kernel/linux.git/drivers/auxdisplay, branch v6.18.35

auxdisplay: line-display: fix OOB read on zero-length message_store()

2026-06-09T10:28:34+00:00

commit a7511dcd9dd4bc55d123f9b800c8a4ed2662e5c6 upstream. linedisp_display() unconditionally reads msg[count - 1] before checking whether count is zero, so a write of zero bytes to the message sysfs attribute hits msg[-1]: write(fd, "", 0); -> message_store(..., buf, count=0) -> linedisp_display(linedisp, buf, count=0) -> msg[count - 1] == '\n' ; OOB read The kernfs write buffer for that store is a 1-byte allocation (kernfs_fop_write_iter() does kmalloc(len + 1) with len == 0), so msg[-1] is a 1-byte read before the slab object. On a KASAN-enabled kernel this trips an out-of-bounds report and panics; on stock kernels it silently reads adjacent slab data and, if that byte happens to be '\n', the following count-- wraps ssize_t 0 to -1 and is then passed to kmemdup_nul(). linedisp_display() is reached from the message_store() sysfs callback (drivers/auxdisplay/line-display.c message attribute, mode 0644) and from the in-tree initial-message setup with count == -1, so the OOB path is only userspace-triggerable via zero-byte writes; vfs_write() does not short-circuit on count == 0 and kernfs_fop_write_iter() dispatches the store callback regardless. Guard the trailing-newline trim with a count check. The existing if (!count) block then takes the clear-display path unchanged. Affects every auxdisplay driver that registers via linedisp_register() / linedisp_attach(): ht16k33, max6959, img-ascii-lcd, seg-led-gpio. Fixes: 7e76aece6f03 ("auxdisplay: Extract character line display core support") Signed-off-by: Stepan Ionichev Signed-off-by: Andy Shevchenko Signed-off-by: Greg Kroah-Hartman

auxdisplay: arm-charlcd: fix release_mem_region() size

2026-02-26T22:58:56+00:00

[ Upstream commit b5c23a4d291d2ac1dfdd574a68a3a68c8da3069e ] It seems like, after the request_mem_region(), the corresponding release_mem_region() must take the same size. This was done in (now removed due to previous refactoring) charlcd_remove() but not in the error path in charlcd_probe(). Fixes: ce8962455e90 ("ARM: 6214/2: driver for the character LCD found in ARM refdesigns") Signed-off-by: Thomas Fourier Reviewed-by: Geert Uytterhoeven Signed-off-by: Andy Shevchenko Signed-off-by: Sasha Levin

treewide, timers: Rename from_timer() to timer_container_of()

2025-06-08T07:07:37+00:00

Move this API to the canonical timer_*() namespace. [ tglx: Redone against pre rc1 ] Signed-off-by: Ingo Molnar Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/all/aB2X0jCKQO56WdMt@gmail.com

treewide: Switch/rename to timer_delete[_sync]()

2025-04-05T08:30:12+00:00

timer_delete[_sync]() replaces del_timer[_sync](). Convert the whole tree over and remove the historical wrapper inlines. Conversion was done with coccinelle plus manual fixups where necessary. Signed-off-by: Thomas Gleixner Signed-off-by: Ingo Molnar

auxdisplay: hd44780: Rename hd to hdc in hd44780_common_alloc()

2025-03-10T16:03:02+00:00

The hd44780_common_alloc() uses hd for local variable while the respective header uses hdc, rename to make it consistent and avoid potential confuse with the drivers that use both for different reasons. No functional changes intended. Signed-off-by: Andy Shevchenko

auxdisplay: hd44780: Call charlcd_alloc() from hd44780_common_alloc()

2025-03-10T16:03:02+00:00

HD44780 APIs all operate on struct charlcd objects. Moreover, the current users always call charlcd_alloc() and hd44780_common_alloc(). Make the latter call the former, so eliminate the additional allocation, to make it consistent with the rest of API and avoid duplication. Signed-off-by: Andy Shevchenko Reviewed-by: Geert Uytterhoeven

auxdisplay: panel: Make use of hd44780_common_free()

2025-03-10T16:03:02+00:00

Use the symmetrical API to free the common resources. Signed-off-by: Andy Shevchenko Reviewed-by: Geert Uytterhoeven

auxdisplay: hd44780: Make use of hd44780_common_free()

2025-03-10T16:03:02+00:00

Use the symmetrical API to free the common resources. Signed-off-by: Andy Shevchenko Reviewed-by: Geert Uytterhoeven

auxdisplay: hd44780: Introduce hd44780_common_free()

2025-03-10T16:03:02+00:00

Introduce hd44780_common_free() for symmetrical operation to hd44780_common_alloc(). It will allow to modify both in the future without touching the users. Signed-off-by: Andy Shevchenko Reviewed-by: Geert Uytterhoeven

auxdisplay: lcd2s: Allocate memory for custom data in charlcd_alloc()

2025-03-10T16:03:02+00:00

Allocate memory for custom data in charlcd_alloc() instead of doing that explicitly in the driver. Signed-off-by: Andy Shevchenko Reviewed-by: Geert Uytterhoeven