kernel/git/next/linux-next.git/drivers/tty, branch master

Merge branch 'for-next' of https://git.kernel.org/pub/scm/linux/kernel/git/deller/linux-fbdev.git

2026-08-28T13:11:57+00:00

Merge tag 'tty-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty

2026-08-25T17:59:12+00:00

Pull TTY / serial driver updates from Greg KH: "Here is the "big" set of tty and serial driver updates for 7.3-rc1. Not really all that much happened this development cycle for this subsystem, changes in here are: - removal of the ipwireless driver as it's no longer used or needed - new 8250_mxpcie driver added - qcom serial driver updates and additions - vt mode validation addition - lots of other small serial driver updates and additions All of these have been in linux-next for weeks with no reported issues" * tag 'tty-7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty: (97 commits) serial: imx: serialize imx_uart_ports[] lifetime tty: clear cdev pointer after cdev_add() failure tty: skip cdev_del() when no cdev is registered serial: core: clear freed pointers on uart_register_driver() failure serial: core: do fallible allocations before the console can be registered serial: 8250_mxpcie: implement rx_trig_bytes callbacks via MUEx50 RTL serial: 8250_mxpcie: introduce per-port private data structure serial: 8250: allow UART drivers to override rx_trig_bytes handling serial: 8250_mxpcie: add break support for RS485 using MUEx50 features serial: 8250: allow low-level drivers to override break control serial: 8250_mxpcie: support serial interface mode switching serial: 8250_mxpcie: speed up TX using memory-mapped FIFO window serial: 8250_mxpcie: speed up RX using memory-mapped FIFO window serial: 8250_mxpcie: add custom handle_irq callback serial: 8250_mxpcie: offload XON/XOFF flow control to MUEx50 hardware serial: 8250_mxpcie: enable automatic RTS/CTS flow control serial: 8250_mxpcie: enable enhanced mode and program FIFO trigger levels serial: 8250: add Moxa MUEx50 UART port type serial: 8250: split Moxa PCIe serial board support out of 8250_pci serial: qcom-geni: Use geni_se_set_perf_level() for baud rate perf level ...

vt: hide cursor prior to font changes to avoid out-of-bound reads

2026-08-22T07:33:45+00:00

KASAN reports slab-out-of-bounds errors: BUG: KASAN: slab-out-of-bounds in soft_cursor+0x3eb/0xb70 drivers/video/fbdev/core/softcursor.c:70 When changing the size of a sceen font, the amount of columns and rows on a screen may change and thus the current position of the cursor and the selection may suddenly lay outside of the current screen limits. Clear the selection and hide the cursor before any font changes to avoid such possible out of bounds accesses. Reported-by: Jaeyoung Chung Signed-off-by: Helge Deller Link: https://lore.kernel.org/all/20260819163440.3702924-1-jjy600901@snu.ac.kr/

Merge tag 'fs_for_v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs

2026-08-20T19:52:35+00:00

Pull ext2, udf, isofs, and quota updates from Jan Kara: - Remove deprecated quota code printing warnings about exceeded quota directly to console - Various udf & isofs hardening for handling of corrupted filesystems - Fix a possible data loss in udf when converting files from inline to out-of-line format - Simplify EIO error handling in ext2 xattr code * tag 'fs_for_v7.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: udf: Fix data loss when converting inline inodes to out of line udf: Move udf_map_block() up ext2: Simplify error handling of IO error when adding xattr isofs: Drop support of directory entries straddling blocks isofs: validate directory records consistently quota: remove CONFIG_PRINT_QUOTA_WARNING code udf: Fix i_lenExtents truncation on 32-bit kernels isofs: release zisofs block pointer buffer head udf: Fix bh leak for unallocated space entries udf: bound lengthAllocDescs from unallocated space entry UDF symlink pathComponent header OOB read isofs: fix out-of-bounds page array access on empty zisofs block udf: reject VAT indexes equal to the entry count udf: Mark LVID buffer as uptodate before marking it dirty udf: avoid recursive s_alloc_mutex deadlock when freeing AED blocks udf: validate extent partition references in udf_current_aext()

Merge tag 'v7.2-rc7' into driver-core-next

2026-08-09T23:20:05+00:00

We need the driver-core fixes in here as well to build on top of. Signed-off-by: Danilo Krummrich

serial: imx: serialize imx_uart_ports[] lifetime

2026-08-03T14:54:10+00:00

imx_uart_probe() publishes its devm-allocated port in imx_uart_ports[] before uart_add_one_port() because console setup uses the table. The entry is not cleared when adding the port fails or after removal, leaving a dangling pointer. A sibling probe can register the shared console through that stale entry. This was reproduced under KASAN on QEMU mcimx6ul-evk by unbinding a sibling UART, unbinding the console UART and rebinding the sibling. Keep the entry valid through uart_remove_one_port(), then clear it. Protect port addition and removal together with their table updates so sibling operations cannot interleave. Reject an occupied slot rather than clobbering an active port during a duplicate-line probe. Fixes: dbff4e9ea2e8 ("IMX UART: remove statically initialized tables") Fixes: 9f322ad064f9 ("imx: serial: handle initialisation failure correctly") Reported-by: Sashiko Link: https://lore.kernel.org/all/20260719162850.043B41F000E9@smtp.kernel.org Link: https://lore.kernel.org/all/20260719222501.CB4CB1F000E9@smtp.kernel.org Cc: stable@vger.kernel.org Assisted-by: Claude:claude-fable-5 Signed-off-by: Karl Mehltretter Reviewed-by: Frank Li Link: https://patch.msgid.link/20260731181844.11330-6-kmehltretter@gmail.com Signed-off-by: Greg Kroah-Hartman

tty: clear cdev pointer after cdev_add() failure

2026-08-03T14:53:09+00:00

tty_cdev_add() drops the cdev reference when cdev_add() fails, but leaves driver->cdevs[index] pointing to freed memory. tty_unregister_device() later passes that stale pointer to cdev_del(), causing a use-after-free. Clear the slot after dropping the reference. Fixes: c1a752ba2d6b ("tty: don't leak cdev in tty_cdev_add()") Assisted-by: Claude:claude-fable-5 Signed-off-by: Karl Mehltretter Link: https://patch.msgid.link/20260731181844.11330-5-kmehltretter@gmail.com Signed-off-by: Greg Kroah-Hartman

tty: skip cdev_del() when no cdev is registered

2026-08-03T14:53:09+00:00

TTY device registration can fail before a cdev is allocated. Serial core keeps the port so setserial can still use it, and later removal passes the NULL cdev slot to cdev_del(), causing a NULL-pointer dereference. Only delete the cdev when the slot is not NULL. Fixes: a3a10ce3429e ("Avoid usb reset crashes by making tty_io cdevs truly dynamic") Fixes: da4c279942b0 ("serial: enable serdev support") Assisted-by: Claude:claude-fable-5 Signed-off-by: Karl Mehltretter Link: https://patch.msgid.link/20260731181844.11330-4-kmehltretter@gmail.com Signed-off-by: Greg Kroah-Hartman

serial: core: clear freed pointers on uart_register_driver() failure

2026-08-03T14:53:09+00:00

uart_register_driver() leaves drv->state pointing to freed memory when tty_alloc_driver() fails. If tty_register_driver() fails, drv->tty_driver also retains a pointer after its reference is dropped. Drivers that use drv->state as an "already registered" flag can then skip registration on the next probe and pass the freed state to uart_add_one_port(). This issue was found with failslab on QEMU's raspi1ap board by failing registration and binding the PL011 port again. Clear both pointers on their failure paths, as uart_unregister_driver() already does. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Fixes: 9e845abfc8a8 ("serial: fix NULL pointer dereference") Assisted-by: Claude:claude-fable-5 Signed-off-by: Karl Mehltretter Link: https://patch.msgid.link/20260731181844.11330-3-kmehltretter@gmail.com Signed-off-by: Greg Kroah-Hartman

serial: core: do fallible allocations before the console can be registered

2026-08-03T14:53:09+00:00

serial_core_add_one_port() allocates uport->tty_groups after uart_configure_port(), which may register the console. If the allocation fails, the driver unwinds the port while its console remains registered. The earlier uport->name allocation has a related failure path that leaves state->uart_port linked to a port being freed. Failslab reproduced a NULL dereference in PL011 console output and a KASAN use-after-free in i.MX console output after failed binds. Allocate the name and tty_groups before linking the port and configuring it. Reserve space for the optional driver attribute group because config_port() may populate uport->attr_group during configuration. Fixes: 266dcff03eed ("Serial: allow port drivers to have a default attribute group") Fixes: f7048b15900f ("tty: serial_core: Add name field to uart_port struct") Reported-by: Sashiko Closes: https://lore.kernel.org/all/20260719070454.D6FA21F000E9@smtp.kernel.org/ Assisted-by: Claude:claude-fable-5 Signed-off-by: Karl Mehltretter Link: https://patch.msgid.link/20260731181844.11330-2-kmehltretter@gmail.com Signed-off-by: Greg Kroah-Hartman