linux.git/drivers/video, branch v7.2-rc1

fbdev: Fix fb_new_modelist to prevent null-ptr-deref in fb_videomode_to_var

2026-06-26T13:12:45+00:00

info->var, a framebuffer's current mode, is expected to have a matching
entry in info->modelist. var_to_display() relies on this and treats a
failed fb_match_mode() as "This should not happen". fb_set_var() keeps it
true by adding the mode to the list on every change, and
do_register_framebuffer() does the same at registration.

store_modes() replaces the modelist from userspace. fb_new_modelist()
validates the new modes but does not check that info->var still has a
match. It relies on fbcon_new_modelist() to re-point consoles, but that
only handles consoles mapped to the framebuffer. With fbcon unbound there
are none, so info->var is left describing a mode that is no longer in the
list.

A later console takeover runs var_to_display(), where fb_match_mode()
returns NULL and leaves fb_display[i].mode NULL. fbcon_switch() passes it
to display_to_var(), and fb_videomode_to_var() dereferences the NULL mode.

Keep the current mode in the list in fb_new_modelist(), the same way
fb_set_var() does.

Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Ian Bridges 
Signed-off-by: Helge Deller

fbcon: fix NULL pointer dereference for a console without vc_data

2026-06-26T13:07:38+00:00

fbcon_new_modelist() runs when a framebuffer's modelist changes. For each
console mapped to it with fb_display[i].mode set, it reads vc_cons[i].d and
passes the vc_num to fbcon_set_disp(). This assumes a console with a mode
set has a vc_data, but it can be NULL. fbcon_set_disp() sets
fb_display[i].mode before it checks vc_data, and fbcon_deinit() leaves the
mode set after the vc_data is freed. fbcon_new_modelist() then dereferences
the NULL vc_data.

Keep fb_display[i].mode set only while the console has a vc_data. Check
vc_data before setting the mode in fbcon_set_disp(), and clear the mode in
fbcon_deinit(). The existing mode check in fbcon_new_modelist() then skips
such consoles.

Reported-by: syzbot+42525d636f430fd5d983@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=42525d636f430fd5d983
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Ian Bridges 
Signed-off-by: Helge Deller

fbdev: fix use-after-free in store_modes()

2026-06-26T12:56:13+00:00

store_modes() replaces a framebuffer's modelist with modes from userspace.
On success it frees the old modelist with fb_destroy_modelist(). Two
fields still point into that freed list.

One pointer is fb_display[i].mode, the mode a console is using.
fbcon_new_modelist() moves these pointers to the new list. It only does so
for consoles still mapped to the framebuffer. An unmapped console is
skipped and keeps its stale pointer. Unbinding fbcon, for example, sets
con2fb_map[i] to -1 but leaves fb_display[i].mode set. An
FBIOPUT_VSCREENINFO ioctl with FB_ACTIVATE_INV_MODE later reaches
fbcon_mode_deleted(). That function reads the stale fb_display[i].mode
through fb_mode_is_equal(). The read is a use-after-free.

The other pointer is fb_info->mode, the current mode. It is set through
the mode sysfs attribute. store_modes() does not update fb_info->mode, so
it is left pointing into the freed list. show_mode(), the attribute's read
handler, dereferences the stale fb_info->mode through mode_string(). The
read is a use-after-free.

Clear both pointers before freeing the list. Commit a1f305893074 ("fbcon:
Set fb_display[i]->mode to NULL when the mode is released") added the
helper fbcon_delete_modelist(). It clears every fb_display[i].mode that
points into a given list. So far it is called only from the unregister
path. Call it from store_modes() too, and set fb_info->mode to NULL.

Reported-by: syzbot+81c7c6b52649fd07299d@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=81c7c6b52649fd07299d
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/all/ajjoDhAi2y4ArSlz@dev/
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Ian Bridges 
Signed-off-by: Helge Deller

fbdev: viafb: return an error when DMA copy times out

2026-06-25T16:36:53+00:00

viafb_dma_copy_out_sg() logs a VIA DMA timeout when the DONE bit is not
set after the completion wait and grace delay, but still returns success
to the caller.

Preserve the existing cleanup sequence and return -ETIMEDOUT when the DMA
engine did not report completion.

Signed-off-by: Pengpeng Hou 
Signed-off-by: Helge Deller

fbdev: goldfishfb: fail pan display on base-update timeout

2026-06-25T16:29:14+00:00

goldfish_fb_pan_display() waits for the device to acknowledge the new
framebuffer base, but it only logs a timeout and still reports success.
The probe path also ignores the initial pan-display result before
registering the framebuffer.

Return -ETIMEDOUT when the base-update acknowledgment does not arrive,
and propagate that error from the initial probe-time base update before
the framebuffer is published.

Signed-off-by: Pengpeng Hou 
Signed-off-by: Helge Deller

fbdev: fbcon: fix out-of-bounds read in err_out of fbcon_do_set_font()

2026-06-25T16:15:48+00:00

When fbcon_do_set_font() fails (e.g., due to a memory allocation failure
inside vc_resize() under heavy memory pressure), it jumps to the `err_out`
label to roll back the console state. However, the current rollback logic
forgets to restore the `hi_font` state, leading to a severe state machine
corruption.

Earlier in the function, `set_vc_hi_font()` might be called to change
`vc->vc_hi_font_mask` and mutate the screen buffer. If `vc_resize()`
subsequently fails, the `err_out` path restores `vc_font.charcount`
but entirely skips rolling back the `vc_hi_font_mask` and the screen
buffer.

This mismatch leaves the terminal in a desynchronized state. Because
`vc_hi_font_mask` remains set, the VT subsystem will still accept
character indices greater than 255 from userspace and write them to the
screen buffer. Subsequent rendering calls (e.g., `fbcon_putcs()`) will
then use these inflated indices to access the reverted, 256-character
font array, leading to a deterministic out-of-bounds read and potential
kernel memory disclosure.

Fix this by adding the missing rollback logic for the `hi_font` mask
and screen buffer in the error path.

Fixes: a5a923038d70 ("fbdev: fbcon: Properly revert changes when vc_resize() failed")
Cc: stable@vger.kernel.org
Signed-off-by: Mingyu Wang <25181214217@stu.xidian.edu.cn>
Reviewed-by: Thomas Zimmermann 
Signed-off-by: Helge Deller

fbdev: pm2fb: unwind WC setup on probe failure

2026-06-25T12:05:05+00:00

Add arch_phys_wc_del() on error path to keep the
write-combining setup balanced when later probe
steps fail.

Signed-off-by: Haoxiang Li 
Signed-off-by: Helge Deller

fbdev: vga16fb: Drop unused assignment of platform_device_id driver data

2026-06-23T07:58:58+00:00

The driver explicitly sets the .driver_data member of struct
platform_device_id to zero without relying on that value. Drop these
unused assignments.

While touching this array unify spacing and usage of commas and use
named initializers for .name.

Signed-off-by: Uwe Kleine-König (The Capable Hub) 
Signed-off-by: Helge Deller

Merge tag 'backlight-next-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight

2026-06-18T21:55:20+00:00

Pull backlight updates from Lee Jones:
 "New Support & Features:
   - Maxim MAX25014: Add support for the Maxim MAX25014 4-channel
     automotive grade backlight driver IC

  Improvements & Fixes:
   - Maintainers: Add the Congatec Board Controller backlight driver to
     its corresponding entry
   - Congatec Board Controller: Remove redundant X86 dependency from the
     backlight driver
   - Kinetic KTD2801: Enable BL_CORE_SUSPENDRESUME to ensure the chip is
     powered off during suspend

  Cleanups & Refactoring:
   - Core: Use named initializers for i2c_device_id arrays to improve
     readability and robustness

  Device Tree Binding Updates:
   - Maxim MAX25014: Add device tree bindings for the Maxim MAX25014
     backlight controller"

* tag 'backlight-next-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/backlight:
  backlight: Use named initializers for arrays of i2c_device_data
  MAINTAINERS: Add cgbc backlight driver
  backlight: cgbc: Remove redundant X86 dependency
  backlight: Add max25014atg backlight
  dt-bindings: backlight: Add max25014 support
  backlight: ktd2801: Enable BL_CORE_SUSPENDRESUME

fbdev: modedb: Fix misaligned fields in the 1920x1080-60 mode

2026-06-12T21:23:43+00:00

The 1920x1080@60 modedb entry has one too many initializers before
its sync field: a stray "0" occupies the sync slot, which shifts the
remaining values by one field. The entry therefore decodes as
sync = 0, vmode = FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT (0x3,
i.e. FB_VMODE_INTERLACED | FB_VMODE_DOUBLE), and flag =
FB_VMODE_NONINTERLACED, instead of the intended sync = positive H/V,
vmode = non-interlaced.

fb_find_mode() then returns a 1920x1080 mode flagged as interlaced +
doublescan with active-low syncs. Drivers that honour var->vmode and
var->sync when programming display timing enable doublescan and the
wrong sync polarity, corrupting the output.

Drop the stray initializer so sync and vmode hold their intended
values (positive H/V sync, non-interlaced), matching the adjacent
1920x1200 entry.

Fixes: c8902258b2b8 ("fbdev: modedb: Add 1920x1080 at 60 Hz video mode")
Cc: stable@vger.kernel.org
Signed-off-by: Steffen Persvold 
Signed-off-by: Helge Deller