From 317a8be730919177956be32422ebe00cf7e46710 Mon Sep 17 00:00:00 2001 From: Karl Mehltretter Date: Sat, 12 Sep 2026 12:21:52 +0200 Subject: [PATCH 01/53] fbdev: sh_mobile_lcdcfb: Restore the per-overlay sysfs attributes The ovl_* files documented in Documentation/ABI/testing/sysfs-devices-platform-sh_mobile_lcdc_fb no longer exist. Commit a979182a2453 ("fbdev: lcdcfb: Register sysfs groups through driver core") moved the attributes from each overlay's framebuffer device to the platform driver's dev_groups and renamed them overlay_*. There is now only one set of attributes for the whole LCDC. The callbacks still expect dev_get_drvdata() to return a struct fb_info, but the platform device holds struct sh_mobile_lcdc_priv, so they access the wrong structure. Restore the documented names and register the group on each overlay's framebuffer device with device_add_groups(). Remove it with device_remove_groups() before unregistering the framebuffer. Skip creation when dev_of_fbinfo(info) is NULL, as the old device_create_file() calls did. Drop the CONFIG_FB_DEVICE guard, since the driver already depends on it. Fixes: a979182a2453 ("fbdev: lcdcfb: Register sysfs groups through driver core") Cc: stable@vger.kernel.org Assisted-by: LLM Signed-off-by: Karl Mehltretter Signed-off-by: Helge Deller --- drivers/video/fbdev/sh_mobile_lcdcfb.c | 37 +++++++++++++++++--------- 1 file changed, 24 insertions(+), 13 deletions(-) diff --git a/drivers/video/fbdev/sh_mobile_lcdcfb.c b/drivers/video/fbdev/sh_mobile_lcdcfb.c index e8324b01700f..5743c96d5481 100644 --- a/drivers/video/fbdev/sh_mobile_lcdcfb.c +++ b/drivers/video/fbdev/sh_mobile_lcdcfb.c @@ -1337,22 +1337,24 @@ overlay_rop3_store(struct device *dev, struct device_attribute *attr, return count; } -static DEVICE_ATTR_RW(overlay_alpha); -static DEVICE_ATTR_RW(overlay_mode); -static DEVICE_ATTR_RW(overlay_position); -static DEVICE_ATTR_RW(overlay_rop3); +static struct device_attribute dev_attr_ovl_alpha = + __ATTR(ovl_alpha, 0644, overlay_alpha_show, overlay_alpha_store); +static struct device_attribute dev_attr_ovl_mode = + __ATTR(ovl_mode, 0644, overlay_mode_show, overlay_mode_store); +static struct device_attribute dev_attr_ovl_position = + __ATTR(ovl_position, 0644, overlay_position_show, overlay_position_store); +static struct device_attribute dev_attr_ovl_rop3 = + __ATTR(ovl_rop3, 0644, overlay_rop3_show, overlay_rop3_store); -static struct attribute *overlay_sysfs_attrs[] __maybe_unused = { - &dev_attr_overlay_alpha.attr, - &dev_attr_overlay_mode.attr, - &dev_attr_overlay_position.attr, - &dev_attr_overlay_rop3.attr, +static struct attribute *overlay_sysfs_attrs[] = { + &dev_attr_ovl_alpha.attr, + &dev_attr_ovl_mode.attr, + &dev_attr_ovl_position.attr, + &dev_attr_ovl_rop3.attr, NULL, }; -#ifdef CONFIG_FB_DEVICE ATTRIBUTE_GROUPS(overlay_sysfs); -#endif static const struct fb_fix_screeninfo sh_mobile_lcdc_overlay_fix = { .id = "SH Mobile LCDC", @@ -1510,9 +1512,10 @@ sh_mobile_lcdc_overlay_fb_unregister(struct sh_mobile_lcdc_overlay *ovl) { struct fb_info *info = ovl->info; - if (info == NULL || info->dev == NULL) + if (!info || !dev_of_fbinfo(info)) return; + device_remove_groups(dev_of_fbinfo(info), overlay_sysfs_groups); unregister_framebuffer(ovl->info); } @@ -1530,6 +1533,15 @@ sh_mobile_lcdc_overlay_fb_register(struct sh_mobile_lcdc_overlay *ovl) if (ret < 0) return ret; + /* The framebuffer device is optional, see fb_device_create(). */ + if (dev_of_fbinfo(info)) { + ret = device_add_groups(dev_of_fbinfo(info), overlay_sysfs_groups); + if (ret < 0) { + unregister_framebuffer(info); + return ret; + } + } + dev_info(lcdc->dev, "registered %s/overlay %u as %dx%d %dbpp.\n", dev_name(lcdc->dev), ovl->index, info->var.xres, info->var.yres, info->var.bits_per_pixel); @@ -2637,7 +2649,6 @@ static int sh_mobile_lcdc_probe(struct platform_device *pdev) static struct platform_driver sh_mobile_lcdc_driver = { .driver = { .name = "sh_mobile_lcdc_fb", - .dev_groups = overlay_sysfs_groups, .pm = &sh_mobile_lcdc_dev_pm_ops, }, .probe = sh_mobile_lcdc_probe, From ac9cfa552102b8e80e88c2872e80dc9cb5f07dda Mon Sep 17 00:00:00 2001 From: Xiang Mei Date: Sat, 12 Sep 2026 14:15:12 -0700 Subject: [PATCH 02/53] fbdev: udlfb: don't rebuild the mode list while the framebuffer is in use dlfb_setup_modes() frees info->modelist with fb_destroy_modelist() and rebuilds it, but fbcon holds raw pointers into that list in fb_display[i].mode and nothing un-publishes them the way do_unregister_framebuffer() and store_modes() do with fbcon_delete_modelist(). The function does refuse to install a new mode while the framebuffer has users (dlfb->fb_count != 0), but only after the list is already destroyed. Reached from the 0666 "edid" sysfs attribute, an unprivileged write to /sys/class/graphics/fb0/edid therefore fails with -EINVAL and still leaves every fb_display[i].mode dangling; the next console switch reads the freed fb_videomode in fb_videomode_to_var(). Test fb_count before touching the list. fbcon takes a reference through fbcon_open(), so that condition covers exactly the states in which fb_display[] points into the list, and the errno returned to userspace is unchanged. BUG: KASAN: slab-use-after-free in fb_videomode_to_var (drivers/video/fbdev/core/modedb.c:905) Read of size 4 at addr ffff8880107b449c by task kworker/1:1/47 Workqueue: events console_callback Call Trace: fb_videomode_to_var (drivers/video/fbdev/core/modedb.c:905) display_to_var (drivers/video/fbdev/core/fbcon.c:998) fbcon_switch (drivers/video/fbdev/core/fbcon.c:2182) redraw_screen (drivers/tty/vt/vt.c:994) complete_change_console (drivers/tty/vt/vt_ioctl.c:1141) console_callback (drivers/tty/vt/vt.c:3358) process_one_work (kernel/workqueue.c:3396) worker_thread (kernel/workqueue.c:3479 kernel/workqueue.c:3560) kthread (kernel/kthread.c:436) ret_from_fork (arch/x86/kernel/process.c:158) ret_from_fork_asm (arch/x86/entry/entry_64.S:245) ... The buggy address is located 28 bytes inside of freed 96-byte region [ffff8880107b4480, ffff8880107b44e0) Cc: stable@vger.kernel.org Fixes: 7d9485e2c53c ("Staging: udlfb: Add functions to expose sysfs metrics and controls") Reported-by: co+ed9902f2e44184d9@bugs.sh Closes: https://lore.kernel.org/all/1jSCSNaDKmuUG7h40rTsSl1rMaSwdlJef4rp%40bugs.sh/ Assisted-by: Claude:claude-opus-5 Signed-off-by: Xiang Mei Link: https://lore.kernel.org/all/1jSCSNaDKmuUG7h40rTsSl1rMaSwdlJef4rp%40bugs.sh/ Signed-off-by: Helge Deller --- drivers/video/fbdev/udlfb.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/video/fbdev/udlfb.c b/drivers/video/fbdev/udlfb.c index e78d6f95c9c5..92b352bc7e96 100644 --- a/drivers/video/fbdev/udlfb.c +++ b/drivers/video/fbdev/udlfb.c @@ -1293,6 +1293,11 @@ static int dlfb_setup_modes(struct dlfb_data *dlfb, goto error; } + if (dlfb->fb_count) { + result = -EINVAL; + goto error; + } + fb_destroy_modelist(&info->modelist); memset(&info->monspecs, 0, sizeof(info->monspecs)); From 0c9cb9321cb3863b52bdea4b8ae5a27705762c9e Mon Sep 17 00:00:00 2001 From: Andrey Misiurov Date: Mon, 12 Oct 2026 19:53:38 +0200 Subject: [PATCH 03/53] fbdev: core: Initialize modelist in framebuffer_alloc() framebuffer_alloc() returns zeroed memory, so info->modelist starts out with NULL next and prev pointers. The list head is initialized only later, by fb_videomode_to_modelist() or by do_register_framebuffer(). The "fix potential memory leak" commits listed below added fb_destroy_modelist(&info->modelist) to the probe error paths of s3fb, tdfxfb, tridentfb, i740fb and carminefb. These paths can run before the list head is initialized: - s3fb, tdfxfb, tridentfb and i740fb call fb_videomode_to_modelist() only after a successful EDID read, and tridentfb can also hit the error path on an ioremap() or kmalloc() failure before that; - carminefb jumps to the error path when fb_find_mode() fails, before its fb_videomode_to_modelist() call. fb_destroy_modelist() then dereferences the NULL head. Reproduced on Debian 12 (6.1.180) by binding s3fb to a VGA device without EDID and forcing fb_alloc_cmap() to fail: s3fb 0000:00:03.0: cannot allocate colormap BUG: kernel NULL pointer dereference, address: 0000000000000000 RIP: 0010:fb_destroy_modelist+0x10/0x80 Call Trace: s3_pci_probe.cold+0x12b/0x2bf [s3fb] local_pci_probe+0x41/0x80 pci_device_probe+0xc3/0x240 really_probe+0xde/0x380 __driver_probe_device+0x84/0x150 driver_probe_device+0x1f/0x90 __driver_attach+0xce/0x1c0 bus_for_each_dev+0x87/0xd0 bus_add_driver+0x1ae/0x200 driver_register+0x89/0xe0 do_one_initcall+0x59/0x220 do_init_module+0x4a/0x1f0 Initialize the list head in framebuffer_alloc(), so info->modelist is always a valid, possibly empty, list and fb_destroy_modelist() is safe on every error path. Keep the lazy initialization in do_register_framebuffer(), as drivers that embed struct fb_info rather than calling framebuffer_alloc() still depend on it. Fixes: 3b0ed04bc852 ("fbdev: s3fb: fix potential memory leak in s3_pci_probe()") Fixes: bb019d755366 ("fbdev: tdfxfb: fix potential memory leak in tdfxfb_probe()") Fixes: 7a35ec619d9a ("fbdev: tridentfb: fix potential memory leak in trident_pci_probe()") Fixes: 5936063409af ("fbdev: i740fb: fix potential memory leak in i740fb_probe()") Fixes: 6fcca16a2b19 ("fbdev: carminefb: fix potential memory leak in alloc_carmine_fb()") Cc: stable@vger.kernel.org Signed-off-by: Andrey Misiurov Signed-off-by: Helge Deller --- drivers/video/fbdev/core/fb_info.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/video/fbdev/core/fb_info.c b/drivers/video/fbdev/core/fb_info.c index 52f9bd2c5417..05988a936beb 100644 --- a/drivers/video/fbdev/core/fb_info.c +++ b/drivers/video/fbdev/core/fb_info.c @@ -43,6 +43,7 @@ struct fb_info *framebuffer_alloc(size_t size, struct device *dev) info->device = dev; info->fbcon_rotate_hint = -1; info->blank = FB_BLANK_UNBLANK; + INIT_LIST_HEAD(&info->modelist); #if IS_ENABLED(CONFIG_FB_BACKLIGHT) mutex_init(&info->bl_curve_mutex); From 81ae1f9a6c850efab3e5dec6b7c9aa5c587f92b7 Mon Sep 17 00:00:00 2001 From: "Lorenzo Stoakes (ARM)" Date: Sat, 26 Sep 2026 14:16:59 +0100 Subject: [PATCH 04/53] fbdev: ssd1307fb: check for fb_deferred_io_init() error fb_deferred_io_init() allocates deferred I/O state, populating info->fbdefio_state, or leaving it NULL if an error occurs. Currently ssd1307fb_probe() ignores its return value. Therefore if an error arises in fb_deferred_io_init() (for instance, due to an allocation failure) info->fbdefio_state is left NULL. When the file is subsequently opened, fb_open() will dereference a NULL pointer (calling fb_deferred_io_open()). Fix this by checking for the error. Fixes: 56c134f7f1b5 ("fbdev: Track deferred-I/O pages in pageref struct") Cc: stable@vger.kernel.org Signed-off-by: Lorenzo Stoakes (ARM) Signed-off-by: Helge Deller --- drivers/video/fbdev/ssd1307fb.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/video/fbdev/ssd1307fb.c b/drivers/video/fbdev/ssd1307fb.c index 4d185c754284..8fd96c37ee1a 100644 --- a/drivers/video/fbdev/ssd1307fb.c +++ b/drivers/video/fbdev/ssd1307fb.c @@ -767,7 +767,11 @@ static int ssd1307fb_probe(struct i2c_client *client) info->fix.smem_start = __pa(vmem); info->fix.smem_len = vmem_size; - fb_deferred_io_init(info); + ret = fb_deferred_io_init(info); + if (ret) { + dev_err(dev, "failed to init fb deferred io: %d\n", ret); + goto fb_defio_error; + } i2c_set_clientdata(client, info); From 5b234b0dd29d79207c059c7b40851dd1e934fa3a Mon Sep 17 00:00:00 2001 From: "Lorenzo Stoakes (ARM)" Date: Sat, 26 Sep 2026 14:17:00 +0100 Subject: [PATCH 05/53] fbdev: xen-fbfront: check for fb_deferred_io_init() error fb_deferred_io_init() allocates deferred I/O state, populating info->fbdefio_state, or leaving it NULL if an error occurs. Currently xenfb_probe() ignores its return value. Therefore if an error arises in fb_deferred_io_init() (for instance, due to an allocation failure) info->fbdefio_state is left NULL. When the file is subsequently opened, fb_open() will dereference a NULL pointer (calling fb_deferred_io_open()). Fix this by checking for the error. Fixes: 56c134f7f1b5 ("fbdev: Track deferred-I/O pages in pageref struct") Cc: stable@vger.kernel.org Signed-off-by: Lorenzo Stoakes (ARM) Signed-off-by: Helge Deller --- drivers/video/fbdev/xen-fbfront.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/video/fbdev/xen-fbfront.c b/drivers/video/fbdev/xen-fbfront.c index 4385976277ac..7ef909d4242d 100644 --- a/drivers/video/fbdev/xen-fbfront.c +++ b/drivers/video/fbdev/xen-fbfront.c @@ -443,7 +443,11 @@ static int xenfb_probe(struct xenbus_device *dev, } fb_info->fbdefio = &xenfb_defio; - fb_deferred_io_init(fb_info); + ret = fb_deferred_io_init(fb_info); + if (ret < 0) { + xenbus_dev_fatal(dev, ret, "fb_deferred_io_init"); + goto error_cmap; + } xenfb_init_shared_page(info, fb_info); @@ -465,6 +469,7 @@ static int xenfb_probe(struct xenbus_device *dev, error_fb: fb_deferred_io_cleanup(fb_info); +error_cmap: fb_dealloc_cmap(&fb_info->cmap); framebuffer_release(fb_info); error_nomem: From feade898fc958ff355101adf12d5632272e64220 Mon Sep 17 00:00:00 2001 From: "Lorenzo Stoakes (ARM)" Date: Sat, 26 Sep 2026 14:17:01 +0100 Subject: [PATCH 06/53] HID: picoLCD: check for fb_deferred_io_init() error fb_deferred_io_init() allocates deferred I/O state, populating info->fbdefio_state, or leaving it NULL if an error occurs. Currently picolcd_init_framebuffer() ignores its return value. Therefore if an error arises in fb_deferred_io_init() (for instance, due to an allocation failure) info->fbdefio_state is left NULL. When the file is subsequently opened, fb_open() will dereference a NULL pointer (calling fb_deferred_io_open()). Fix this by checking for the error. Also correct cleanup ordering - defio is initialised after the sysfs file, so cleanup defio first. Fixes: 56c134f7f1b5 ("fbdev: Track deferred-I/O pages in pageref struct") Cc: stable@vger.kernel.org Signed-off-by: Lorenzo Stoakes (ARM) Signed-off-by: Helge Deller --- drivers/hid/hid-picolcd_fb.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/drivers/hid/hid-picolcd_fb.c b/drivers/hid/hid-picolcd_fb.c index 8c28e982e09d..a016dd9ca847 100644 --- a/drivers/hid/hid-picolcd_fb.c +++ b/drivers/hid/hid-picolcd_fb.c @@ -531,17 +531,23 @@ int picolcd_init_framebuffer(struct picolcd_data *data) goto err_cleanup; } - fb_deferred_io_init(info); + error = fb_deferred_io_init(info); + if (error) { + dev_err(dev, "failed to initialize deferred I/O\n"); + goto err_sysfs; + } + error = register_framebuffer(info); if (error) { dev_err(dev, "failed to register framebuffer\n"); - goto err_sysfs; + goto err_defio; } return 0; +err_defio: + fb_deferred_io_cleanup(info); err_sysfs: device_remove_file(dev, &dev_attr_fb_update_rate); - fb_deferred_io_cleanup(info); err_cleanup: data->fb_info = NULL; From eae055f33e41e1d3e1a7e905bdcb1e9f196ed31d Mon Sep 17 00:00:00 2001 From: "Lorenzo Stoakes (ARM)" Date: Sat, 26 Sep 2026 14:17:02 +0100 Subject: [PATCH 07/53] fbdev: udlfb: check for fb_deferred_io_init() error fb_deferred_io_init() allocates deferred I/O state, populating info->fbdefio_state, or leaving it NULL if an error occurs. Currently dlfb_ops_open() ignores its return value. Therefore if an error arises in fb_deferred_io_init() (for instance, due to an allocation failure) info->fbdefio_state is left NULL. fb_open() will then dereference a NULL pointer (calling fb_deferred_io_open()) as soon as dlfb_ops_open() returns. Additionally, if the allocation of info->fbdefio itself fails, dlfb_ops_open() sets info->fbdefio to NULL and invokes fb_deferred_io_init() regardless, hitting BUG_ON(!fbdefio). Fix this by only invoking fb_deferred_io_init() if the allocation succeeded, and checking for the error. The driver already supports operating without deferred I/O, so in either case fall back to that by setting info->fbdefio to NULL. The ignored return value was introduced in commit 56c134f7f1b5 ("fbdev: Track deferred-I/O pages in pageref struct"). However, the BUG_ON() issue originates from the earlier commit 5bea1fbf9423 ("staging: udlfb: fix incorrect fb_defio implementation for multiple framebuffers"), so target that for the fix. Fixes: 5bea1fbf9423 ("staging: udlfb: fix incorrect fb_defio implementation for multiple framebuffers") Cc: stable@vger.kernel.org Signed-off-by: Lorenzo Stoakes (ARM) Signed-off-by: Helge Deller --- drivers/video/fbdev/udlfb.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/drivers/video/fbdev/udlfb.c b/drivers/video/fbdev/udlfb.c index 92b352bc7e96..8b7b4bdac4fb 100644 --- a/drivers/video/fbdev/udlfb.c +++ b/drivers/video/fbdev/udlfb.c @@ -947,10 +947,13 @@ static int dlfb_ops_open(struct fb_info *info, int user) fbdefio->delay = DL_DEFIO_WRITE_DELAY; fbdefio->sort_pagereflist = true; fbdefio->deferred_io = dlfb_dpy_deferred_io; - } - info->fbdefio = fbdefio; - fb_deferred_io_init(info); + info->fbdefio = fbdefio; + if (fb_deferred_io_init(info)) { + kfree(fbdefio); + info->fbdefio = NULL; + } + } } dev_dbg(info->dev, "open, user=%d fb_info=%p count=%d\n", From 8ea6c6e77ccf887f3e68c64f4c261071a345da1e Mon Sep 17 00:00:00 2001 From: "Lorenzo Stoakes (ARM)" Date: Sat, 26 Sep 2026 14:17:03 +0100 Subject: [PATCH 08/53] fbdev: smscufx: check for fb_deferred_io_init() error fb_deferred_io_init() allocates deferred I/O state, populating info->fbdefio_state, or leaving it NULL if an error occurs. Currently ufx_ops_open() ignores its return value. Therefore if an error arises in fb_deferred_io_init() (for instance, due to an allocation failure) info->fbdefio_state is left NULL. fb_open() will then dereference a NULL pointer (calling fb_deferred_io_open()) as soon as ufx_ops_open() returns. Additionally, if the allocation of info->fbdefio itself fails, ufx_ops_open() sets info->fbdefio to NULL and invokes fb_deferred_io_init() regardless, hitting BUG_ON(!fbdefio). Fix this by only invoking fb_deferred_io_init() if the allocation succeeded, and checking for the error. The driver already supports operating without deferred I/O, so in either case fall back to that by setting info->fbdefio to NULL. The ignored return value was introduced in commit 56c134f7f1b5 ("fbdev: Track deferred-I/O pages in pageref struct"). However, the BUG_ON() issue originates from the earlier commit 3c8a63e22a08 ("Add support for SMSC UFX6000/7000 USB display adapters"), so target that for the fix. Fixes: 3c8a63e22a08 ("Add support for SMSC UFX6000/7000 USB display adapters") Cc: stable@vger.kernel.org Signed-off-by: Lorenzo Stoakes (ARM) Signed-off-by: Helge Deller --- drivers/video/fbdev/smscufx.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/drivers/video/fbdev/smscufx.c b/drivers/video/fbdev/smscufx.c index 5704f60e1741..34d8abd5b354 100644 --- a/drivers/video/fbdev/smscufx.c +++ b/drivers/video/fbdev/smscufx.c @@ -1041,10 +1041,13 @@ static int ufx_ops_open(struct fb_info *info, int user) if (fbdefio) { fbdefio->delay = UFX_DEFIO_WRITE_DELAY; fbdefio->deferred_io = ufx_dpy_deferred_io; - } - info->fbdefio = fbdefio; - fb_deferred_io_init(info); + info->fbdefio = fbdefio; + if (fb_deferred_io_init(info)) { + kfree(fbdefio); + info->fbdefio = NULL; + } + } } pr_debug("open /dev/fb%d user=%d fb_info=%p count=%d", From 5192201aaac2a923ff98306e3ccda58718ee395f Mon Sep 17 00:00:00 2001 From: "Lorenzo Stoakes (ARM)" Date: Sat, 26 Sep 2026 14:17:04 +0100 Subject: [PATCH 09/53] fbdev: sh_mobile_lcdc: check for fb_deferred_io_init() error fb_deferred_io_init() allocates deferred I/O state, populating info->fbdefio_state, or leaving it NULL if an error occurs. Currently sh_mobile_lcdc_start() ignores its return value. Therefore if an error arises in fb_deferred_io_init() (for instance, due to an allocation failure) info->fbdefio_state is left NULL. When the file is subsequently opened, fb_open() will dereference a NULL pointer (calling fb_deferred_io_open()). Fix this by checking for the error. Also clear info->fbdefio in that case, so that sh_mobile_lcdc_stop() does not attempt to clean up deferred I/O state that was never initialised. Fixes: 56c134f7f1b5 ("fbdev: Track deferred-I/O pages in pageref struct") Cc: stable@vger.kernel.org Signed-off-by: Lorenzo Stoakes (ARM) Signed-off-by: Helge Deller --- drivers/video/fbdev/sh_mobile_lcdcfb.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/video/fbdev/sh_mobile_lcdcfb.c b/drivers/video/fbdev/sh_mobile_lcdcfb.c index 5743c96d5481..a8ef7c599391 100644 --- a/drivers/video/fbdev/sh_mobile_lcdcfb.c +++ b/drivers/video/fbdev/sh_mobile_lcdcfb.c @@ -1042,7 +1042,11 @@ static int sh_mobile_lcdc_start(struct sh_mobile_lcdc_priv *priv) ch->defio.deferred_io = sh_mobile_lcdc_deferred_io; ch->defio.delay = msecs_to_jiffies(tmp); ch->info->fbdefio = &ch->defio; - fb_deferred_io_init(ch->info); + ret = fb_deferred_io_init(ch->info); + if (ret) { + ch->info->fbdefio = NULL; + return ret; + } } sh_mobile_lcdc_display_on(ch); From 20b3b97cf89cb381bf07516090d99399cc9b91fd Mon Sep 17 00:00:00 2001 From: Yibo Tan Date: Tue, 15 Sep 2026 22:45:28 +0800 Subject: [PATCH 10/53] fbdev: atmel_lcdfb: Prevent FIFO work after removal The LCD controller IRQ schedules sinfo->task to recover from a FIFO underflow. Probe currently requests the IRQ before initializing the work, so an early interrupt can schedule an uninitialized work item. The probe error path and remove path cancel the work before freeing the IRQ. A FIFO-underflow interrupt can schedule the work again after that cancellation. framebuffer_release() may then free sinfo while the work is still pending. KASAN reported a use-after-free in atmel_lcdfb_task() when an underflow interrupt occurred during removal. With the IRQ freed before the work was cancelled, the same test completed without a kernel diagnostic. Initialize the work before requesting the IRQ. In both cleanup paths, free the IRQ before cancelling the work so that it cannot be scheduled again after cancellation. Fixes: d22579b83735 ("atmel_lcdfb: FIFO underflow management") Cc: stable@vger.kernel.org Assisted-by: Codex:GPT-5 Signed-off-by: Yibo Tan Signed-off-by: Helge Deller --- drivers/video/fbdev/atmel_lcdfb.c | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/drivers/video/fbdev/atmel_lcdfb.c b/drivers/video/fbdev/atmel_lcdfb.c index 53f0156992e6..9a0cc09004b7 100644 --- a/drivers/video/fbdev/atmel_lcdfb.c +++ b/drivers/video/fbdev/atmel_lcdfb.c @@ -1146,6 +1146,9 @@ static int atmel_lcdfb_probe(struct platform_device *pdev) /* Initialize PWM for contrast or backlight ("off") */ init_contrast(sinfo); + /* Some LCDC recovery operations require process context. */ + INIT_WORK(&sinfo->task, atmel_lcdfb_task); + /* interrupt */ ret = request_irq(sinfo->irq_base, atmel_lcdfb_interrupt, 0, pdev->name, info); if (ret) { @@ -1153,10 +1156,6 @@ static int atmel_lcdfb_probe(struct platform_device *pdev) goto unmap_mmio; } - /* Some operations on the LCDC might sleep and - * require a preemptible task context */ - INIT_WORK(&sinfo->task, atmel_lcdfb_task); - ret = atmel_lcdfb_init_fbinfo(sinfo); if (ret < 0) { dev_err(dev, "init fbinfo failed: %d\n", ret); @@ -1192,8 +1191,8 @@ static int atmel_lcdfb_probe(struct platform_device *pdev) dev_set_drvdata(dev, NULL); fb_dealloc_cmap(&info->cmap); unregister_irqs: - cancel_work_sync(&sinfo->task); free_irq(sinfo->irq_base, info); + cancel_work_sync(&sinfo->task); unmap_mmio: exit_backlight(sinfo); iounmap(sinfo->mmio); @@ -1230,6 +1229,7 @@ static void atmel_lcdfb_remove(struct platform_device *pdev) return; sinfo = info->par; + free_irq(sinfo->irq_base, info); cancel_work_sync(&sinfo->task); exit_backlight(sinfo); atmel_lcdfb_power_control(sinfo, 0); @@ -1238,7 +1238,6 @@ static void atmel_lcdfb_remove(struct platform_device *pdev) clk_put(sinfo->lcdc_clk); clk_put(sinfo->bus_clk); fb_dealloc_cmap(&info->cmap); - free_irq(sinfo->irq_base, info); iounmap(sinfo->mmio); release_mem_region(info->fix.mmio_start, info->fix.mmio_len); if (platform_get_resource(pdev, IORESOURCE_MEM, 1)) { From b71e0bb7ad40c005b167e9b48be3af5a3fa51974 Mon Sep 17 00:00:00 2001 From: Myeonghun Pak Date: Mon, 14 Sep 2026 20:38:34 -0400 Subject: [PATCH 11/53] fbdev: gxt4500: Release WC setup on probe failure gxt4500_probe() adds a write-combining range before allocating the cmap and registering the framebuffer. If a later step fails, the range is not released. Add the missing cleanup before unmapping the framebuffer, matching the successful remove path. This issue was identified during our ongoing static-analysis research while reviewing kernel code. Fixes: 38fc4d45fae5 ("gxt4500: Use arch_phys_wc_* for framebuffer") Assisted-by: LLM Co-developed-by: Ijae Kim Signed-off-by: Ijae Kim Signed-off-by: Myeonghun Pak Signed-off-by: Helge Deller --- drivers/video/fbdev/gxt4500.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/video/fbdev/gxt4500.c b/drivers/video/fbdev/gxt4500.c index 1ee0a1efa18e..906b8a0dea77 100644 --- a/drivers/video/fbdev/gxt4500.c +++ b/drivers/video/fbdev/gxt4500.c @@ -719,6 +719,7 @@ static int gxt4500_probe(struct pci_dev *pdev, const struct pci_device_id *ent) err_free_cmap: fb_dealloc_cmap(&info->cmap); err_unmap_all: + arch_phys_wc_del(par->wc_cookie); iounmap(info->screen_base); err_unmap_regs: iounmap(par->regs); From d3bc005a62945aec57059201092b12b7c955e5a7 Mon Sep 17 00:00:00 2001 From: Myeonghun Pak Date: Mon, 14 Sep 2026 20:52:43 -0400 Subject: [PATCH 12/53] fbdev: kyro: Release WC setup on registration failure If register_framebuffer() fails, kyrofb_probe() frees the framebuffer without releasing its write-combining range. Release the range before freeing the framebuffer. Earlier failures still skip this cleanup. The missing cleanup already exists in the initial Git import, before the conversion from mtrr_add() to arch_phys_wc_add(). This issue was identified during our ongoing static-analysis research while reviewing kernel code. Cc: stable@vger.kernel.org Assisted-by: LLM Co-developed-by: Ijae Kim Signed-off-by: Ijae Kim Signed-off-by: Myeonghun Pak Signed-off-by: Helge Deller --- drivers/video/fbdev/kyro/fbdev.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/video/fbdev/kyro/fbdev.c b/drivers/video/fbdev/kyro/fbdev.c index c23738988822..94d6af54e6c4 100644 --- a/drivers/video/fbdev/kyro/fbdev.c +++ b/drivers/video/fbdev/kyro/fbdev.c @@ -765,7 +765,7 @@ static int kyrofb_probe(struct pci_dev *pdev, const struct pci_device_id *ent) fb_memset_io(info->screen_base, 0, size); if (register_framebuffer(info) < 0) - goto out_free_fb; + goto out_free_wc; fb_info(info, "%s frame buffer device, at %dx%d@%d using %ldk/%ldk of VRAM\n", info->fix.id, @@ -776,6 +776,8 @@ static int kyrofb_probe(struct pci_dev *pdev, const struct pci_device_id *ent) return 0; +out_free_wc: + arch_phys_wc_del(currentpar->wc_cookie); out_free_fb: framebuffer_release(info); From 8710af6a35201a6d01b5af8f7e4bad29cc40467f Mon Sep 17 00:00:00 2001 From: Myeonghun Pak Date: Mon, 14 Sep 2026 20:54:47 -0400 Subject: [PATCH 13/53] fbdev: nvidia: Release write-combining handle on probe failure Failures in nvidia_set_fbinfo() or register_framebuffer() leave the handle from arch_phys_wc_add() allocated. Release it in the shared error path, as nvidiafb_remove() already does on normal removal. The missing cleanup was already present in the initial Git import, when the driver used mtrr_add() directly. This issue was identified during our ongoing static-analysis research while reviewing kernel code. Cc: stable@vger.kernel.org Assisted-by: LLM Co-developed-by: Ijae Kim Signed-off-by: Ijae Kim Signed-off-by: Myeonghun Pak Signed-off-by: Helge Deller --- drivers/video/fbdev/nvidia/nvidia.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/video/fbdev/nvidia/nvidia.c b/drivers/video/fbdev/nvidia/nvidia.c index 4ef7a5ba43cc..395f5d0455fa 100644 --- a/drivers/video/fbdev/nvidia/nvidia.c +++ b/drivers/video/fbdev/nvidia/nvidia.c @@ -1423,6 +1423,7 @@ static int nvidiafb_probe(struct pci_dev *pd, const struct pci_device_id *ent) return 0; err_out_iounmap_fb: + arch_phys_wc_del(par->wc_cookie); fb_destroy_modelist(&info->modelist); err_out_free_base1: fb_destroy_modedb(info->monspecs.modedb); From 8e7b98afecd734f6543c65550a265fa6b87b8feb Mon Sep 17 00:00:00 2001 From: Ethan Nelson-Moore Date: Mon, 14 Sep 2026 22:20:29 -0700 Subject: [PATCH 14/53] fbdev: acornfb: remove unused code for 26-bit hardware The acornfb driver contains code to support machines with a MEMC chip and without IOMD and VIDC20 chips. All 32-bit Acorn hardware has IOMD and VIDC20 chips and does not have a MEMC chip. Linux formerly supported 26-bit Acorn computers, but that support was removed in commit 99eb8a550dbc ("Remove the arm26 port") because it had bitrotted to the extent that it did not even compile. Remove this unused code. Also take the opportunity to remove incorrect file paths in the file headers, which are bad style regardless. Signed-off-by: Ethan Nelson-Moore Signed-off-by: Helge Deller --- drivers/video/fbdev/acornfb.c | 57 +++++++++-------------------------- drivers/video/fbdev/acornfb.h | 9 ++---- 2 files changed, 16 insertions(+), 50 deletions(-) diff --git a/drivers/video/fbdev/acornfb.c b/drivers/video/fbdev/acornfb.c index f0600f6ca254..30781679c90a 100644 --- a/drivers/video/fbdev/acornfb.c +++ b/drivers/video/fbdev/acornfb.c @@ -1,7 +1,5 @@ // SPDX-License-Identifier: GPL-2.0-only /* - * linux/drivers/video/acornfb.c - * * Copyright (C) 1998-2001 Russell King * * Frame buffer code for Acorn platforms @@ -94,7 +92,6 @@ static struct vidc_timing current_vidc; extern unsigned int vram_size; /* set by setup.c */ -#ifdef HAS_VIDC20 #include #define MAX_SIZE (2*1024*1024) @@ -306,7 +303,6 @@ acornfb_setcolreg(u_int regno, u_int red, u_int green, u_int blue, return 0; } -#endif /* * Before selecting the timing parameters, adjust @@ -390,7 +386,6 @@ acornfb_adjust_timing(struct fb_info *info, struct fb_var_screeninfo *var, u_int /* hsync_len must be even */ var->hsync_len = (var->hsync_len + 1) & ~1; -#if defined(HAS_VIDC20) /* left_margin must be even */ if (var->left_margin & 1) { var->left_margin += 1; @@ -400,7 +395,6 @@ acornfb_adjust_timing(struct fb_info *info, struct fb_var_screeninfo *var, u_int /* right_margin must be even */ if (var->right_margin & 1) var->right_margin += 1; -#endif if (var->vsync_len < 1) var->vsync_len = 1; @@ -436,11 +430,7 @@ acornfb_update_dma(struct fb_info *info, struct fb_var_screeninfo *var) { u_int off = var->yoffset * info->fix.line_length; -#if defined(HAS_MEMC) - memc_write(VDMA_INIT, off >> 2); -#elif defined(HAS_IOMD) iomd_writel(info->fix.smem_start + off, IOMD_VIDINIT); -#endif } static int @@ -469,7 +459,6 @@ acornfb_check_var(struct fb_var_screeninfo *var, struct fb_info *info) var->transp.length = 0; break; -#ifdef HAS_VIDC20 case 16: var->red.offset = 0; var->red.length = 5; @@ -491,7 +480,6 @@ acornfb_check_var(struct fb_var_screeninfo *var, struct fb_info *info) var->transp.offset = 24; var->transp.length = 4; break; -#endif default: return -EINVAL; } @@ -519,6 +507,9 @@ acornfb_check_var(struct fb_var_screeninfo *var, struct fb_info *info) static int acornfb_set_par(struct fb_info *info) { + unsigned long start, size; + u_int control; + switch (info->var.bits_per_pixel) { case 1: current_par.palette_size = 2; @@ -536,7 +527,6 @@ static int acornfb_set_par(struct fb_info *info) current_par.palette_size = VIDC_PALETTE_SIZE; info->fix.visual = FB_VISUAL_PSEUDOCOLOR; break; -#ifdef HAS_VIDC20 case 16: current_par.palette_size = 32; info->fix.visual = FB_VISUAL_DIRECTCOLOR; @@ -545,41 +535,26 @@ static int acornfb_set_par(struct fb_info *info) current_par.palette_size = VIDC_PALETTE_SIZE; info->fix.visual = FB_VISUAL_DIRECTCOLOR; break; -#endif default: BUG(); } info->fix.line_length = (info->var.xres * info->var.bits_per_pixel) / 8; -#if defined(HAS_MEMC) - { - unsigned long size = info->fix.smem_len - VDMA_XFERSIZE; + start = info->fix.smem_start; + size = current_par.screen_end; - memc_write(VDMA_START, 0); - memc_write(VDMA_END, size >> 2); + if (current_par.using_vram) { + size -= current_par.vram_half_sam; + control = DMA_CR_E | (current_par.vram_half_sam / 256); + } else { + size -= 16; + control = DMA_CR_E | DMA_CR_D | 16; } -#elif defined(HAS_IOMD) - { - unsigned long start, size; - u_int control; - start = info->fix.smem_start; - size = current_par.screen_end; - - if (current_par.using_vram) { - size -= current_par.vram_half_sam; - control = DMA_CR_E | (current_par.vram_half_sam / 256); - } else { - size -= 16; - control = DMA_CR_E | DMA_CR_D | 16; - } - - iomd_writel(start, IOMD_VIDSTART); - iomd_writel(size, IOMD_VIDEND); - iomd_writel(control, IOMD_VIDCR); - } -#endif + iomd_writel(start, IOMD_VIDSTART); + iomd_writel(size, IOMD_VIDEND); + iomd_writel(control, IOMD_VIDCR); acornfb_update_dma(info, &info->var); acornfb_set_timing(info); @@ -709,10 +684,8 @@ static void acornfb_init_fbinfo(void) */ memset(&fb_info.var, 0, sizeof(fb_info.var)); -#if defined(HAS_VIDC20) fb_info.var.red.length = 8; fb_info.var.transp.length = 4; -#endif fb_info.var.green = fb_info.var.red; fb_info.var.blue = fb_info.var.red; fb_info.var.nonstd = 0; @@ -991,7 +964,6 @@ static int acornfb_probe(struct platform_device *dev) size = PAGE_ALIGN(size); -#if defined(HAS_VIDC20) if (!current_par.using_vram) { dma_addr_t handle; void *base; @@ -1011,7 +983,6 @@ static int acornfb_probe(struct platform_device *dev) fb_info.screen_base = base; fb_info.fix.smem_start = handle; } -#endif fb_info.fix.smem_len = size; current_par.palette_size = VIDC_PALETTE_SIZE; diff --git a/drivers/video/fbdev/acornfb.h b/drivers/video/fbdev/acornfb.h index f8df4ecb4fd7..c5d0fa04adc8 100644 --- a/drivers/video/fbdev/acornfb.h +++ b/drivers/video/fbdev/acornfb.h @@ -1,16 +1,14 @@ /* SPDX-License-Identifier: GPL-2.0-only */ /* - * linux/drivers/video/acornfb.h - * * Copyright (C) 1998,1999 Russell King * * Frame buffer code for Acorn platforms */ -#if defined(HAS_VIDC20) + #include + #define VIDC_PALETTE_SIZE 256 #define VIDC_NAME "VIDC20" -#endif #define EXTEND8(x) ((x)|(x)<<8) #define EXTEND4(x) ((x)|(x)<<4|(x)<<8|(x)<<12) @@ -94,7 +92,6 @@ struct modex_params { const struct modey_params *modey; }; -#ifdef HAS_VIDC20 /* * VIDC20 registers */ @@ -162,5 +159,3 @@ struct modex_params { #define VIDC20_DCTL_VRAM_PXCLK (1 << 18) #define VIDC20_DCTL_VRAM_PXCLK2 (2 << 18) #define VIDC20_DCTL_VRAM_PXCLK4 (3 << 18) - -#endif From 92198ec63465f44fee641a70f32a57b73267e15c Mon Sep 17 00:00:00 2001 From: Myeonghun Pak Date: Thu, 10 Sep 2026 20:08:35 -0400 Subject: [PATCH 15/53] fbdev: sstfb: use managed PCI device enable sstfb_probe() enables the PCI device with pci_enable_device(), but failure paths after that point return without disabling it. The successful probe path has the same imbalance because sstfb_remove() releases the framebuffer, mappings and memory regions, but never calls pci_disable_device(). Use pcim_enable_device() so the PCI core disables the device automatically after probe failure or driver removal. The driver still releases its framebuffer, mappings and memory regions explicitly. This issue was identified during our ongoing static-analysis research while reviewing kernel code. Co-developed-by: Ijae Kim Signed-off-by: Ijae Kim Signed-off-by: Myeonghun Pak Signed-off-by: Helge Deller --- drivers/video/fbdev/sstfb.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/video/fbdev/sstfb.c b/drivers/video/fbdev/sstfb.c index 2745557822f7..039279feb5bf 100644 --- a/drivers/video/fbdev/sstfb.c +++ b/drivers/video/fbdev/sstfb.c @@ -1332,7 +1332,8 @@ static int sstfb_probe(struct pci_dev *pdev, const struct pci_device_id *id) return err; /* Enable device in PCI config. */ - if ((err=pci_enable_device(pdev))) { + err = pcim_enable_device(pdev); + if (err) { printk(KERN_ERR "cannot enable device\n"); return err; } From 8f5ba51fa0431b1172f8d65a048b83f7f53d6526 Mon Sep 17 00:00:00 2001 From: Helge Deller Date: Sat, 12 Sep 2026 18:16:24 +0200 Subject: [PATCH 16/53] fbdev: Drop unused FB_IOMEM_HELPERS_DEFERRED Kconfig option Signed-off-by: Helge Deller Noticed-by: Breno Rodrigues Alves --- drivers/video/fbdev/core/Kconfig | 6 ------ 1 file changed, 6 deletions(-) diff --git a/drivers/video/fbdev/core/Kconfig b/drivers/video/fbdev/core/Kconfig index 8d1993e0b591..14860a1ae6bc 100644 --- a/drivers/video/fbdev/core/Kconfig +++ b/drivers/video/fbdev/core/Kconfig @@ -155,12 +155,6 @@ config FB_IOMEM_HELPERS select FB_CFB_IMAGEBLIT select FB_IOMEM_FOPS -config FB_IOMEM_HELPERS_DEFERRED - bool - depends on FB_CORE - select FB_DEFERRED_IO - select FB_IOMEM_HELPERS - config FB_SYSMEM_HELPERS bool depends on FB_CORE From 7f9e766102031228721d6216b3ef4024399754aa Mon Sep 17 00:00:00 2001 From: Hemanth Selam Date: Fri, 4 Sep 2026 17:52:49 +0530 Subject: [PATCH 17/53] fbdev: s1d13xxxfb: fix typos in comments Assisted-by: Cursor:claude-opus-5 Signed-off-by: Hemanth Selam Signed-off-by: Helge Deller --- drivers/video/fbdev/s1d13xxxfb.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/video/fbdev/s1d13xxxfb.c b/drivers/video/fbdev/s1d13xxxfb.c index e80c806ef520..ab09790d6268 100644 --- a/drivers/video/fbdev/s1d13xxxfb.c +++ b/drivers/video/fbdev/s1d13xxxfb.c @@ -400,7 +400,7 @@ s1d13xxxfb_pan_display(struct fb_var_screeninfo *var, struct fb_info *info) /** * bltbit_wait_bitclear - waits for change in register value - * @info : frambuffer structure + * @info : framebuffer structure * @bit : value currently in register * @timeout : ... * @@ -426,7 +426,7 @@ bltbit_wait_bitclear(struct fb_info *info, u8 bit, int timeout) * @info : framebuffer structure * @area : fb_copyarea structure * - * supports (atleast) S1D13506 + * supports (at least) S1D13506 * */ static void @@ -516,7 +516,7 @@ s1d13xxxfb_bitblt_copyarea(struct fb_info *info, const struct fb_copyarea *area) * @info : framebuffer structure * @rect : fb_fillrect structure * - * supports (atleast 13506) + * supports (at least 13506) * **/ static void From 0706874c53f192c3700bacfb3030d935735d7366 Mon Sep 17 00:00:00 2001 From: Hemanth Selam Date: Sat, 12 Sep 2026 18:30:44 +0200 Subject: [PATCH 18/53] fbdev: sticore: fix typos in comments Assisted-by: Cursor:claude-opus-5 Signed-off-by: Hemanth Selam Signed-off-by: Helge Deller --- drivers/video/sticore.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/video/sticore.c b/drivers/video/sticore.c index 1d4477f20450..6876a03c464a 100644 --- a/drivers/video/sticore.c +++ b/drivers/video/sticore.c @@ -389,7 +389,7 @@ static int sti_font_setup(char *str) * - sti_font= ( = 1,2,3,...) * most STI ROMs have built-in HP specific fonts, which can be selected * by giving the desired number to the sticon driver. - * NOTE: This number is machine and STI ROM dependend. + * NOTE: This number is machine and STI ROM dependent. * - sti_font=x (e.g. sti_font=16x8) * and gives hints to the height and width of the * font which the user wants. The sticon driver will try to use From 8c96ce3f4f40222354a086e02f5229679db7aa25 Mon Sep 17 00:00:00 2001 From: Hemanth Selam Date: Sat, 12 Sep 2026 18:32:00 +0200 Subject: [PATCH 19/53] fbdev: viafb: fix typos in comments Assisted-by: Cursor:claude-opus-5 Signed-off-by: Hemanth Selam Signed-off-by: Helge Deller --- drivers/video/fbdev/via/dvi.c | 6 +++--- drivers/video/fbdev/via/hw.c | 2 +- drivers/video/fbdev/via/viafbdev.c | 4 ++-- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/drivers/video/fbdev/via/dvi.c b/drivers/video/fbdev/via/dvi.c index 27990a73bfa3..845f51322697 100644 --- a/drivers/video/fbdev/via/dvi.c +++ b/drivers/video/fbdev/via/dvi.c @@ -399,7 +399,7 @@ void viafb_dvi_enable(void) tmds_register_write(0x88, 0x3b); else /*clear CR91[5] to direct on display period - in the secondary diplay path */ + in the secondary display path */ via_write_reg_mask(VIACR, 0x91, 0x00, 0x20); break; @@ -407,12 +407,12 @@ void viafb_dvi_enable(void) if (viaparinfo->chip_info->gfx_chip_name == UNICHROME_CLE266) viafb_write_reg_mask(CR93, VIACR, 0x21, BIT0 + BIT5); - /*fix dvi cann't be enabled with MB VT5718C4 - Al Zhang */ + /* fix dvi can't be enabled with MB VT5718C4 - Al Zhang */ if (viaparinfo->chip_info->gfx_chip_name == UNICHROME_CLE266) tmds_register_write(0x88, 0x3b); else /*clear CR91[5] to direct on display period - in the secondary diplay path */ + in the secondary display path */ via_write_reg_mask(VIACR, 0x91, 0x00, 0x20); /*fix DVI cannot enable on EPIA-M board */ diff --git a/drivers/video/fbdev/via/hw.c b/drivers/video/fbdev/via/hw.c index 66afd7be00cc..e9d0fac8fb17 100644 --- a/drivers/video/fbdev/via/hw.c +++ b/drivers/video/fbdev/via/hw.c @@ -1542,7 +1542,7 @@ static void init_gfx_chip_info(int chip_type) else viaparinfo->chip_info->gfx_chip_revision = CLE266_REVISION_CX; - /* restore orignal CR4F value */ + /* restore original CR4F value */ viafb_write_reg(CR4F, VIACR, tmp); } diff --git a/drivers/video/fbdev/via/viafbdev.c b/drivers/video/fbdev/via/viafbdev.c index dd9374e8ad09..2c67a18d16ad 100644 --- a/drivers/video/fbdev/via/viafbdev.c +++ b/drivers/video/fbdev/via/viafbdev.c @@ -190,7 +190,7 @@ static int viafb_check_var(struct fb_var_screeninfo *var, DEBUG_MSG(KERN_INFO "viafb_check_var!\n"); /* Sanity check */ - /* HW neither support interlacte nor double-scaned mode */ + /* HW neither support interlacte nor double-scanned mode */ if (var->vmode & FB_VMODE_INTERLACED || var->vmode & FB_VMODE_DOUBLE) return -EINVAL; @@ -765,7 +765,7 @@ static int viafb_cursor(struct fb_info *info, struct fb_cursor *cursor) if (info->flags & FBINFO_HWACCEL_DISABLED || info != viafbinfo) return -ENODEV; - /* LCD ouput does not support hw cursors (at least on VN896) */ + /* LCD output does not support hw cursors (at least on VN896) */ if ((chip_name == UNICHROME_CLE266 && viapar->iga_path == IGA2) || viafb_LCD_ON) return -ENODEV; From 9776303082e15c39c4bee47af9c034d63f810838 Mon Sep 17 00:00:00 2001 From: Hemanth Selam Date: Sat, 12 Sep 2026 18:32:21 +0200 Subject: [PATCH 20/53] fbdev: sstfb: fix typos in comments Assisted-by: Cursor:claude-opus-5 Signed-off-by: Hemanth Selam Signed-off-by: Helge Deller --- drivers/video/fbdev/sstfb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/video/fbdev/sstfb.c b/drivers/video/fbdev/sstfb.c index 039279feb5bf..8e2c2421028d 100644 --- a/drivers/video/fbdev/sstfb.c +++ b/drivers/video/fbdev/sstfb.c @@ -15,7 +15,7 @@ * 09/2002 Helge Deller * (enable driver on big-endian machines (hppa), ioctl fixes) * 12/2002 Helge Deller - * (port driver to new frambuffer infrastructure) + * (port driver to new framebuffer infrastructure) * 01/2003 Helge Deller * (initial work on fb hardware acceleration for voodoo2) * 08/2006 Alan Cox From ef20d37db20526660912c196adc85b46ac57843f Mon Sep 17 00:00:00 2001 From: Hemanth Selam Date: Sat, 12 Sep 2026 18:32:32 +0200 Subject: [PATCH 21/53] fbdev: tgafb: fix typos in comments Assisted-by: Cursor:claude-opus-5 Signed-off-by: Hemanth Selam Signed-off-by: Helge Deller --- drivers/video/fbdev/tgafb.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/video/fbdev/tgafb.c b/drivers/video/fbdev/tgafb.c index dccfc38cfbd5..32296f926196 100644 --- a/drivers/video/fbdev/tgafb.c +++ b/drivers/video/fbdev/tgafb.c @@ -884,7 +884,7 @@ tgafb_clut_imageblit(struct fb_info *info, const struct fb_image *image) /** * tgafb_imageblit - REQUIRED function. Can use generic routines if - * non acclerated hardware and packed pixel based. + * non accelerated hardware and packed pixel based. * Copies a image from system memory to the screen. * * @info: frame buffer structure that represents a single frame buffer @@ -921,7 +921,7 @@ tgafb_imageblit(struct fb_info *info, const struct fb_image *image) /** * tgafb_fillrect - REQUIRED function. Can use generic routines if - * non acclerated hardware and packed pixel based. + * non accelerated hardware and packed pixel based. * Draws a rectangle on the screen. * * @info: frame buffer structure that represents a single frame buffer @@ -1047,7 +1047,7 @@ tgafb_fillrect(struct fb_info *info, const struct fb_fillrect *rect) /* * tgafb_copyarea - REQUIRED function. Can use generic routines if - * non acclerated hardware and packed pixel based. + * non accelerated hardware and packed pixel based. * Copies on area of the screen to another area. * * @info: frame buffer structure that represents a single frame buffer From b2c10f386c583d55ebbae368a0f6c9cb3f00d3e4 Mon Sep 17 00:00:00 2001 From: Hemanth Selam Date: Sat, 12 Sep 2026 18:32:45 +0200 Subject: [PATCH 22/53] fbdev: tridentfb: fix typos in comments Assisted-by: Cursor:claude-opus-5 Signed-off-by: Hemanth Selam Signed-off-by: Helge Deller --- drivers/video/fbdev/tridentfb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/video/fbdev/tridentfb.c b/drivers/video/fbdev/tridentfb.c index 9f055ba776c8..6501f6e2615a 100644 --- a/drivers/video/fbdev/tridentfb.c +++ b/drivers/video/fbdev/tridentfb.c @@ -58,7 +58,7 @@ static struct fb_fix_screeninfo tridentfb_fix = { .accel = FB_ACCEL_NONE, }; -/* defaults which are normally overriden by user values */ +/* defaults which are normally overridden by user values */ /* video mode */ static char *mode_option; From abe386eac4dcbdf6a14ce565252d9e3c03ec53e1 Mon Sep 17 00:00:00 2001 From: Hemanth Selam Date: Sat, 12 Sep 2026 18:33:40 +0200 Subject: [PATCH 23/53] fbdev: mmp: fix typos in comments Assisted-by: Cursor:claude-opus-5 Signed-off-by: Hemanth Selam Signed-off-by: Helge Deller --- drivers/video/fbdev/mmp/core.c | 2 +- drivers/video/fbdev/mmp/hw/mmp_ctrl.c | 4 ++-- drivers/video/fbdev/mmp/hw/mmp_ctrl.h | 4 ++-- drivers/video/fbdev/mmp/hw/mmp_spi.c | 2 +- include/video/mmp_disp.h | 6 +++--- 5 files changed, 9 insertions(+), 9 deletions(-) diff --git a/drivers/video/fbdev/mmp/core.c b/drivers/video/fbdev/mmp/core.c index 3c35b0a3ea09..9d4fda2fc83f 100644 --- a/drivers/video/fbdev/mmp/core.c +++ b/drivers/video/fbdev/mmp/core.c @@ -65,7 +65,7 @@ static DEFINE_MUTEX(disp_lock); * @p: panel to be registered * * this function provides interface for panel drivers to register panel - * to panel_list and connect to path which matchs panel->plat_path_name. + * to panel_list and connect to path which matches panel->plat_path_name. * no error returns when no matching path is found as path register after * panel register is permitted. */ diff --git a/drivers/video/fbdev/mmp/hw/mmp_ctrl.c b/drivers/video/fbdev/mmp/hw/mmp_ctrl.c index 2c457da67a9f..3db608e5aef1 100644 --- a/drivers/video/fbdev/mmp/hw/mmp_ctrl.c +++ b/drivers/video/fbdev/mmp/hw/mmp_ctrl.c @@ -325,7 +325,7 @@ static void ctrl_set_default(struct mmphw_ctrl *ctrl) u32 tmp, irq_mask; /* - * LCD Global control(LCD_TOP_CTRL) should be configed before + * LCD Global control(LCD_TOP_CTRL) should be configured before * any other LCD registers read/write, or there maybe issues. */ tmp = readl_relaxed(ctrl->reg_base + LCD_TOP_CTRL); @@ -521,7 +521,7 @@ static int mmphw_probe(struct platform_device *pdev) /* init global regs */ ctrl_set_default(ctrl); - /* init pathes from machine info and register them */ + /* init paths from machine info and register them */ for (i = 0; i < ctrl->path_num; i++) { /* get from config and machine info */ path_plat = &ctrl->path_plats[i]; diff --git a/drivers/video/fbdev/mmp/hw/mmp_ctrl.h b/drivers/video/fbdev/mmp/hw/mmp_ctrl.h index 719b99a9bc77..b49d870df44f 100644 --- a/drivers/video/fbdev/mmp/hw/mmp_ctrl.h +++ b/drivers/video/fbdev/mmp/hw/mmp_ctrl.h @@ -1404,7 +1404,7 @@ struct mmphw_ctrl { int status; struct mutex access_ok; - /*pathes*/ + /* paths */ int path_num; struct mmphw_path_plat path_plats[] __counted_by(path_num); }; @@ -1434,7 +1434,7 @@ static inline void __iomem *ctrl_regs(struct mmp_path *path) return path_to_ctrl(path)->reg_base; } -/* path regs, for regs symmetrical for both pathes */ +/* path regs, for regs symmetrical for both paths */ static inline struct lcd_regs *path_regs(struct mmp_path *path) { if (path->id == PATH_PN) diff --git a/drivers/video/fbdev/mmp/hw/mmp_spi.c b/drivers/video/fbdev/mmp/hw/mmp_spi.c index 3f253f4271ac..8e6e8be441d2 100644 --- a/drivers/video/fbdev/mmp/hw/mmp_spi.c +++ b/drivers/video/fbdev/mmp/hw/mmp_spi.c @@ -1,7 +1,7 @@ // SPDX-License-Identifier: GPL-2.0-or-later /* * linux/drivers/video/mmp/hw/mmp_spi.c - * using the spi in LCD controler for commands send + * using the spi in LCD controller for commands send * * Copyright (C) 2012 Marvell Technology Group Ltd. * Authors: Guoqing Li diff --git a/include/video/mmp_disp.h b/include/video/mmp_disp.h index 41354bd49895..8f2b434da4e9 100644 --- a/include/video/mmp_disp.h +++ b/include/video/mmp_disp.h @@ -172,7 +172,7 @@ struct mmp_panel { /* use node to register to list */ struct list_head node; const char *name; - /* path name used to connect to proper path configed */ + /* path name used to connect to proper path configured */ const char *plat_path_name; struct device *dev; int panel_type; @@ -291,7 +291,7 @@ static inline int mmp_overlay_set_addr(struct mmp_overlay *overlay, * it defined a common interface that plat driver need to implement */ struct mmp_path_info { - /* driver data, set when registed*/ + /* driver data, set when registered */ const char *name; struct device *dev; int id; @@ -309,7 +309,7 @@ extern void mmp_unregister_path(struct mmp_path *path); extern void mmp_register_panel(struct mmp_panel *panel); extern void mmp_unregister_panel(struct mmp_panel *panel); -/* defintions for platform data */ +/* definitions for platform data */ /* interface for buffer driver */ struct mmp_buffer_driver_mach_info { const char *name; From 286e43f6c6b77a9f96cc57b80353f8f2e3b7e3fc Mon Sep 17 00:00:00 2001 From: Hemanth Selam Date: Sat, 12 Sep 2026 18:34:19 +0200 Subject: [PATCH 24/53] fbdev: au1100fb: fix typos in comments Assisted-by: Cursor:claude-opus-5 Signed-off-by: Hemanth Selam Signed-off-by: Helge Deller --- drivers/video/fbdev/au1100fb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/video/fbdev/au1100fb.c b/drivers/video/fbdev/au1100fb.c index 39f86ffb1ae3..01c836cb5205 100644 --- a/drivers/video/fbdev/au1100fb.c +++ b/drivers/video/fbdev/au1100fb.c @@ -528,7 +528,7 @@ static int au1100fb_setmode(struct au1100fb_device *fbdev) if (!info->var.rotate || (info->var.rotate == 180)) { words *= info->var.yres_virtual; if (info->var.rotate /* 180 */) { - words -= (words % 8); /* should be divisable by 8 */ + words -= (words % 8); /* should be divisible by 8 */ } } fbdev->regs->lcd_words = LCD_WRD_WRDS_N(words); From ebe989c9530ce98e05932d6e471ddba96f200a56 Mon Sep 17 00:00:00 2001 From: Hemanth Selam Date: Sat, 12 Sep 2026 18:34:32 +0200 Subject: [PATCH 25/53] fbdev: efifb: fix typos in comments Assisted-by: Cursor:claude-opus-5 Signed-off-by: Hemanth Selam Signed-off-by: Helge Deller --- drivers/video/fbdev/efifb.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/video/fbdev/efifb.c b/drivers/video/fbdev/efifb.c index ad8dec7807c3..e1c764854004 100644 --- a/drivers/video/fbdev/efifb.c +++ b/drivers/video/fbdev/efifb.c @@ -97,7 +97,7 @@ static int efifb_setcolreg(unsigned regno, unsigned red, unsigned green, } /* - * If fbcon deffered console takeover is configured, the intent is for the + * If fbcon deferred console takeover is configured, the intent is for the * framebuffer to show the boot graphics (e.g. vendor logo) until there is some * (error) message to display. But the boot graphics may have been destroyed by * e.g. option ROM output, detect this and restore the boot graphics. @@ -421,7 +421,7 @@ static int efifb_probe(struct platform_device *dev) size_vmode = efifb_defined.yres * efifb_fix.line_length; /* size_total -- all video memory we have. Used for - * entries, ressource allocation and bounds + * entries, resource allocation and bounds * checking. */ size_total = si->lfb_size; if (size_total < size_vmode) From 962bc9c4af3a42408c7c45dbd90db02c03360faf Mon Sep 17 00:00:00 2001 From: Hemanth Selam Date: Sat, 12 Sep 2026 18:34:50 +0200 Subject: [PATCH 26/53] fbdev: grvga: fix typos in comments Assisted-by: Cursor:claude-opus-5 Signed-off-by: Hemanth Selam Signed-off-by: Helge Deller --- drivers/video/fbdev/grvga.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/video/fbdev/grvga.c b/drivers/video/fbdev/grvga.c index a6594bcd74e8..771d9491b49e 100644 --- a/drivers/video/fbdev/grvga.c +++ b/drivers/video/fbdev/grvga.c @@ -432,7 +432,7 @@ static int grvga_probe(struct platform_device *dev) retval = -ENOMEM; goto dealloc_cmap; } - } else { /* Allocate frambuffer memory */ + } else { /* Allocate framebuffer memory */ unsigned long page; From 0b5126863bcbac84f800a860c87ee1151c380c6e Mon Sep 17 00:00:00 2001 From: Hemanth Selam Date: Sat, 12 Sep 2026 18:35:22 +0200 Subject: [PATCH 27/53] fbdev: kyro: fix typos in comments Assisted-by: Cursor:claude-opus-5 Signed-off-by: Hemanth Selam Signed-off-by: Helge Deller --- drivers/video/fbdev/kyro/STG4000OverlayDevice.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/video/fbdev/kyro/STG4000OverlayDevice.c b/drivers/video/fbdev/kyro/STG4000OverlayDevice.c index 9fde0e3b69ec..cb6fa0991fca 100644 --- a/drivers/video/fbdev/kyro/STG4000OverlayDevice.c +++ b/drivers/video/fbdev/kyro/STG4000OverlayDevice.c @@ -60,7 +60,7 @@ typedef struct _OVRL_SRC_DEST { u32 ulDstX2; u32 ulDstY2; - /*clipped pixel pos of source data within buffer thses need to be 128 bit word aligned */ + /* clipped pixel pos of source data within buffer these need to be 128 bit word aligned */ u32 ulSrcX1; u32 ulSrcY1; u32 ulSrcX2; From a9cb7304cf4471281be7938c9afa12a798bb8e7e Mon Sep 17 00:00:00 2001 From: Hemanth Selam Date: Sat, 12 Sep 2026 18:35:35 +0200 Subject: [PATCH 28/53] fbdev: maxinefb: fix typos in comments Assisted-by: Cursor:claude-opus-5 Signed-off-by: Hemanth Selam Signed-off-by: Helge Deller --- drivers/video/fbdev/maxinefb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/video/fbdev/maxinefb.c b/drivers/video/fbdev/maxinefb.c index 67d4bd881041..88aec13a98fb 100644 --- a/drivers/video/fbdev/maxinefb.c +++ b/drivers/video/fbdev/maxinefb.c @@ -98,7 +98,7 @@ static int maxinefb_setcolreg(unsigned regno, unsigned red, unsigned green, return 1; red >>= 8; /* The cmap fields are 16 bits */ - green >>= 8; /* wide, but the harware colormap */ + green >>= 8; /* wide, but the hardware colormap */ blue >>= 8; /* registers are only 8 bits wide */ hw_colorvalue = (blue << 16) + (green << 8) + (red); From 4d6c0305103db9a0ad9444d5a504c9ddeda8c858 Mon Sep 17 00:00:00 2001 From: Hemanth Selam Date: Sat, 12 Sep 2026 18:35:51 +0200 Subject: [PATCH 29/53] fbdev: pm2fb: fix typos in comments Assisted-by: Cursor:claude-opus-5 Signed-off-by: Hemanth Selam Signed-off-by: Helge Deller --- drivers/video/fbdev/pm2fb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/video/fbdev/pm2fb.c b/drivers/video/fbdev/pm2fb.c index 058075a34c5d..f287c9059489 100644 --- a/drivers/video/fbdev/pm2fb.c +++ b/drivers/video/fbdev/pm2fb.c @@ -428,7 +428,7 @@ static void set_aperture(struct pm2fb_par *p, u32 depth) } #endif - /* We don't use aperture two, so this may be superflous */ + /* We don't use aperture two, so this may be superfluous */ pm2_WR(p, PM2R_APERTURE_TWO, PM2F_APERTURE_STANDARD); } From cac219981475099607bb1594b8eff973f110d377 Mon Sep 17 00:00:00 2001 From: Hemanth Selam Date: Sat, 12 Sep 2026 18:36:07 +0200 Subject: [PATCH 30/53] fbdev: skeletonfb: fix typos in comments Assisted-by: Cursor:claude-opus-5 Signed-off-by: Hemanth Selam Signed-off-by: Helge Deller --- drivers/video/fbdev/skeletonfb.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/video/fbdev/skeletonfb.c b/drivers/video/fbdev/skeletonfb.c index 7e98850d9bde..bbfbf55cdab8 100644 --- a/drivers/video/fbdev/skeletonfb.c +++ b/drivers/video/fbdev/skeletonfb.c @@ -478,7 +478,7 @@ static int xxxfb_blank(int blank_mode, struct fb_info *info) /** * xxxfb_fillrect - REQUIRED function. Can use generic routines if - * non acclerated hardware and packed pixel based. + * non accelerated hardware and packed pixel based. * Draws a rectangle on the screen. * * @info: frame buffer structure that represents a single frame buffer @@ -505,7 +505,7 @@ void xxxfb_fillrect(struct fb_info *p, const struct fb_fillrect *region) /** * xxxfb_copyarea - REQUIRED function. Can use generic routines if - * non acclerated hardware and packed pixel based. + * non accelerated hardware and packed pixel based. * Copies one area of the screen to another area. * * @info: frame buffer structure that represents a single frame buffer @@ -530,7 +530,7 @@ void xxxfb_copyarea(struct fb_info *p, const struct fb_copyarea *area) /** * xxxfb_imageblit - REQUIRED function. Can use generic routines if - * non acclerated hardware and packed pixel based. + * non accelerated hardware and packed pixel based. * Copies a image from system memory to the screen. * * @info: frame buffer structure that represents a single frame buffer From b3b8e5b713e4d064ea2240bff52755af793425f8 Mon Sep 17 00:00:00 2001 From: Hemanth Selam Date: Sat, 12 Sep 2026 18:36:22 +0200 Subject: [PATCH 31/53] fbdev: ocfb: fix typos in comments Assisted-by: Cursor:claude-opus-5 Signed-off-by: Hemanth Selam Signed-off-by: Helge Deller --- drivers/video/fbdev/ocfb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/video/fbdev/ocfb.c b/drivers/video/fbdev/ocfb.c index 893888260c21..c16e907e5710 100644 --- a/drivers/video/fbdev/ocfb.c +++ b/drivers/video/fbdev/ocfb.c @@ -115,7 +115,7 @@ static int ocfb_setupfb(struct ocfb_dev *fbdev) fbdev->little_endian = 0; ocfb_writereg(fbdev, OCFB_VBARA, fbdev->fb_phys); - /* Detect endianess */ + /* Detect endianness */ if (ocfb_readreg(fbdev, OCFB_VBARA) != fbdev->fb_phys) { fbdev->little_endian = 1; ocfb_writereg(fbdev, OCFB_VBARA, fbdev->fb_phys); From be07060f1f90b8b38a1cfd27cce070935357d452 Mon Sep 17 00:00:00 2001 From: Hemanth Selam Date: Sat, 12 Sep 2026 18:36:37 +0200 Subject: [PATCH 32/53] fbdev: omap2fb: fix typos in comments Assisted-by: Cursor:claude-opus-5 Signed-off-by: Hemanth Selam Signed-off-by: Helge Deller --- drivers/video/fbdev/omap2/omapfb/dss/dispc.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/video/fbdev/omap2/omapfb/dss/dispc.c b/drivers/video/fbdev/omap2/omapfb/dss/dispc.c index 1dc70c96d813..cbe3cc545131 100644 --- a/drivers/video/fbdev/omap2/omapfb/dss/dispc.c +++ b/drivers/video/fbdev/omap2/omapfb/dss/dispc.c @@ -2119,7 +2119,7 @@ static int check_horiz_timing_omap3(unsigned long pclk, unsigned long lclk, /* * Pixel data should be prepared before visible display point starts. - * So, atleast DS-2 lines must have already been fetched by DISPC + * So, at least DS-2 lines must have already been fetched by DISPC * during nonactive - pos_x period. */ val = div_u64((u64)(nonactive - pos_x) * lclk, pclk); @@ -2130,7 +2130,7 @@ static int check_horiz_timing_omap3(unsigned long pclk, unsigned long lclk, /* * All lines need to be refilled during the nonactive period of which - * only one line can be loaded during the active period. So, atleast + * only one line can be loaded during the active period. So, at least * DS - 1 lines should be loaded during nonactive period. */ val = div_u64((u64)nonactive * lclk, pclk); From e2c83f4c49eb63336bcef107efa56371aea99b7d Mon Sep 17 00:00:00 2001 From: Hemanth Selam Date: Sat, 12 Sep 2026 18:37:41 +0200 Subject: [PATCH 33/53] fbdev: radeonfb: fix typos in comments Assisted-by: Cursor:claude-opus-5 Signed-off-by: Hemanth Selam Signed-off-by: Helge Deller --- drivers/video/fbdev/aty/radeon_base.c | 4 ++-- drivers/video/fbdev/aty/radeon_monitor.c | 4 ++-- drivers/video/fbdev/aty/radeonfb.h | 2 +- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/drivers/video/fbdev/aty/radeon_base.c b/drivers/video/fbdev/aty/radeon_base.c index b6b058cee751..387bc5f96765 100644 --- a/drivers/video/fbdev/aty/radeon_base.c +++ b/drivers/video/fbdev/aty/radeon_base.c @@ -779,7 +779,7 @@ static void radeon_get_pllinfo(struct radeonfb_info *rinfo) #endif /* CONFIG_PPC || CONFIG_SPARC */ /* - * Check out if we have an X86 which gave us some PLL informations + * Check out if we have an X86 which gave us some PLL information * and if yes, retrieve them */ if (!force_measure_pll && rinfo->bios_seg) { @@ -2407,7 +2407,7 @@ static int radeonfb_pci_register(struct pci_dev *pdev, if (rinfo->bios_seg == NULL && rinfo->is_mobility) radeon_map_ROM(rinfo, pdev); - /* Get informations about the board's PLL */ + /* Get information about the board's PLL */ radeon_get_pllinfo(rinfo); #ifdef CONFIG_FB_RADEON_I2C diff --git a/drivers/video/fbdev/aty/radeon_monitor.c b/drivers/video/fbdev/aty/radeon_monitor.c index 621d13a1a1d9..775888c43ef0 100644 --- a/drivers/video/fbdev/aty/radeon_monitor.c +++ b/drivers/video/fbdev/aty/radeon_monitor.c @@ -58,7 +58,7 @@ static char *radeon_get_mon_name(int type) #if defined(CONFIG_PPC) || defined(CONFIG_SPARC) /* - * Try to find monitor informations & EDID data out of the Open Firmware + * Try to find monitor information & EDID data out of the Open Firmware * device-tree. This also contains some "hacks" to work around a few machine * models with broken OF probing by hard-coding known EDIDs for some Mac * laptops internal LVDS panel. (XXX: not done yet) @@ -248,7 +248,7 @@ static int radeon_get_panel_info_BIOS(struct radeonfb_info *rinfo) return 0; } -/* Try to extract the connector informations from the BIOS. This +/* Try to extract the connector information from the BIOS. This * doesn't quite work yet, but it's output is still useful for * debugging */ diff --git a/drivers/video/fbdev/aty/radeonfb.h b/drivers/video/fbdev/aty/radeonfb.h index 91d81b576231..0781caea2c71 100644 --- a/drivers/video/fbdev/aty/radeonfb.h +++ b/drivers/video/fbdev/aty/radeonfb.h @@ -148,7 +148,7 @@ struct pll_info { * This structure contains the various registers manipulated by this * driver for setting or restoring a mode. It's mostly copied from * XFree's RADEONSaveRec structure. A few chip settings might still be - * tweaked without beeing reflected or saved in these registers though + * tweaked without being reflected or saved in these registers though */ struct radeon_regs { /* Common registers */ From 727a98c91754cc6d14fd6c07dcb7b00a56373bd7 Mon Sep 17 00:00:00 2001 From: Hemanth Selam Date: Sat, 12 Sep 2026 18:38:16 +0200 Subject: [PATCH 34/53] fbdev: mach64: fix typos in comments Assisted-by: Cursor:claude-opus-5 Signed-off-by: Hemanth Selam Signed-off-by: Helge Deller --- drivers/video/fbdev/aty/mach64_cursor.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/video/fbdev/aty/mach64_cursor.c b/drivers/video/fbdev/aty/mach64_cursor.c index e826cb7dd55d..60abb9666395 100644 --- a/drivers/video/fbdev/aty/mach64_cursor.c +++ b/drivers/video/fbdev/aty/mach64_cursor.c @@ -43,7 +43,7 @@ * * * The Screen position of the top left corner of the displayed - * cursor is specificed by CURS_HORZ_VERT_POSN. Care must be taken + * cursor is specified by CURS_HORZ_VERT_POSN. Care must be taken * when the cursor hot spot is not the top left corner and the * physical cursor position becomes negative. It will be displayed * if either the horizontal or vertical cursor position is negative From c24ea935ab2b99c3d05be5649a965321b03029cb Mon Sep 17 00:00:00 2001 From: Hemanth Selam Date: Sat, 12 Sep 2026 18:38:37 +0200 Subject: [PATCH 35/53] fbdev: aty128fb: fix typos in comments Assisted-by: Cursor:claude-opus-5 Signed-off-by: Hemanth Selam Signed-off-by: Helge Deller --- drivers/video/fbdev/aty/aty128fb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/video/fbdev/aty/aty128fb.c b/drivers/video/fbdev/aty/aty128fb.c index c349a1711ff5..6f71c3c6307e 100644 --- a/drivers/video/fbdev/aty/aty128fb.c +++ b/drivers/video/fbdev/aty/aty128fb.c @@ -753,7 +753,7 @@ static u32 depth_to_dst(u32 depth) } /* - * PLL informations retreival + * PLL information retreival */ From d72a71b8266222f398e824179004a7249aa0e22b Mon Sep 17 00:00:00 2001 From: Hemanth Selam Date: Sat, 12 Sep 2026 18:38:54 +0200 Subject: [PATCH 36/53] fbdev: atyfb_base: fix typos in comments Assisted-by: Cursor:claude-opus-5 Signed-off-by: Hemanth Selam Signed-off-by: Helge Deller --- drivers/video/fbdev/aty/atyfb_base.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/video/fbdev/aty/atyfb_base.c b/drivers/video/fbdev/aty/atyfb_base.c index 97cc8b6a9361..b1f33642e722 100644 --- a/drivers/video/fbdev/aty/atyfb_base.c +++ b/drivers/video/fbdev/aty/atyfb_base.c @@ -2966,7 +2966,7 @@ static int atyfb_setup_sparc(struct pci_dev *pdev, struct fb_info *info, /* * Figure mmap addresses from PCI config space. - * Split Framebuffer in big- and little-endian halfs. + * Split Framebuffer in big- and little-endian halves. */ for (i = 0; i < 6 && pdev->resource[i].start; i++) /* nothing */ ; @@ -3387,7 +3387,7 @@ static int init_from_bios(struct atyfb_par *par) PRINTKI("Mach64 BIOS is located at %x, mapped at %x.\n", rom_addr, bios_base); - /* check for frequncy table */ + /* check for frequency table */ bios_ptr = (u8*)bios_base; rom_table_offset = (u16)(bios_ptr[0x48] | (bios_ptr[0x49] << 8)); freq_table_offset = bios_ptr[rom_table_offset + 16] | (bios_ptr[rom_table_offset + 17] << 8); From ec4eb034cf8f38fe1ee1e9df07850953c0c2ec0e Mon Sep 17 00:00:00 2001 From: Helge Deller Date: Sat, 26 Sep 2026 08:12:26 +0200 Subject: [PATCH 37/53] fbdev: atafb: fix sparse warnings Fix two sparse warnings: - atafb.c:1092: sparse: Using plain integer as NULL pointer Use NULL instead of 0 when assigning a pointer. - atafb.c:2824: sparse: switch with no cases FBCMD_GET_CURRENTPAR and and FBCMD_SET_CURRENTPAR seem to be historic defines, which are not any longer in the kernel, and as such the code isn't built any longer and may be dropped. Fixes: d463633d63e6 ("fbdev: atafb: Add support for SuperVidel's SuperBlitter") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202609261313.kgFtkz2t-lkp@intel.com/ Cc: Miro Kropacek Signed-off-by: Helge Deller Reviewed-by: Geert Uytterhoeven Reviewed-by: Michael Schmitz --- drivers/video/fbdev/atafb.c | 26 +------------------------- 1 file changed, 1 insertion(+), 25 deletions(-) diff --git a/drivers/video/fbdev/atafb.c b/drivers/video/fbdev/atafb.c index c3011b61a94b..5c3e5861543a 100644 --- a/drivers/video/fbdev/atafb.c +++ b/drivers/video/fbdev/atafb.c @@ -1089,7 +1089,7 @@ static int falcon_decode_var(struct fb_info *info, struct fb_var_screeninfo *var /* Choose largest pixelclock <= wanted clock */ int i; unsigned long pcl = ULONG_MAX; - pclock = 0; + pclock = NULL; for (i = 1; i <= 4; i *= 2) { if (f25.t * i >= var->pixclock && f25.t * i < pcl) { @@ -2818,29 +2818,6 @@ static void atafb_imageblit(struct fb_info *info, const struct fb_image *image) } } -static int -atafb_ioctl(struct fb_info *info, unsigned int cmd, unsigned long arg) -{ - switch (cmd) { -#ifdef FBCMD_GET_CURRENTPAR - case FBCMD_GET_CURRENTPAR: - if (copy_to_user((void *)arg, ¤t_par, - sizeof(struct atafb_par))) - return -EFAULT; - return 0; -#endif -#ifdef FBCMD_SET_CURRENTPAR - case FBCMD_SET_CURRENTPAR: - if (copy_from_user(¤t_par, (void *)arg, - sizeof(struct atafb_par))) - return -EFAULT; - ata_set_par(¤t_par); - return 0; -#endif - } - return -EINVAL; -} - /* (un)blank/poweroff * 0 = unblank * 1 = blank @@ -2922,7 +2899,6 @@ static struct fb_ops atafb_ops = { .fb_fillrect = atafb_fillrect, .fb_copyarea = atafb_copyarea, .fb_imageblit = atafb_imageblit, - .fb_ioctl = atafb_ioctl, __FB_DEFAULT_IOMEM_OPS_MMAP, }; From 111a4137edd2c4caad413efa5ebb8a37067c172c Mon Sep 17 00:00:00 2001 From: Helge Deller Date: Tue, 29 Sep 2026 08:06:20 +0200 Subject: [PATCH 38/53] fbdev: atafb: avoid cast when assigning buffer address pointer MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The sparse tool complains that the "cast removes the address space '__iomem' of expression". Avoid the cast by using the screen_buffer pointer instead of the screen_base pointer from the union. Fixes: d463633d63e6 ("fbdev: atafb: Add support for SuperVidel's SuperBlitter") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202609261313.kgFtkz2t-lkp@intel.com/ Cc: Miro Kropáček Signed-off-by: Helge Deller --- drivers/video/fbdev/atafb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/video/fbdev/atafb.c b/drivers/video/fbdev/atafb.c index 5c3e5861543a..c32576cb1720 100644 --- a/drivers/video/fbdev/atafb.c +++ b/drivers/video/fbdev/atafb.c @@ -2454,7 +2454,7 @@ static void svblit_fillrect(struct fb_info *info, ((u32 *)info->pseudo_palette)[rect->color] : rect->color; /* draw the first line with the CPU ... */ - line = (u8 *)info->screen_base + rect->dy * pitch + + line = info->screen_buffer + rect->dy * pitch + rect->dx * bytespp; switch (bytespp) { case 1: From b40e7ffea066935d125d71c763c21e4d8c320060 Mon Sep 17 00:00:00 2001 From: Matthias Goergens Date: Sun, 27 Sep 2026 13:12:56 +0800 Subject: [PATCH 39/53] MAINTAINERS: name the deller/linux-fbdev for-next branch The T: entry for FRAMEBUFFER LAYER names deller/linux-fbdev without a branch. The repository's HEAD points to branch master, which mainline already contains. linux-next merges the for-next branch of this repository (Next/Trees). Name that branch in the entry. Signed-off-by: Matthias Goergens Acked-by: Helge Deller Signed-off-by: Helge Deller --- MAINTAINERS | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/MAINTAINERS b/MAINTAINERS index f53047aa8d3c..8ccd5d2d57c2 100644 --- a/MAINTAINERS +++ b/MAINTAINERS @@ -10341,7 +10341,7 @@ L: linux-fbdev@vger.kernel.org L: dri-devel@lists.freedesktop.org S: Maintained Q: http://patchwork.kernel.org/project/linux-fbdev/list/ -T: git git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev.git +T: git git://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev.git for-next F: Documentation/fb/ F: drivers/video/ F: include/linux/fb.h From 1438d00569c4c3d19ac46147b2791a3e9284fc47 Mon Sep 17 00:00:00 2001 From: Thomas Zimmermann Date: Mon, 5 Oct 2026 15:30:59 +0200 Subject: [PATCH 40/53] vt: Add cursor-size helpers Cursors in the VT subsystem are blocks within a character cell that are filled with the foreground color. The new helpers vc_cursor_start() and vc_cursor_end() return the scanlines in which the cursor block starts rsp. ends. This is compatible with VGA hardware. In terms of cursor design, the new cursor-size helpers follow established styles in fbcon. The only exception is in underline cursors for fonts with a size larger than 10. The underlining dash is now one pixel closer to the font-glyph data, so that the cursor looks less detached. This follows the style used by vgacon. Users control the cursor size with the vt module's parameter cur_default or with the ESC sequence \e[?Nc, where N is the cursor-size constant. In case of an invalid setting, the new helpers fall back to cur_default and then underline cursors; in this order. Similar code in vgacon and fbcon ignores the cursor's default size stored in vt.cur_default. The consoles default to full-block cursors, while vt defaults to underline cursors. VGA BIOSes also tend to use underline by. default. Upon initialization vt applies its default to the console, but each console might fall back to it own default. For example, running the ESC code from above with the invalid constant of 8 magically flips the cursor from underline to block size on vgacon. Another call with N set to 0 (i.e., default) magically flips it back to underlyine. Making underline the new default everywhere harmonizes vt, fbcon and most VGA BIOSes. Signed-off-by: Thomas Zimmermann Reviewed-by: Helge Deller Acked-by: Greg Kroah-Hartman Signed-off-by: Helge Deller --- drivers/tty/vt/vt.c | 114 +++++++++++++++++++++++++++++++++ include/linux/console_struct.h | 8 +++ 2 files changed, 122 insertions(+) diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c index 49a140b49eff..8415e274e4be 100644 --- a/drivers/tty/vt/vt.c +++ b/drivers/tty/vt/vt.c @@ -71,6 +71,7 @@ * by Adam Tla/lka , Aug 2006 */ +#include #include #include #include @@ -264,6 +265,119 @@ unsigned int vc_font_size(const struct vc_font *font) } EXPORT_SYMBOL_GPL(vc_font_size); +/* + * Cursors + */ + +/** + * vc_cursor_valid_size - Computes a valid cursor size from the given value + * @cursor_size: The size constant of cursor pattern + * + * The argument given in @cursor_size is one of the CUR_ constants, as stored + * in struct @vc_data.vc_cursor_type. For unknown values, the helper draws the + * default cursor or an underline dash. + * + * Returns: + * A valid cursor size for the given size value + */ +unsigned int vc_cursor_valid_size(unsigned int cursor_size) +{ + const unsigned int cursor_default_size = CUR_SIZE(READ_ONCE(cur_default)); + + do { + switch (cursor_size) { + case CUR_NONE: + case CUR_UNDERLINE: + case CUR_LOWER_THIRD: + case CUR_LOWER_HALF: + case CUR_TWO_THIRDS: + case CUR_BLOCK: + return cursor_size; + default: + pr_warn_once("Unknown cursor %u\n", cursor_size); + fallthrough; + case CUR_DEF: + /* + * Use user-given default size, or underline if + * the given default is invalid. + */ + if (cursor_size != cursor_default_size) + cursor_size = cursor_default_size; + else + cursor_size = CUR_UNDERLINE; + } + } while (true); +} +EXPORT_SYMBOL_GPL(vc_cursor_valid_size); + +/** + * vc_cursor_start - Calculates the cursor's first scanline within a character cell + * @cell_height: The overall height of the character cell + * @cursor_size: The size constant of cursor pattern + * + * The parameter @cell_height is the height of the character cell as + * displayed by the console. The argument given in @cursor_size is one + * of the CUR_ constants. See vc_cursor_valid_size() for how to get a + * valid cursor-size constant. + * + * Returns: + * The index of the cursor's first scanline within the character cell + */ +unsigned int vc_cursor_start(unsigned int cell_height, unsigned int cursor_size) +{ + switch (cursor_size) { + case CUR_NONE: + return cell_height; + case CUR_UNDERLINE: + default: + if (cell_height < 10) + return cell_height - 1; + else + return cell_height - 3; + case CUR_LOWER_THIRD: + return cell_height - cell_height / 3; + case CUR_LOWER_HALF: + return cell_height - cell_height / 2; + case CUR_TWO_THIRDS: + return cell_height - (cell_height * 2) / 3; + case CUR_BLOCK: + return 0; + } +} +EXPORT_SYMBOL_GPL(vc_cursor_start); + +/** + * vc_cursor_end - Calculates the first scanline after the cursor within a character cell + * @cell_height: The overall height of the character cell + * @cursor_size: The size constant of cursor pattern + * + * The parameter @cell_height is the height of the character cell as + * displayed by the console. The argument given in @cursor_size is one + * of the CUR_ constants. See vc_cursor_valid_size() for how to get a + * valid cursor-size constant. + * + * Returns: + * The index of the first scanline after the cursor within the character cell + */ +unsigned int vc_cursor_end(unsigned int cell_height, unsigned int cursor_size) +{ + switch (cursor_size) { + case CUR_UNDERLINE: + default: + if (cell_height < 10) + return cell_height; + else + return cell_height - 1; + case CUR_NONE: + case CUR_LOWER_THIRD: + case CUR_LOWER_HALF: + case CUR_TWO_THIRDS: + case CUR_BLOCK: + return cell_height; + } +} +EXPORT_SYMBOL_GPL(vc_cursor_end); + /* * /sys/class/tty/tty0/ * diff --git a/include/linux/console_struct.h b/include/linux/console_struct.h index fe915afdece5..de9e91429a88 100644 --- a/include/linux/console_struct.h +++ b/include/linux/console_struct.h @@ -204,6 +204,10 @@ struct vc { extern struct vc vc_cons [MAX_NR_CONSOLES]; extern void vc_SAK(struct work_struct *work); +/* + * Cursors + */ + #define CUR_MAKE(size, change, set) ((size) | ((change) << 8) | \ ((set) << 16)) #define CUR_SIZE(c) ((c) & 0x00000f) @@ -222,6 +226,10 @@ extern void vc_SAK(struct work_struct *work); #define CUR_CHANGE(c) ((c) & 0x00ff00) #define CUR_SET(c) (((c) & 0xff0000) >> 8) +unsigned int vc_cursor_valid_size(unsigned int cursor_size); +unsigned int vc_cursor_start(unsigned int cell_height, unsigned int cursor_size); +unsigned int vc_cursor_end(unsigned int cell_height, unsigned int cursor_size); + bool con_is_visible(const struct vc_data *vc); #endif /* _LINUX_CONSOLE_STRUCT_H */ From 64527782d4e1c7a4ffb8e35a68fdb1249ff4656e Mon Sep 17 00:00:00 2001 From: Thomas Zimmermann Date: Mon, 5 Oct 2026 15:31:00 +0200 Subject: [PATCH 41/53] vgacon: Remove trailing whitespaces Fix coding style. Signed-off-by: Thomas Zimmermann Reviewed-by: Helge Deller Signed-off-by: Helge Deller --- drivers/video/console/vgacon.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/drivers/video/console/vgacon.c b/drivers/video/console/vgacon.c index 37bd18730fe0..536e7fe4d142 100644 --- a/drivers/video/console/vgacon.c +++ b/drivers/video/console/vgacon.c @@ -881,14 +881,14 @@ static int vgacon_do_font_op(struct vgastate *state, char *arg, int set, /* First, the Sequencer */ vga_wseq(state->vgabase, VGA_SEQ_RESET, 0x1); /* CPU writes only to map 2 */ - vga_wseq(state->vgabase, VGA_SEQ_PLANE_WRITE, 0x04); + vga_wseq(state->vgabase, VGA_SEQ_PLANE_WRITE, 0x04); /* Sequential addressing */ - vga_wseq(state->vgabase, VGA_SEQ_MEMORY_MODE, 0x07); + vga_wseq(state->vgabase, VGA_SEQ_MEMORY_MODE, 0x07); /* Clear synchronous reset */ vga_wseq(state->vgabase, VGA_SEQ_RESET, 0x03); /* Now, the graphics controller, select map 2 */ - vga_wgfx(state->vgabase, VGA_GFX_PLANE_READ, 0x02); + vga_wgfx(state->vgabase, VGA_GFX_PLANE_READ, 0x02); /* disable odd-even addressing */ vga_wgfx(state->vgabase, VGA_GFX_MODE, 0x00); /* map start at A000:0000 */ @@ -930,7 +930,7 @@ static int vgacon_do_font_op(struct vgastate *state, char *arg, int set, raw_spin_lock_irq(&vga_lock); /* First, the sequencer, Synchronous reset */ - vga_wseq(state->vgabase, VGA_SEQ_RESET, 0x01); + vga_wseq(state->vgabase, VGA_SEQ_RESET, 0x01); /* CPU writes to maps 0 and 1 */ vga_wseq(state->vgabase, VGA_SEQ_PLANE_WRITE, 0x03); /* odd-even addressing */ @@ -959,7 +959,7 @@ static int vgacon_do_font_op(struct vgastate *state, char *arg, int set, /* Wilton (1987) mentions the following; I don't know what it means, but it works, and it appears necessary */ inb_p(video_port_status); - vga_wattr(state->vgabase, VGA_AR_ENABLE_DISPLAY, 0); + vga_wattr(state->vgabase, VGA_AR_ENABLE_DISPLAY, 0); clear_attribs = true; } raw_spin_unlock_irq(&vga_lock); From 5c02696d1561f543e1b03967cb8224cb6c4a3493 Mon Sep 17 00:00:00 2001 From: Thomas Zimmermann Date: Mon, 5 Oct 2026 15:31:01 +0200 Subject: [PATCH 42/53] vgacon: Use vt_cursor_{start,end}() Replace vgacon's custom cursor metrics with the shared helpers vc_cursor_start() and vc_font_cursor_end(). Note that the _end() function returns the index of the scanline below the cursor, while VGA hardware expects the cursor's final scanline. Hence vgacon subtracts 1 from the end value. The cursor shapes remain mostly unchanged, except that non-underline cursors now also use the glyph's top-most and bottom-most scanline. This follows the style used by fbcon. Signed-off-by: Thomas Zimmermann Reviewed-by: Helge Deller Signed-off-by: Helge Deller --- drivers/video/console/vgacon.c | 33 +++++---------------------------- 1 file changed, 5 insertions(+), 28 deletions(-) diff --git a/drivers/video/console/vgacon.c b/drivers/video/console/vgacon.c index 536e7fe4d142..2dcb1e38bd6b 100644 --- a/drivers/video/console/vgacon.c +++ b/drivers/video/console/vgacon.c @@ -506,6 +506,7 @@ static void vgacon_set_cursor_size(int from, int to) static void vgacon_cursor(struct vc_data *c, bool enable) { unsigned int c_height; + unsigned int c_size; if (c->vc_mode != KD_TEXT) return; @@ -513,10 +514,11 @@ static void vgacon_cursor(struct vc_data *c, bool enable) vgacon_restore_screen(c); c_height = c->vc_cell_height; + c_size = vc_cursor_valid_size(CUR_SIZE(c->vc_cursor_type)); write_vga(14, (c->vc_pos - vga_vram_base) / 2); - if (!enable) { + if (!enable || c_size == CUR_NONE) { if (vga_video_type >= VIDEO_TYPE_VGAC) vgacon_set_cursor_size(31, 30); else @@ -524,33 +526,8 @@ static void vgacon_cursor(struct vc_data *c, bool enable) return; } - switch (CUR_SIZE(c->vc_cursor_type)) { - case CUR_UNDERLINE: - vgacon_set_cursor_size(c_height - (c_height < 10 ? 2 : 3), - c_height - (c_height < 10 ? 1 : 2)); - break; - case CUR_TWO_THIRDS: - vgacon_set_cursor_size(c_height / 3, - c_height - (c_height < 10 ? 1 : 2)); - break; - case CUR_LOWER_THIRD: - vgacon_set_cursor_size(c_height * 2 / 3, - c_height - (c_height < 10 ? 1 : 2)); - break; - case CUR_LOWER_HALF: - vgacon_set_cursor_size(c_height / 2, - c_height - (c_height < 10 ? 1 : 2)); - break; - case CUR_NONE: - if (vga_video_type >= VIDEO_TYPE_VGAC) - vgacon_set_cursor_size(31, 30); - else - vgacon_set_cursor_size(31, 31); - break; - default: - vgacon_set_cursor_size(1, c_height); - break; - } + vgacon_set_cursor_size(vc_cursor_start(c_height, c_size), + vc_cursor_end(c_height, c_size) - 1); } static void vgacon_doresize(struct vc_data *c, From a88cef92063b16b42e6fa202ce199f0da3110e1f Mon Sep 17 00:00:00 2001 From: Thomas Zimmermann Date: Mon, 5 Oct 2026 15:31:02 +0200 Subject: [PATCH 43/53] lib/fonts: Add font_glyph_cursor() helper The new helper font_glyph_cursor() fills a glyph with a cursor pattern. As with the font_glyph_rotate_*() helpers, the caller has to provide the output memory. Signed-off-by: Thomas Zimmermann Reviewed-by: Helge Deller Signed-off-by: Helge Deller --- include/linux/font.h | 4 +++ lib/fonts/Makefile | 3 ++- lib/fonts/font_cursor.c | 56 +++++++++++++++++++++++++++++++++++++++++ 3 files changed, 62 insertions(+), 1 deletion(-) create mode 100644 lib/fonts/font_cursor.c diff --git a/include/linux/font.h b/include/linux/font.h index 5e1cf9830084..be1a26ff8ae9 100644 --- a/include/linux/font.h +++ b/include/linux/font.h @@ -109,6 +109,10 @@ const unsigned char *font_data_glyph_buf(font_data_t *fd, bool font_data_is_equal(font_data_t *lhs, font_data_t *rhs); int font_data_export(font_data_t *fd, struct console_font *font, unsigned int vpitch); +/* font_cursor.c */ +void font_glyph_cursor(unsigned int width, unsigned int height, + unsigned int from, unsigned int to, unsigned char *out); + /* font_rotate.c */ void font_glyph_rotate_90(const unsigned char *glyph, unsigned int width, unsigned int height, unsigned char *out); diff --git a/lib/fonts/Makefile b/lib/fonts/Makefile index 7202a70a56ef..bc08bf8ea3f8 100644 --- a/lib/fonts/Makefile +++ b/lib/fonts/Makefile @@ -1,7 +1,8 @@ # SPDX-License-Identifier: GPL-2.0 # Font handling -font-y := fonts.o +font-y := fonts.o \ + font_cursor.o font-$(CONFIG_FRAMEBUFFER_CONSOLE_ROTATION) += font_rotate.o # Built-in fonts; sorted by Family-Size in ascending order diff --git a/lib/fonts/font_cursor.c b/lib/fonts/font_cursor.c new file mode 100644 index 000000000000..7f4d587669aa --- /dev/null +++ b/lib/fonts/font_cursor.c @@ -0,0 +1,56 @@ +// SPDX-License-Identifier: GPL-2.0-only + +#include +#include +#include + +#include "font.h" + +/** + * font_glyph_cursor - Create a cursor glyph + * @width: The glyph width in bits per scanline + * @height: The number of scanlines in the glyph + * @start: The first scanline of the cursor block + * @end: The first scanline after the cursor block + * @out: The cursor-glyph bitmap + * + * The parameters @width and @height refer to the glyph size. The caller + * has to provide the output buffer @out of sufficient size to hold the + * cursor glyph. The arguments in @start and @end describe the number of + * scanlines occupied by the cursor block; counting from the top of the + * glyph. The helper fills these scanlines with a pattern and clears the + * remaining scanlines. + */ +void font_glyph_cursor(unsigned int width, unsigned int height, + unsigned int start, unsigned int end, unsigned char *out) +{ + unsigned int pitch = font_glyph_pitch(width); + const unsigned char *out_end = out + height * pitch; + unsigned int size; + + if (WARN_ON_ONCE(start > height)) + start = height; + if (WARN_ON_ONCE(end > height)) + end = height; + + if (end < start) + end = start; + + /* clear scanlines before cursor block */ + size = start * pitch; + memset(out, 0x00, size); + out += size; + + /* set cursor block */ + size = (end - start) * pitch; + memset(out, 0xff, size); + out += size; + + /* clear scanlines below cursor block */ + size = (height - end) * pitch; + memset(out, 0x00, size); + out += size; + + WARN_ON_ONCE(out != out_end); +} +EXPORT_SYMBOL_GPL(font_glyph_cursor); From 54ddfe9a7eef0d207d72338ea009278998f87668 Mon Sep 17 00:00:00 2001 From: Thomas Zimmermann Date: Mon, 5 Oct 2026 15:31:03 +0200 Subject: [PATCH 44/53] fbcon: Replace fbcon_fill_cursor_mask() with fbcon_cursor_glyph() The kernel's font library provides font_glyph_cursor() to create cursor glyphs. Replace fbcon's fbcon_fill_cursor_mask() with a new helper that uses font_glyph_cursor(). The cursor shapes remain mostly unchanged. The only exception is in underline cursors for fonts with a size larger than 10. The underlining dash is now one pixel closer to the font-glyph data, so that the cursor looks less detached. This follows the style used by vgacon. Signed-off-by: Thomas Zimmermann Reviewed-by: Helge Deller Signed-off-by: Helge Deller --- drivers/video/fbdev/core/bitblit.c | 3 +- drivers/video/fbdev/core/fbcon.c | 45 +++++++--------------------- drivers/video/fbdev/core/fbcon.h | 2 +- drivers/video/fbdev/core/fbcon_ccw.c | 3 +- drivers/video/fbdev/core/fbcon_cw.c | 3 +- drivers/video/fbdev/core/fbcon_ud.c | 3 +- 6 files changed, 16 insertions(+), 43 deletions(-) diff --git a/drivers/video/fbdev/core/bitblit.c b/drivers/video/fbdev/core/bitblit.c index 39f44258d793..03b3b18e1fe9 100644 --- a/drivers/video/fbdev/core/bitblit.c +++ b/drivers/video/fbdev/core/bitblit.c @@ -334,11 +334,10 @@ static void bit_cursor(struct vc_data *vc, struct fb_info *info, bool enable, vc->vc_cursor_type != par->p->cursor_shape || par->cursor_state.mask == NULL || par->cursor_reset) { - unsigned char *mask = kmalloc_array(vc->vc_font.height, w, GFP_ATOMIC); + unsigned char *mask = fbcon_cursor_glyph(&vc->vc_font, vc->vc_cursor_type); if (!mask) return; - fbcon_fill_cursor_mask(par, vc, mask); kfree(par->cursor_state.mask); par->cursor_state.mask = (const char *)mask; diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c index 01715873ea49..ba689d42792d 100644 --- a/drivers/video/fbdev/core/fbcon.c +++ b/drivers/video/fbdev/core/fbcon.c @@ -445,44 +445,21 @@ static void fbcon_del_cursor_work(struct fb_info *info) cancel_delayed_work_sync(&par->cursor_work); } -void fbcon_fill_cursor_mask(struct fbcon_par *par, struct vc_data *vc, unsigned char *mask) +unsigned char *fbcon_cursor_glyph(const struct vc_font *font, unsigned int cursor_type) { - static const unsigned int pattern = 0xffffffff; - unsigned int pitch = vc_font_pitch(&vc->vc_font); - unsigned int cur_height, size; + unsigned int height = font->height; + unsigned int cursor_size = vc_cursor_valid_size(CUR_SIZE(cursor_type)); + unsigned char *glyph; - switch (CUR_SIZE(vc->vc_cursor_type)) { - case CUR_NONE: - cur_height = 0; - break; - case CUR_UNDERLINE: - if (vc->vc_font.height < 10) - cur_height = 1; - else - cur_height = 2; - break; - case CUR_LOWER_THIRD: - cur_height = vc->vc_font.height / 3; - break; - case CUR_LOWER_HALF: - cur_height = vc->vc_font.height / 2; - break; - case CUR_TWO_THIRDS: - cur_height = (vc->vc_font.height * 2) / 3; - break; - case CUR_BLOCK: - default: - cur_height = vc->vc_font.height; - break; - } + glyph = kmalloc_array(height, vc_font_pitch(font), GFP_ATOMIC); + if (!glyph) + return NULL; - size = (vc->vc_font.height - cur_height) * pitch; - while (size--) - *mask++ = (unsigned char)~pattern; + font_glyph_cursor(font->width, height, + vc_cursor_start(height, cursor_size), + vc_cursor_end(height, cursor_size), glyph); - size = cur_height * pitch; - while (size--) - *mask++ = (unsigned char)pattern; + return glyph; } #ifndef MODULE diff --git a/drivers/video/fbdev/core/fbcon.h b/drivers/video/fbdev/core/fbcon.h index 407d207b14f1..054cf66b15fa 100644 --- a/drivers/video/fbdev/core/fbcon.h +++ b/drivers/video/fbdev/core/fbcon.h @@ -202,7 +202,7 @@ extern void fbcon_set_tileops(struct vc_data *vc, struct fb_info *info); extern void fbcon_set_bitops_ur(struct fbcon_par *par); extern int soft_cursor(struct fb_info *info, struct fb_cursor *cursor); -void fbcon_fill_cursor_mask(struct fbcon_par *par, struct vc_data *vc, unsigned char *mask); +unsigned char *fbcon_cursor_glyph(const struct vc_font *font, unsigned int cursor_type); #define FBCON_ATTRIBUTE_UNDERLINE 1 #define FBCON_ATTRIBUTE_REVERSE 2 diff --git a/drivers/video/fbdev/core/fbcon_ccw.c b/drivers/video/fbdev/core/fbcon_ccw.c index 33f02d579e02..9a9839631cc5 100644 --- a/drivers/video/fbdev/core/fbcon_ccw.c +++ b/drivers/video/fbdev/core/fbcon_ccw.c @@ -298,10 +298,9 @@ static void ccw_cursor(struct vc_data *vc, struct fb_info *info, bool enable, par->cursor_reset) { unsigned char *tmp, *mask; - tmp = kmalloc_array(vc->vc_font.height, vc_font_pitch(&vc->vc_font), GFP_ATOMIC); + tmp = fbcon_cursor_glyph(&vc->vc_font, vc->vc_cursor_type); if (!tmp) return; - fbcon_fill_cursor_mask(par, vc, tmp); mask = kmalloc_array(vc->vc_font.width, w, GFP_ATOMIC); if (!mask) { diff --git a/drivers/video/fbdev/core/fbcon_cw.c b/drivers/video/fbdev/core/fbcon_cw.c index bde820967eb9..4cb20337cf79 100644 --- a/drivers/video/fbdev/core/fbcon_cw.c +++ b/drivers/video/fbdev/core/fbcon_cw.c @@ -281,10 +281,9 @@ static void cw_cursor(struct vc_data *vc, struct fb_info *info, bool enable, par->cursor_reset) { unsigned char *tmp, *mask; - tmp = kmalloc_array(vc->vc_font.height, vc_font_pitch(&vc->vc_font), GFP_ATOMIC); + tmp = fbcon_cursor_glyph(&vc->vc_font, vc->vc_cursor_type); if (!tmp) return; - fbcon_fill_cursor_mask(par, vc, tmp); mask = kmalloc_array(vc->vc_font.width, w, GFP_ATOMIC); if (!mask) { diff --git a/drivers/video/fbdev/core/fbcon_ud.c b/drivers/video/fbdev/core/fbcon_ud.c index eaf08999e249..ac22b9846b79 100644 --- a/drivers/video/fbdev/core/fbcon_ud.c +++ b/drivers/video/fbdev/core/fbcon_ud.c @@ -328,10 +328,9 @@ static void ud_cursor(struct vc_data *vc, struct fb_info *info, bool enable, par->cursor_reset) { unsigned char *tmp, *mask; - tmp = kmalloc_array(vc->vc_font.height, w, GFP_ATOMIC); + tmp = fbcon_cursor_glyph(&vc->vc_font, vc->vc_cursor_type); if (!tmp) return; - fbcon_fill_cursor_mask(par, vc, tmp); mask = kmalloc_array(vc->vc_font.height, w, GFP_ATOMIC); if (!mask) { From 06fccf840640d8f6b0e08a1756f8d2f0435b4cbe Mon Sep 17 00:00:00 2001 From: Tingjie Zhong Date: Tue, 20 Oct 2026 10:46:57 -0600 Subject: [PATCH 45/53] fbdev: bitblit: Fix glyph clipping when fbcon pans Commit 3637d34b35b2 ("fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds") made bit_putcs() clip glyphs to var.yres. When fbcon scrolls by panning, it draws text rows up to var.yres_virtual, so after the first pan most new text is not drawn until the next full redraw. This affects fbdev drivers that set FBINFO_HWACCEL_YPAN or FBINFO_HWACCEL_YWRAP, such as vesafb with the ypan option, when CONFIG_FRAMEBUFFER_CONSOLE_LEGACY_ACCELERATION=y. Clip to GETVYRES() instead, which fbcon_ud.c and fbcon_ccw.c already use as the drawing area height. When fbcon does not pan, GETVYRES() returns var.yres, keeping the existing bound. When fbcon pans, it returns var.yres_virtual, which the framebuffer memory must cover anyway for panning to work. Fixes: 3637d34b35b2 ("fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds") Reported-by: Thomas Zimmermann Closes: https://lore.kernel.org/linux-fbdev/b8b52ffd-ecec-4fba-b432-ba32135c2f99@suse.de/ Tested-by: Thomas Zimmermann Cc: stable@vger.kernel.org Signed-off-by: Tingjie Zhong Signed-off-by: Helge Deller --- drivers/video/fbdev/core/bitblit.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/video/fbdev/core/bitblit.c b/drivers/video/fbdev/core/bitblit.c index 03b3b18e1fe9..590d12bbf30d 100644 --- a/drivers/video/fbdev/core/bitblit.c +++ b/drivers/video/fbdev/core/bitblit.c @@ -18,6 +18,7 @@ #include #include #include "fbcon.h" +#include "fbcon_rotate.h" /* * Accelerated handlers. @@ -150,7 +151,9 @@ static void bit_putcs(struct vc_data *vc, struct fb_info *info, const unsigned short *s, int count, int yy, int xx, int fg, int bg) { + struct fbcon_par *par = info->fbcon_par; struct fb_image image; + u32 vyres = GETVYRES(par->p, info); u32 width = DIV_ROUND_UP(vc->vc_font.width, 8); u32 cellsize = width * vc->vc_font.height; u32 maxcnt = info->pixmap.size/cellsize; @@ -167,10 +170,10 @@ static void bit_putcs(struct vc_data *vc, struct fb_info *info, image.height = vc->vc_font.height; image.depth = 1; - if (image.dy >= info->var.yres) + if (image.dy >= vyres) return; - image.height = min(image.height, info->var.yres - image.dy); + image.height = min(image.height, vyres - image.dy); if (attribute) { buf = kmalloc(cellsize, GFP_ATOMIC); From 10463bcd43495fb88ff667b2c5348200860f6bdc Mon Sep 17 00:00:00 2001 From: Yao Yiqi Date: Mon, 19 Oct 2026 17:43:29 +0800 Subject: [PATCH 46/53] fbcon: Include font geometry in the rotated font cache fbcon_rotate_font() caches a rotated copy of the console font and skips the rebuild when the fontdata pointer and the rotation match. Raw font data carries no geometry, though: width, height and charcount live in vc->vc_font. fbcon_set_font() deduplicates uploads by byte equality, so the same bytes re-uploaded with different dimensions keep the fontdata pointer while the geometry changes, and the early-out skips the rebuild. The rotated cell size depends on the geometry (rotation swaps width and height), so the stale buffer is indexed with the new cell size. Re-uploading a 4x16 font as 16x8 on a CW-rotated console, for example, doubles the rotated cell size and reads past the end of the old buffer. Record the geometry the buffer was built from and compare it in the early-out. The pointer-only key used to be backed by an explicit width check in the deduplication, which commit 1e3c49aa03fb ("lib/fonts: Compare font data for equality with font_data_is_equal()") dropped. Fixes: 6cc50e1c5b57 ("[PATCH] fbcon: Console Rotation - Add support to rotate font bitmap") Cc: stable@vger.kernel.org Signed-off-by: Yao Yiqi Acked-by: Thomas Zimmermann Signed-off-by: Helge Deller --- drivers/video/fbdev/core/fbcon.h | 9 ++++++--- drivers/video/fbdev/core/fbcon_rotate.c | 9 ++++++++- 2 files changed, 14 insertions(+), 4 deletions(-) diff --git a/drivers/video/fbdev/core/fbcon.h b/drivers/video/fbdev/core/fbcon.h index 054cf66b15fa..91b59b2990d2 100644 --- a/drivers/video/fbdev/core/fbcon.h +++ b/drivers/video/fbdev/core/fbcon.h @@ -89,10 +89,13 @@ struct fbcon_par { char *cursor_data; #ifdef CONFIG_FRAMEBUFFER_CONSOLE_ROTATION struct { - font_data_t *fontdata; /* source font */ - u8 *buf; /* rotated glyphs */ + font_data_t *fontdata; /* source font */ + u8 *buf; /* rotated glyphs */ size_t bufsize; - int buf_rotate; /* rotation of buf */ + int buf_rotate; /* rotation of buf */ + unsigned int buf_width; /* geometry of source font */ + unsigned int buf_height; + unsigned int buf_charcount; } rotated; #endif u8 *cursor_src; diff --git a/drivers/video/fbdev/core/fbcon_rotate.c b/drivers/video/fbdev/core/fbcon_rotate.c index 6cdbc96eeca6..660a3fa81bae 100644 --- a/drivers/video/fbdev/core/fbcon_rotate.c +++ b/drivers/video/fbdev/core/fbcon_rotate.c @@ -21,11 +21,18 @@ int fbcon_rotate_font(struct fb_info *info, struct vc_data *vc) unsigned char *buf; int ret; - if (par->p->fontdata == par->rotated.fontdata && par->rotate == par->rotated.buf_rotate) + if (par->p->fontdata == par->rotated.fontdata && + par->rotate == par->rotated.buf_rotate && + vc->vc_font.width == par->rotated.buf_width && + vc->vc_font.height == par->rotated.buf_height && + vc->vc_font.charcount == par->rotated.buf_charcount) return 0; par->rotated.fontdata = par->p->fontdata; par->rotated.buf_rotate = par->rotate; + par->rotated.buf_width = vc->vc_font.width; + par->rotated.buf_height = vc->vc_font.height; + par->rotated.buf_charcount = vc->vc_font.charcount; if (info->fbops->fb_sync) info->fbops->fb_sync(info); From e4b6b865d45d8dafb6c6f28c8a993a5b4431d25a Mon Sep 17 00:00:00 2001 From: Yao Yiqi Date: Mon, 19 Oct 2026 17:43:30 +0800 Subject: [PATCH 47/53] fbcon: Rebuild rotated font buffer on font change fbcon_rotate_font() caches a rotated copy of the console font in par->rotated.buf. The buffer is sized from the font's width, height and charcount, and is rebuilt in fbcon_init(), fbcon_switch() and fbcon_modechanged(), but not in fbcon_do_set_font(). When the font is changed through KDFONTOP, the new geometry is installed and vc_resize() redraws before the buffer is rebuilt. The rotated putcs/cursor ops then index the old buffer with the new cell size; KASAN reports a slab-out-of-bounds read in soft_cursor(). Rebuild the buffer for the visible console before the redraw, as the other callers do: select the console's blitting state with set_blitting_type() (which also uploads the new font's map on tile-blitting hardware), then rebuild. Background consoles keep their rebuild at fbcon_switch() time, as the buffer is shared per framebuffer and must not be updated for a console that is not being displayed. To ensure a correct rollback when the rebuild or the following vc_resize() fails, save the rotated font state, clear it before rebuilding, and restore it in the error path of fbcon_do_set_font(). Fixes: 6cc50e1c5b57 ("[PATCH] fbcon: Console Rotation - Add support to rotate font bitmap") Cc: stable@vger.kernel.org Signed-off-by: Yao Yiqi Acked-by: Thomas Zimmermann Signed-off-by: Helge Deller --- drivers/video/fbdev/core/fbcon.c | 46 ++++++++++++++++++++++++++++++++ drivers/video/fbdev/core/fbcon.h | 22 ++++++++------- 2 files changed, 59 insertions(+), 9 deletions(-) diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c index ba689d42792d..af587ff02e43 100644 --- a/drivers/video/fbdev/core/fbcon.c +++ b/drivers/video/fbdev/core/fbcon.c @@ -2391,6 +2391,10 @@ static int fbcon_do_set_font(struct vc_data *vc, int w, int h, int charcount, font_data_t *old_fontdata = p->fontdata; const u8 *old_data = vc->vc_font.data; unsigned short old_hi_font_mask = vc->vc_hi_font_mask; +#ifdef CONFIG_FRAMEBUFFER_CONSOLE_ROTATION + struct fbcon_rotated saved_rotated = { }; + bool rotated_saved = false; +#endif font_data_get(data); @@ -2409,6 +2413,27 @@ static int fbcon_do_set_font(struct vc_data *vc, int w, int h, int charcount, else if (!vc->vc_hi_font_mask && charcount == 512) set_vc_hi_font(vc, true); + /* + * Select the console's blitting state and update par->rotated to + * match the new font, so that the rendering below does not use a + * cache that was built for the old font. Clear the cached state so + * the rebuild allocates a fresh buffer; the old state is kept until + * the font change can no longer fail. + */ + if (con_is_visible(vc)) { + set_blitting_type(vc, info); + if (par->bitops->rotate_font) { +#ifdef CONFIG_FRAMEBUFFER_CONSOLE_ROTATION + saved_rotated = par->rotated; + memset(&par->rotated, 0, sizeof(par->rotated)); + rotated_saved = true; +#endif + ret = par->bitops->rotate_font(info, vc); + if (ret) + goto err_out; + } + } + if (resize) { int cols, rows; @@ -2425,12 +2450,26 @@ static int fbcon_do_set_font(struct vc_data *vc, int w, int h, int charcount, update_screen(vc); } +#ifdef CONFIG_FRAMEBUFFER_CONSOLE_ROTATION + if (rotated_saved) + kfree(saved_rotated.buf); +#endif if (old_fontdata) font_data_put(old_fontdata); return 0; err_out: +#ifdef CONFIG_FRAMEBUFFER_CONSOLE_ROTATION + /* + * Drop the buffer built for the new font and restore the saved + * state. + */ + if (rotated_saved) { + kfree(par->rotated.buf); + par->rotated = saved_rotated; + } +#endif p->fontdata = old_fontdata; vc->vc_font.data = old_data; vc->vc_font.width = old_width; @@ -2443,6 +2482,13 @@ static int fbcon_do_set_font(struct vc_data *vc, int w, int h, int charcount, else if (!old_hi_font_mask && vc->vc_hi_font_mask) set_vc_hi_font(vc, false); + /* + * Re-select the blitting type, which re-uploads the font map on + * tile-blitting hardware. + */ + if (con_is_visible(vc)) + set_blitting_type(vc, info); + font_data_put(data); return ret; diff --git a/drivers/video/fbdev/core/fbcon.h b/drivers/video/fbdev/core/fbcon.h index 91b59b2990d2..d93a89877d04 100644 --- a/drivers/video/fbdev/core/fbcon.h +++ b/drivers/video/fbdev/core/fbcon.h @@ -72,6 +72,18 @@ struct fbcon_bitops { int (*rotate_font)(struct fb_info *info, struct vc_data *vc); }; +#ifdef CONFIG_FRAMEBUFFER_CONSOLE_ROTATION +struct fbcon_rotated { + font_data_t *fontdata; /* source font */ + u8 *buf; /* rotated glyphs */ + size_t bufsize; + int buf_rotate; /* rotation of buf */ + unsigned int buf_width; /* geometry of source font */ + unsigned int buf_height; + unsigned int buf_charcount; +}; +#endif + struct fbcon_par { struct fb_var_screeninfo var; /* copy of the current fb_var_screeninfo */ struct delayed_work cursor_work; /* Cursor timer */ @@ -88,15 +100,7 @@ struct fbcon_par { int rotate; char *cursor_data; #ifdef CONFIG_FRAMEBUFFER_CONSOLE_ROTATION - struct { - font_data_t *fontdata; /* source font */ - u8 *buf; /* rotated glyphs */ - size_t bufsize; - int buf_rotate; /* rotation of buf */ - unsigned int buf_width; /* geometry of source font */ - unsigned int buf_height; - unsigned int buf_charcount; - } rotated; + struct fbcon_rotated rotated; #endif u8 *cursor_src; u32 cursor_size; From 7935db1a4a0f83a63590a222500e5016e2f6c85e Mon Sep 17 00:00:00 2001 From: Yao Yiqi Date: Mon, 19 Oct 2026 17:43:31 +0800 Subject: [PATCH 48/53] fbcon: Retry rotated font allocation after failure fbcon_rotate_font() records the font, its geometry and the rotation in par->rotated before calling font_data_rotate(). If the allocation fails, the error path clears par->rotated.buf, but the recorded key already looks up to date, so the next call takes the early-out and never retries. The rotated putcs/cursor ops keep returning early on the NULL buffer, and the console stays blank even after memory is available again. Also test par->rotated.buf in the early-out, so a failed allocation is retried on the next call: at the next fbcon_switch(), fbcon_modechanged() or font change. Fixes: e4ef723d8975 ("fbcon: Avoid OOB font access if console rotation fails") Cc: stable@vger.kernel.org Signed-off-by: Yao Yiqi Acked-by: Thomas Zimmermann Signed-off-by: Helge Deller --- drivers/video/fbdev/core/fbcon_rotate.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/video/fbdev/core/fbcon_rotate.c b/drivers/video/fbdev/core/fbcon_rotate.c index 660a3fa81bae..7afd63dcee7b 100644 --- a/drivers/video/fbdev/core/fbcon_rotate.c +++ b/drivers/video/fbdev/core/fbcon_rotate.c @@ -25,7 +25,8 @@ int fbcon_rotate_font(struct fb_info *info, struct vc_data *vc) par->rotate == par->rotated.buf_rotate && vc->vc_font.width == par->rotated.buf_width && vc->vc_font.height == par->rotated.buf_height && - vc->vc_font.charcount == par->rotated.buf_charcount) + vc->vc_font.charcount == par->rotated.buf_charcount && + par->rotated.buf) return 0; par->rotated.fontdata = par->p->fontdata; From 8f6dd8f15e0d1a1f8fd1e019cc89427735e00216 Mon Sep 17 00:00:00 2001 From: Thomas Zimmermann Date: Fri, 9 Oct 2026 18:05:35 +0200 Subject: [PATCH 49/53] fbdev: au1100fb: Use FB blanking constants Fbdev and its drivers use FB_BLANK constants for controlling the display's blanking state. Semantics differ to similar VESA blanking constants. Replace the VESA constants in au1100fb with FB_BLANK. Signed-off-by: Thomas Zimmermann Signed-off-by: Helge Deller --- drivers/video/fbdev/au1100fb.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/drivers/video/fbdev/au1100fb.c b/drivers/video/fbdev/au1100fb.c index 01c836cb5205..71610d5ecc2b 100644 --- a/drivers/video/fbdev/au1100fb.c +++ b/drivers/video/fbdev/au1100fb.c @@ -424,15 +424,15 @@ static int au1100fb_fb_blank(int blank_mode, struct fb_info *fbi) switch (blank_mode) { - case VESA_NO_BLANKING: + case FB_BLANK_UNBLANK: /* Turn on panel */ fbdev->regs->lcd_control |= LCD_CONTROL_GO; wmb(); /* drain writebuffer */ break; - - case VESA_VSYNC_SUSPEND: - case VESA_HSYNC_SUSPEND: - case VESA_POWERDOWN: + case FB_BLANK_NORMAL: + case FB_BLANK_VSYNC_SUSPEND: + case FB_BLANK_HSYNC_SUSPEND: + case FB_BLANK_POWERDOWN: /* Turn off panel */ fbdev->regs->lcd_control &= ~LCD_CONTROL_GO; wmb(); /* drain writebuffer */ @@ -539,7 +539,7 @@ static int au1100fb_setmode(struct au1100fb_device *fbdev) /* Resume controller */ fbdev->regs->lcd_control |= LCD_CONTROL_GO; mdelay(10); - au1100fb_fb_blank(VESA_NO_BLANKING, info); + au1100fb_fb_blank(FB_BLANK_UNBLANK, info); return 0; } @@ -856,7 +856,7 @@ static void au1100fb_drv_remove(struct platform_device *dev) fbdev = platform_get_drvdata(dev); #if !defined(CONFIG_FRAMEBUFFER_CONSOLE) && defined(CONFIG_LOGO) - au1100fb_fb_blank(VESA_POWERDOWN, &fbdev->info); + au1100fb_fb_blank(FB_BLANK_POWERDOWN, &fbdev->info); #endif fbdev->regs->lcd_control &= ~LCD_CONTROL_GO; @@ -880,7 +880,7 @@ static int au1100fb_drv_suspend(struct platform_device *dev, pm_message_t state) return 0; /* Blank the LCD */ - au1100fb_fb_blank(VESA_POWERDOWN, &fbdev->info); + au1100fb_fb_blank(FB_BLANK_POWERDOWN, &fbdev->info); clk_disable(fbdev->lcdclk); @@ -904,7 +904,7 @@ static int au1100fb_drv_resume(struct platform_device *dev) return ret; /* Unblank the LCD */ - au1100fb_fb_blank(VESA_NO_BLANKING, &fbdev->info); + au1100fb_fb_blank(FB_BLANK_UNBLANK, &fbdev->info); return 0; } From baedbacdc8d6a756166bb83afe31e3b165bd8aa2 Mon Sep 17 00:00:00 2001 From: Thomas Zimmermann Date: Fri, 9 Oct 2026 18:05:36 +0200 Subject: [PATCH 50/53] fbdev: i810fb: Use FB blanking constants Fbdev and its drivers use FB_BLANK constants for controlling the display's blanking state. Semantics differ to similar VESA blanking constants. Replace the VESA constant in i810fb with FB_BLANK. Signed-off-by: Thomas Zimmermann Signed-off-by: Helge Deller --- drivers/video/fbdev/i810/i810_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/video/fbdev/i810/i810_main.c b/drivers/video/fbdev/i810/i810_main.c index 10b914a24114..f5780fd8afea 100644 --- a/drivers/video/fbdev/i810/i810_main.c +++ b/drivers/video/fbdev/i810/i810_main.c @@ -1623,7 +1623,7 @@ static int i810fb_resume(struct pci_dev *dev) par->cursor_heap.offset); i810fb_set_par(info); fb_set_suspend (info, 0); - info->fbops->fb_blank(VESA_NO_BLANKING, info); + info->fbops->fb_blank(FB_BLANK_UNBLANK, info); fail: console_unlock(); return 0; From a1d236fee3b8f86b5f45756e7911abc2842aef3d Mon Sep 17 00:00:00 2001 From: Thomas Zimmermann Date: Fri, 9 Oct 2026 18:05:37 +0200 Subject: [PATCH 51/53] fbdev: sa1100fb: Remove comment on VESA DPMS modes Fbdev and its drivers use FB_BLANK constants for controlling the display's blanking state. Semantics differ to similar VESA blanking constants. Remove the comment on VESA constants from sa1100fb. It's misleading at best, as the driver should never use the VESA constants for blanking. Signed-off-by: Thomas Zimmermann Signed-off-by: Helge Deller --- drivers/video/fbdev/sa1100fb.c | 29 ----------------------------- 1 file changed, 29 deletions(-) diff --git a/drivers/video/fbdev/sa1100fb.c b/drivers/video/fbdev/sa1100fb.c index fea0172c45b5..8102ab7d51e6 100644 --- a/drivers/video/fbdev/sa1100fb.c +++ b/drivers/video/fbdev/sa1100fb.c @@ -491,35 +491,6 @@ sa1100fb_set_cmap(struct fb_cmap *cmap, int kspc, int con, } #endif -/* - * Formal definition of the VESA spec: - * On - * This refers to the state of the display when it is in full operation - * Stand-By - * This defines an optional operating state of minimal power reduction with - * the shortest recovery time - * Suspend - * This refers to a level of power management in which substantial power - * reduction is achieved by the display. The display can have a longer - * recovery time from this state than from the Stand-by state - * Off - * This indicates that the display is consuming the lowest level of power - * and is non-operational. Recovery from this state may optionally require - * the user to manually power on the monitor - * - * Now, the fbdev driver adds an additional state, (blank), where they - * turn off the video (maybe by colormap tricks), but don't mess with the - * video itself: think of it semantically between on and Stand-By. - * - * So here's what we should do in our fbdev blank routine: - * - * VESA_NO_BLANKING (mode 0) Video on, front/back light on - * VESA_VSYNC_SUSPEND (mode 1) Video on, front/back light off - * VESA_HSYNC_SUSPEND (mode 2) Video on, front/back light off - * VESA_POWERDOWN (mode 3) Video off, front/back light off - * - * This will match the matrox implementation. - */ /* * sa1100fb_blank(): * Blank the display by setting all palette values to zero. Note, the From 2439733aa594c95fa7606d3d7d82ba1313ee03b7 Mon Sep 17 00:00:00 2001 From: Thomas Zimmermann Date: Fri, 9 Oct 2026 18:05:38 +0200 Subject: [PATCH 52/53] fbdev: platinumfb: Use FB blanking constants Fbdev and its drivers use FB_BLANK constants for controlling the display's blanking state. Semantics differ to similar VESA blanking constants. Replace the VESA constants with FB_BLANK in platinumfb. The VESA constants can be interpreted bitwise, while the FB_BLANK constants can not. Therefore turn the bit tests in an if-else sequence that handles the individual cases. By default, the display is unblanked. The modified code is within a comment block, so it will not run. I still changed it to keep the driver up to standard. This might also resolve the nearby TODO comment on incorrect hardware blanking. Signed-off-by: Thomas Zimmermann Signed-off-by: Helge Deller --- drivers/video/fbdev/platinumfb.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/drivers/video/fbdev/platinumfb.c b/drivers/video/fbdev/platinumfb.c index 81fdaa3541db..b55a7b70d31d 100644 --- a/drivers/video/fbdev/platinumfb.c +++ b/drivers/video/fbdev/platinumfb.c @@ -167,10 +167,12 @@ static int platinumfb_blank(int blank, struct fb_info *fb) ctrl = le32_to_cpup(&info->platinum_regs->ctrl.r) | 0x33; if (blank) --blank_mode; - if (blank & VESA_VSYNC_SUSPEND) - ctrl &= ~3; - if (blank & VESA_HSYNC_SUSPEND) + if (blank == FB_BLANK_VSYNC_SUSPEND) + ctrl &= ~0x03; + else if (blank == FB_BLANK_HSYNC_SUSPEND) ctrl &= ~0x30; + else if (blank == FB_BLANK_POWERDOWN) + ctrl &= ~0x33; out_le32(&info->platinum_regs->ctrl.r, ctrl); */ /* TODO: Figure out how the heck to powerdown this thing! */ From 61e1a43ca5825acb137a10ac7d52746632bfb124 Mon Sep 17 00:00:00 2001 From: Thomas Zimmermann Date: Fri, 9 Oct 2026 18:05:39 +0200 Subject: [PATCH 53/53] fbdev: xilinxfb: Use FB blanking constants Fbdev and its drivers use FB_BLANK constants for controlling the display's blanking state. Semantics differ to similar VESA blanking constants. Replace the VESA constant in xilinxfb with FB_BLANK. Signed-off-by: Thomas Zimmermann Signed-off-by: Helge Deller --- drivers/video/fbdev/xilinxfb.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/video/fbdev/xilinxfb.c b/drivers/video/fbdev/xilinxfb.c index 0a6e05cd155a..462fe2e94d55 100644 --- a/drivers/video/fbdev/xilinxfb.c +++ b/drivers/video/fbdev/xilinxfb.c @@ -376,7 +376,7 @@ static void xilinxfb_release(struct device *dev) struct xilinxfb_drvdata *drvdata = dev_get_drvdata(dev); #if !defined(CONFIG_FRAMEBUFFER_CONSOLE) && defined(CONFIG_LOGO) - xilinx_fb_blank(VESA_POWERDOWN, &drvdata->info); + xilinx_fb_blank(FB_BLANK_POWERDOWN, &drvdata->info); #endif unregister_framebuffer(&drvdata->info);