kernel/linux.git/drivers/tty/vt, branch v6.19.11

vt: save/restore unicode screen buffer for alternate screen

2026-03-25T10:13:19+00:00

commit 5eb608319bb56464674a71b4a66ea65c6c435d64 upstream. The alternate screen support added by commit 23743ba64709 ("vt: add support for smput/rmput escape codes") only saves and restores the regular screen buffer (vc_origin), but completely ignores the corresponding unicode screen buffer (vc_uni_lines) creating a messed-up display. Add vc_saved_uni_lines to save the unicode screen buffer when entering the alternate screen, and restore it when leaving. Also ensure proper cleanup in reset_terminal() and vc_deallocate(). Fixes: 23743ba64709 ("vt: add support for smput/rmput escape codes") Cc: stable Signed-off-by: Nicolas Pitre Link: https://patch.msgid.link/5o2p6qp3-91pq-0p17-or02-1oors4417ns7@onlyvoer.pbz Signed-off-by: Greg Kroah-Hartman

tty: vt/keyboard: Split apart vt_do_diacrit()

2026-03-04T12:20:39+00:00

[ Upstream commit 0a76a17238f805b231d97b118232a5185bbb7a18 ] After commit bfb24564b5fd ("tty: vt/keyboard: use __free()"), builds using asm goto for put_user() and get_user() with a version of clang older than 17 error with: drivers/tty/vt/keyboard.c:1709:7: error: cannot jump from this asm goto statement to one of its possible targets if (put_user(asize, &a->kb_cnt)) ^ ... arch/arm64/include/asm/uaccess.h:298:2: note: expanded from macro '__put_mem_asm' asm goto( \ ^ drivers/tty/vt/keyboard.c:1687:7: note: possible target of asm goto statement if (put_user(asize, &a->kb_cnt)) ^ ... arch/arm64/include/asm/uaccess.h:342:2: note: expanded from macro '__raw_put_user' __rpu_failed: \ ^ drivers/tty/vt/keyboard.c:1697:23: note: jump exits scope of variable with __attribute__((cleanup)) void __free(kfree) *buf = kmalloc_array(MAX_DIACR, sizeof(struct kbdiacruc), ^ drivers/tty/vt/keyboard.c:1671:33: note: jump bypasses initialization of variable with __attribute__((cleanup)) struct kbdiacr __free(kfree) *dia = kmalloc_array(MAX_DIACR, sizeof(struct kbdiacr), ^ Prior to a fix to clang's scope checker in clang 17 [1], all labels in a function were validated as potential targets of all asm gotos in a function, regardless of whether they actually were a target of an asm goto call, resulting in false positive errors about skipping over variables marked with the cleanup attribute. To workaround this error, split up the bodies of the case statements in vt_do_diacrit() into their own functions so that the scope checker does not trip up on the multiple instances of __free(). Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202509091702.Oc7eCRDw-lkp@intel.com/ Closes: https://lore.kernel.org/oe-kbuild-all/202511241835.EA8lShgH-lkp@intel.com/ Link: https://github.com/llvm/llvm-project/commit/f023f5cdb2e6c19026f04a15b5a935c041835d14 [1] Signed-off-by: Nathan Chancellor Link: https://patch.msgid.link/20251125-tty-vt-keyboard-wa-clang-scope-check-error-v1-1-f5a5ea55c578@kernel.org Signed-off-by: Greg Kroah-Hartman Signed-off-by: Sasha Levin

tty: vt: do not open code DIV_ROUND_UP()

2025-11-21T17:31:27+00:00

Use the designated DIV_ROUND_UP() macro instead of explicit addition with division. Signed-off-by: Jiri Slaby (SUSE) Link: https://patch.msgid.link/20251119092457.826789-2-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman

tty: vt/keyboard: use guard()s

2025-11-21T17:30:40+00:00

Use guards in the vt/keyboard code. This improves readability, makes error handling easier, and marks locked portions of code explicit. All that while being sure the lock is unlocked. Signed-off-by: Jiri Slaby (SUSE) Link: https://patch.msgid.link/20251119100140.830761-9-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman

tty: vt/keyboard: simplify returns from vt_do_kbkeycode_ioctl()

2025-11-21T17:30:40+00:00

Return immediately when something goes wrong in vt_do_kbkeycode_ioctl(). This makes the code flow more obvious. Signed-off-by: Jiri Slaby (SUSE) Link: https://patch.msgid.link/20251119100140.830761-8-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman

tty: vt/keyboard: use __free()

2025-11-21T17:30:40+00:00

The vt/keyboard code can use __free to ensure the temporary buffers are freed. Perform the switch. And even one non-temporary in kbd_connect(). There are fail paths, so ensure the buffer is freed in them and not when returning 0 -- by retain_and_null_ptr(). Signed-off-by: Jiri Slaby (SUSE) Link: https://patch.msgid.link/20251119100140.830761-7-jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman

drivers/tty/vt: use umin() instead of min_t(u16, ...) for row/col limits

2025-11-21T17:16:11+00:00

The row/column bounds (for a screen window box) are changed from 'offset one' to 'offset zero' and bound to the screen size using: v->xs = min_t(u16, v->xs - 1, vc->vc_cols - 1); This has the side effect of converting zero to the limit. A check I'm adding to min_t() reports that (u16)(v->xs - 1) (etc) discards signiticant bits (because v->xs is promoted to 'int' before the addition). If v->xs is zero (it comes from userspace) it converts -1 to 0xffff. This is then bounded to 'vc->vc_cols - 1' which will be fine. Replace with: v->xs = umin(v->xs - 1, vc->vc_cols - 1); which again converts a -1 to unsigned - this time to 0xffffffff, with the same overall effect. Whether zero is meant to mean the 'maximum size' is unknown. I can't find any documentation for the ioctl and it pre-dates git. Detected by an extra check added to min_t(). Signed-off-by: David Laight Reviewed-by: Jiri Slaby Link: https://patch.msgid.link/20251119224140.8616-28-david.laight.linux@gmail.com Signed-off-by: Greg Kroah-Hartman

vt: move vc_saved_screen to within tty allocated judgment

2025-09-12T13:58:41+00:00

Everything starts with the assumption that a tty has been allocated. Therefore, Move it to within the tty allocation check. Fixes: 23743ba64709 ("vt: add support for smput/rmput escape codes") Reported-by: syzbot+f6cb41c144427dc0796a@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=f6cb41c144427dc0796a Tested-by: syzbot+f6cb41c144427dc0796a@syzkaller.appspotmail.com Signed-off-by: Edward Adam Davis Reviewed-by: Jiri Slaby Link: https://lore.kernel.org/r/tencent_CAD45DB31906CF890DBB25AB0DED12205D07@qq.com Signed-off-by: Greg Kroah-Hartman

tty/vt: Add missing return value for VT_RESIZE in vt_ioctl()

2025-09-06T13:49:55+00:00

In vt_ioctl(), the handler for VT_RESIZE always returns 0, which prevents users from detecting errors. Add the missing return value so that errors can be properly reported to users like vt_resizex(). Signed-off-by: Zizhi Wo Link: https://lore.kernel.org/r/20250904023955.3892120-1-wozizhi@huaweicloud.com Signed-off-by: Greg Kroah-Hartman

vt: remove redundant check on vc_mode in con_font_set()

2025-09-06T13:49:52+00:00

Previous commit edab558feba1 ("vt: sort out locking for font handling") move the vc_mode check into console_lock protect, but forget to remove the old check in con_font_set(). Just remove the redundant check. Signed-off-by: Wang Liang Link: https://lore.kernel.org/r/20250904023345.13731-1-wangliang74@huawei.com Signed-off-by: Greg Kroah-Hartman