Pull s390 fixes from Vasily Gorbik:

 - Fix potential uninitialized memory reads and buffer overflows from
   malformed zcrypt CCA and EP11 requests by properly validating lengths
   and payloads

 - Fix possible out of bounds accesses in zcrypt EP11 domain handling by
   replacing fixed payload layout assumptions with parsing ASN.1 fields
   with bounds checks

 - Fix zcrypt CCA and EP11 request and reply buffer allocations missing
   required 4-byte padding, and scrub the full allocation on release

 - Fix zcrypt CCA and EP11 messages leaking up to 3 uninitialized bytes
   of memory by zeroing trailing alignment padding

* tag 's390-7.2-7' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
  s390/zcrypt: Pad trailing CCA or EP11 message with zeros
  s390/zcrypt: Improve EP11 CPRB domain handling with ASN.1 parsing
  s390/zcrypt: Improve EP11 CPRB length and overflow checks
  s390/zcrypt: Improve CCA CPRB length and overflow checks
  s390/zcrypt: Fix CPRB memory allocation in zcrypt misc code

Pull USB / Thunderbolt fixes from Greg KH:
 "Here are some small USB and Thunderbolt driver fixes for 7.2-rc7 that
  resolve some reported issues. Included in here are:

   - new quirk for some broken USB devices

   - thunderbolt device fixes for reported issues

   - usb gadget driver fix

   - usb atm driver fix

   - xhci driver fixes.

   - other minor USB driver fixes

  All of these have been in linux-next this week with no reported
  issues"

* tag 'usb-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
  usb: xhci: use BIT_ULL for CRCR bits to fix incorrect 64bit mask
  usb: quirks: Add ShanWan gamepad to quirk list
  usb: hub: Split announce_device() to log device identity before enumeration
  usb: core: Add quirk for 255-bytes initial config read
  usb: atm: cxacru: properly kill rcv_urb on error in cxacru_cm()
  usb: misc: usbio: check ibuf_len against rxbuf_len in bulk msg
  usb: gadget: f_ncm: Use unsigned int for ndp_index
  usb: cdnsp: fix incorrect endian conversions for APB timeout register
  thunderbolt: Initialize ->domain_released completion before it is being used
  thunderbolt: icm: Preserve USB4 proxy data-valid bit
  thunderbolt: Bound the DROM dual link port number before indexing sw->ports
  thunderbolt: Fix bandwidth group reservation indexing
  thunderbolt: stream: Unmap buffers with mapped size

Pull tty / serial / vt driver fixes from Greg KH:
 "Here are some small serial and vt tty driver fixes for 7.2-rc7 that
  resolve some reported problems. Included in here are:

   - two vt core fixes

   - amba-pl011 serial driver fixes

   - 8250_of and 8250_dma driver fixes

   - qcom-geni serial driver fix

   - sc16is7xx serial driver fix

  All of these have been in linux-next this week with no reported
  issues"

* tag 'tty-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
  serial: amba-pl011: synchronize DMA teardown
  serial: amba-pl011: cancel RS485 hrtimers after freeing IRQ
  serial: amba-pl011: fix indefinite RS485 post-send delay
  vt: add permission check for KDSKBMETA ioctl
  vt: stabilize tty reference in kbd_keycode with tty_port_tty_get
  serial: 8250_of: clear stuck empty-FIFO RX-timeout on LPC32xx
  serial: qcom-geni: fix TX DMA buffer flush
  serial: 8250_dma: Clear stale RX state on shutdown
  serial: sc16is7xx: enable THRI before filling TX FIFO

Pull staging driver fixes from Greg KH:
 "Here are some more small staging driver fixes, just for the rtl8723bs
  driver, for some reported problems found with it now that people are
  starting to actually test the thing with "bad" networks.

  Nothing major, but good to have in the -final release. All of these
  have been in linux-next for over a week with no reported problems"

* tag 'staging-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
  staging: rtl8723bs: validate monitor transmit frame lengths
  staging: rtl8723bs: fix missing shared-key auth challenge length check
  staging: rtl8723bs: fix OOB read in WMM_param_handler()
  staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()

Pull char / misc and documentation fixes from Greg KH:
 "Here are some small char/misc and nvmem and documentation fixes for
  7.2-rc7 to resolve some reported issues.  Included in here are:

   - updates to the documentation for the kernel threat model and
     security bugs to get the LLMs to actually follow what we have been
     asking them to do (i.e. not claim security issues for things we do
     not consider security issues.)

   - nvmem driver fixes which required a tiny "layout" driver to be
     added.

   - fastrpc driver fixes

   - mei driver fix

   - counter driver fix

   - binder driver fix

  All of these have been in linux-next this week with no reported
  problems"

* tag 'char-misc-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
  docs: security-bugs: clarify some mandatory steps for AI reports
  docs: coding-assistant: explain important steps when looking for bugs
  docs: security-bugs: clarify what counts as a valid version
  docs: threat-model: move fake devices out of "non production use"
  docs: threat-model: clarify "security bug" vs "vulnerability"
  counter: microchip-tcb-capture: Fix DT channel validation
  mei: pull kvfree out of spinlock
  rust_binder: do not query current thread for all ioctls
  nvmem: layouts: Add fixed-layout driver
  nvmem: apple-spmi-nvmem: wrap regmap calls to satisfy CFI
  misc: fastrpc: fix memory leak in fastrpc_channel_ctx_free
  misc: fastrpc: fix channel ctx ref leak when session alloc fails
  misc: fastrpc: take fl->lock when moving mmaps on interrupted invoke
  misc: fastrpc: Remove buffer from list prior to unmap operation
  misc: fastrpc: Fix initial memory allocation for Audio PD memory pool

Pull fbdev fixes from Helge Deller:
 "A few patches for the core fbdev layer which stabilize or fix
  potential issues with text font rendering after screen rotation or
  after user initiated font changes and locking fixes for sysfb during
  modifications of the graphics mode database"

* tag 'fbdev-for-7.2-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev:
  fbdev: bitblit: bound-check glyph index in bit_cursor()
  fbdev: Fix out-of-bounds access when rotating console after font resize
  fbdev: core: Fix pointer desynchronization in fb_io_read()
  fbdev: serialize mode sysfs access with lock_fb_info()
  fbdev: clear fb_info->mode before deleting a videomode
  fbdev: bound mode sysfs output to the sysfs buffer

Pull input updates from Dmitry Torokhov:

 - Fixes for information leaks and OOB accesses across several drivers,
   including evdev, focaltech, edt-ft5x06, iforce, and cs40l50-vibra

 - Improvements to the synaptics-rmi4 driver to properly handle F54
   worker errors and prevent buffer overflows

 - Input validation fixes in the hynitron_cstxxx touchscreen driver to
   prevent issues with invalid finger IDs and touch counts

 - Fixes for use-after-free and initialization bugs in the byd mouse and
   psxpad-spi drivers

 - New quirks for the atkbd driver to make keyboard work on HONOR and
   Xiaomi laptops

 - Support for the ZENAIM LEVERLESS controller in the xpad driver.

* tag 'input-for-v7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  Input: evdev - sanitize event type index when fetching event masks
  Input: synaptics-rmi4 - propagate F54 worker errors to V4L2 queue
  Input: synaptics-rmi4 - block s_input when F54 queue is busy
  Input: synaptics-rmi4 - bound the F54 report size to the allocated buffer
  Input: synaptics-rmi4 - zero report size on F54 work error
  Input: synaptics-rmi4 - fix F55 transmitter electrode count typo
  Input: hynitron_cstxxx - validate touch count and finger IDs
  Input: evdev - fix information leak in evdev_pass_values()
  fixp-arith: convert comments to kernel-doc format
  Input: focaltech - fix array out-of-bounds in focaltech_process_rel_packet
  Input: atkbd - skip deactivate for HONOR ZQC-P
  Input: atkbd - skip deactivate for Xiaomi Book Pro 14's internal keyboard
  Input: iforce - validate input packet lengths
  Input: psxpad-spi - set driver data before use
  Input: cs40l50-vibra - validate custom data from user space
  Input: xpad - add support for ZENAIM LEVERLESS
  Input: edt-ft5x06 - ignore contacts with an out-of-range slot id
  Input: byd - synchronize timer deletion before freeing private data

bit_cursor() fetches the glyph under the cursor with

	c = scr_readw(vc_pos);
	src = vc_font.data + ((c & charmask) * w * height);

where charmask is 0x1ff when vc_hi_font_mask is set. The screen buffer
value comes directly from scr_readw() and may be larger than the current
font's glyph count.

Syzkaller triggers this via vcs_write(). The Call Trace shows
vcs_write() in vc_screen.c writing an arbitrary 16-bit value with
writev() to /dev/vcsa, which vcs_write_buf() in vc_screen.c stores via
vcs_scr_writew() without checking charcount. The stored value is later
read in bit_cursor() in bitblit.c.

When the font is changed from a font with 512 glyphs to a font with
256 glyphs, the screen buffer can retain characters with the high
bit set from the previous mode, which could also produce the same
out-of-bounds access.

  BUG: KASAN: global-out-of-bounds in soft_cursor+0x378/0x6bc drivers/video/fbdev/core/softcursor.c:70
  Read of size 16 at addr ffff800086c57970

  Call Trace:
   soft_cursor+0x378/0x6bc drivers/video/fbdev/core/softcursor.c:70
   bit_cursor+0xa90/0x1108 drivers/video/fbdev/core/bitblit.c:365
   fbcon_cursor+0x344/0x498 drivers/video/fbdev/core/fbcon.c:1427
   hide_cursor+0xdc/0x2d0 drivers/tty/vt/vt.c:883
   update_region+0x100/0x18c drivers/tty/vt/vt.c:669
   vcs_write+0x8ec/0xaf0 drivers/tty/vt/vc_screen.c:685

bit_putcs_aligned() and bit_putcs_unaligned() already clamp the glyph
index to vc_font.charcount. Apply the same clamp in bit_cursor() after
extracting the attribute and masking, before indexing fontdata.

The fix completes the bounds checking started in commit 18c4ef4e765a
("fbdev: bitblit: bound-check glyph index in bit_putcs*"), which missed
the cursor path.

This change should be safe because the clamp reuses the existing
contract from fbcon: charcount is maintained under console_lock in
con_font_set() and fbcon_font_set(), and hi_font_mask is cleared when
switching from 512 to 256 glyphs. When stale screen data with high bits
remains after a font switch, or when vcs_write() stores an arbitrary
value, clamping the index to 0 prevents the out-of-bounds read without
changing cursor semantics — the same fallback bit_putcs uses.

Reported-by: syzbot+61b1db46218109869c14@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=61b1db46218109869c14
Link: https://lore.kernel.org/all/6a75205c.01d0871a.3a0d52.0032.GAE@google.com/
Fixes: 18c4ef4e765a ("fbdev: bitblit: bound-check glyph index in bit_putcs*")
Cc: stable@vger.kernel.org
Assisted-by: Hermes:muse-spark-1.2 syzkaller
Signed-off-by: Rik van Riel <riel@surriel.com>
Signed-off-by: Helge Deller <deller@gmx.de>

[BUG]
Recently, we encountered a KASAN warning as follows:

BUG: KASAN: slab-out-of-bounds in ccw_putcs+0x8bd/0xa80
Read of size 1 at addr ff11000110067100 by task bash/1209
CPU: 10 UID: 0 PID: 1209 Comm: bash Not tainted 7.2.0-rc3 #69 PREEMPT(full)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-4.fc41 04/01/2014
 Call Trace:
  <TASK>
  ...
  kasan_report+0xf0/0x120
  ? ccw_putcs+0x8bd/0xa80
  ccw_putcs+0x8bd/0xa80
  ? __pfx_ccw_putcs+0x10/0x10
  fbcon_putcs+0x338/0x410
  ? __pfx_ccw_putcs+0x10/0x10
  do_update_region+0x21d/0x450
  invert_screen+0x29d/0x5e0
  ? __kmalloc_noprof+0x493/0x640
  ? vc_do_resize+0x17c/0xe50
  clear_selection+0x4c/0x60
  vc_do_resize+0xaee/0xe50
  fbcon_modechanged+0x2bd/0x640
  rotate_all_store+0x298/0x380
  ...

reproduce:
1) issue two ioctls: first a KDFONTOP ioctl with op.op = KD_FONT_OP_SET,
op.width = 1 and op.height = 1, then a TIOCL_SETSEL ioctl
2) echo 2 > /sys/devices/virtual/graphics/fbcon/rotate_all
3) issue two ioctls: first a KDFONTOP ioctl with op.op = KD_FONT_OP_SET,
op.width = 8 and op.height = 1, then a TIOCL_SETSEL ioctl
4) echo 3 > /sys/devices/virtual/graphics/fbcon/rotate_all

[CAUSE]
The root cause is that fbcon_modechanged() first sets the current rotate's
corresponding ops. Subsequently, during vc_resize(), it may trigger
clear_selection(), and in fbcon_putcs->ccw_putcs[rotate=3], this can result
in an out-of-bounds access to "src". This happens because par->rotated.buf
is reallocated in fbcon_rotate_font():
1) When rotate=2, its size is (width + 7) / 8 * height
2) When rotate=3, its size is (height + 7) / 8 * width

And the call to fbcon_rotate_font() occurs after clear_selection(). In
other words, the fontbuffer is allocated using the size calculated from the
previous rotation 2, but before reallocating it with the new size,
con_putcs is already using the new rotation 3:

rotate_all_store
 fbcon_rotate_all
  fbcon_set_all_vcs
   fbcon_modechanged
    set_blitting_type
    ...
     par->bitops = &ccw_fbcon_bitops
    vc_resize
    ...
     clear_selection
      highlight
      ...
       do_update_region
	fbcon_putcs
	...
	 image.dy = vyres - ((xx + count) * vc->vc_font.width) [1]  // overflow!
	 ccw_putcs_aligned
	  // old buf size is still being used during the read!
	  src = par->rotated.buf + (scr_readw(s--) & charmask) * cellsize
	  fb_pad_aligned_buffer----[src KASAN!!!]	[2]
	  info->fbops->fb_imageblit(info, image)
	   sys_imageblit
	    fb_imageblit
	     fb_address_forward
	      // offset: image->dy * bits_per_line + image->dx * bpp
	      unsigned int bits = (unsigned int)adr->bits + offset
	      adr->address += (bits & ~(BITS_PER_LONG - 1u)) / BITS_PER_BYTE	[3]
	     fb_bitmap_imageblit
	     ...
	      fb_read_offset	// page fault!	[4]
    update_screen
     redraw_screen
     ...
      ccw_cursor
       soft_cursor
        memcpy(src, image->data, dsize)----[src KASAN again!!!]	[5]
     fbcon_switch
      fbcon_rotate_font
       font_data_rotate
	dst = kmalloc_array(charcount, d_cellsize, GFP_KERNEL)
       // the new size is allocated only here!
       par->rotated.buf = buf	[6]

[FIX]
A fairly obvious approach is to follow fbcon_switch(): in
fbcon_modechanged(), call rotate_font() before vc_resize() so that a
correctly sized buffer is allocated in time, as done in [6]. This fix is
necessary, but it is not sufficient on its own.

In [1] it causes an image.dy overflow (ccw_putcs: vyres = 768,
image.dy = 4294967040), because vc_cols has not been updated in time at
this point (it is likewise only updated after clear_selection()). This
allows (xx + count) * width to exceed vyres, causing image.dy to overflow.
Subsequently, address in [3] is incremented by an even larger amount, which
triggers a page fault at [4].

Therefore, a second fix is required in combination with the first: move
clear_selection() earlier, before set_blitting_type() in
fbcon_set_all_vcs(), to prevent the out-of-bounds access. fbcon_rotate()
has a similar problem, so add the same clear there. Since vc_is_sel() is
not exported, the fbdev side is currently forced to call clear_selection()
unconditionally, causing the global selection to be cleared prematurely.
And this will not cause any other significant impact.

Signed-off-by: Zizhi Wo <wozizhi@huawei.com>
Signed-off-by: Helge Deller <deller@gmx.de>

In fb_io_read(), if copy_to_user() performs a partial copy (e.g., due to
a faulty user buffer), the loop adjusts the chunk size 'c' and updates
the remaining 'count'. However, the hardware 'src' pointer has already
been eagerly advanced by the original chunk size.

If the loop is allowed to continue, the read will resume from an
incorrect, over-advanced offset. Since the remaining 'count' was only
decremented by the successful bytes, this desynchronization causes the
next iterations to execute more hardware reads than originally bounded,
eventually leading to out-of-bounds I/O reads.

Fix this by breaking out of the loop immediately upon a partial
copy_to_user(). A partial copy indicates a faulty user buffer, making
subsequent read attempts futile. Breaking out ensures we return the
number of successfully read bytes without risking out-of-bounds hardware
accesses in subsequent mismatched iterations.

Fixes: 6121cd9ef911 ("fbdev: Move I/O read and write code into helper functions")
Cc: stable@vger.kernel.org
Signed-off-by: Mingyu Wang <25181214217@stu.xidian.edu.cn>
Signed-off-by: Helge Deller <deller@gmx.de>