_ioremap_resource() (Amin GATTOUT)
   - matroxfb: Mark variable with __maybe_unused (Andy Shevchenko)
   - omapfb: Add missing error check for clk_get() (Chen Ni)
   - tdfxfb: Make the VGA register initialisation a bit more obvious (Daniel Palmer)
   - macfb: Replace deprecated strcpy with strscpy (Thorsten Blum)

  Fixes:
   - tdfxfb, udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO (Greg Kroah-Hartman)
   - omap2: fix inconsistent lock returns in omapfb_mmap (Hongling Zeng)
   - viafb: check ioremap return value in viafb_lcd_get_mobile_state (Wang Jun)"

* tag 'fbdev-for-7.1-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev: (40 commits)
  fbdev: udlfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO
  fbdev: tdfxfb: avoid divide-by-zero on FBIOPUT_VSCREENINFO
  fbdev: omap2: fix inconsistent lock returns in omapfb_mmap
  MAINTAINERS: Add dedicated entry for fbcon
  fbcon: Put font-rotation state into separate struct
  fbcon: Fill cursor mask in helper function
  lib/fonts: Implement font rotation
  lib/fonts: Refactor glyph-rotation helpers
  lib/fonts: Refactor glyph-pattern helpers
  lib/fonts: Implement glyph rotation
  lib/fonts: Clean up Makefile
  lib/fonts: Provide helpers for calculating glyph pitch and size
  vt: Implement helpers for struct vc_font in source file
  fbcon: Avoid OOB font access if console rotation fails
  fbdev: atyfb: Remove unused fb_list
  fbdev: matroxfb: Mark variable with __maybe_unused to avoid W=1 build break
  fbdev: update help text for CONFIG_FB_NVIDIA
  fbdev: omapfb: Add missing error check for clk_get()
  fbdev: viafb: check ioremap return value in viafb_lcd_get_mobile_state
  lib/fonts: Remove internal symbols and macros from public header file
  ...

lib/fonts: Provide helpers for calculating glyph pitch and size

2026-04-07T15:38:07+00:00

Implement pitch and size calculation for a single font glyph in the
new helpers font_glyph_pitch() and font_glyph_size(). Replace the
instances where the calculations are open-coded.

Note that in the case of fbcon console rotation, the parameters for
a glyph's width and height might be reversed. This is intentional.

v2:
- fix typos in commit message

Signed-off-by: Thomas Zimmermann 
Signed-off-by: Helge Deller

vt: Implement helpers for struct vc_font in source file

2026-04-07T15:38:06+00:00

Move the helpers vc_font_pitch() and vc_font_size() from the VT
header file into source file. They are not called very often, so
there's no benefit in keeping them in the headers. Also avoids
including  from the header.

v2:
- fix typo in commit description

Signed-off-by: Thomas Zimmermann 
Acked-by: Greg Kroah-Hartman 
Signed-off-by: Helge Deller

vt: resize saved unicode buffer on alt screen exit after resize

2026-03-30T15:39:44+00:00

Instead of discarding the saved unicode buffer when the console was
resized while in the alternate screen, resize it to the current
dimensions using vc_uniscr_copy_area() to preserve its content. This
properly restores the unicode screen on alt screen exit rather than
lazily rebuilding it from a lossy reverse glyph translation.

On allocation failure the stale buffer is freed and vc_uni_lines is
set to NULL so it gets lazily rebuilt via vc_uniscr_check() when next
needed.

Fixes: 40014493cece ("vt: discard stale unicode buffer on alt screen exit after resize")
Cc: stable 
Signed-off-by: Nicolas Pitre 
Link: https://patch.msgid.link/3nsr334n-079q-125n-7807-n4nq818758ns@syhkavp.arg
Signed-off-by: Greg Kroah-Hartman

vt: discard stale unicode buffer on alt screen exit after resize

2026-03-30T15:38:47+00:00

When enter_alt_screen() saves vc_uni_lines into vc_saved_uni_lines and
sets vc_uni_lines to NULL, a subsequent console resize via vc_do_resize()
skips reallocating the unicode buffer because vc_uni_lines is NULL.
However, vc_saved_uni_lines still points to the old buffer allocated for
the original dimensions.

When leave_alt_screen() later restores vc_saved_uni_lines, the buffer
dimensions no longer match vc_rows/vc_cols. Any operation that iterates
over the unicode buffer using the current dimensions (e.g. csi_J clearing
the screen) will access memory out of bounds, causing a kernel oops:

  BUG: unable to handle page fault for address: 0x0000002000000020
  RIP: 0010:csi_J+0x133/0x2d0

The faulting address 0x0000002000000020 is two adjacent u32 space
characters (0x20) interpreted as a pointer, read from the row data area
past the end of the 25-entry pointer array in a buffer allocated for
80x25 but accessed with 240x67 dimensions.

Fix this by checking whether the console dimensions changed while in the
alternate screen. If they did, free the stale saved buffer instead of
restoring it. The unicode screen will be lazily rebuilt via
vc_uniscr_check() when next needed.

Fixes: 5eb608319bb5 ("vt: save/restore unicode screen buffer for alternate screen")
Cc: stable 
Tested-by: Liav Mordouch 
Signed-off-by: Liav Mordouch 
Reviewed-by: Nicolas Pitre 
Link: https://patch.msgid.link/20260327170204.29706-1-liavmordouch@gmail.com
Signed-off-by: Greg Kroah-Hartman