[PATCH AUTOSEL 6.18-6.12] fbcon: don't suspend/resume when vc is graphics mode

[PATCH AUTOSEL 6.18-6.12] fbcon: don't suspend/resume when vc is graphics mode

[Sasha Levin]

From: Lu Yao <yaolu@kylinos.cn>

[ Upstream commit 70d9d5f5fcd940f627bd403aaa6f65de724eef6b ]

Don't need to do suspend/resume for fbcon in graphic mode.

Doing this may cause error, eg:
  At the beginning, starting the Xorg with single screen and then an
  external screen was plugged in. After logging out in Xorg, fbdev
  info may using screen which is connected later on for info always
  using first connected connector in list in func 'drm_setup_crtcs_fb'.
  Then, S3 executed, fbcon found that the information did not match
  and do atomic to switch fb. However, Xorg will not re-bind the crtc
  fb but continues doing ioctl. At this time, the fb is incorrect.

With some modifications by Helge Deller.

Signed-off-by: Lu Yao <yaolu@kylinos.cn>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---

LLM Generated explanations, may be completely bogus:

## Phase 1: Commit Message Forensics

### Step 1.1: Subject Line
**Record:** `[fbcon]` `[don't]` (preventive) — skip suspend/resume fbcon
work when the virtual console is in graphics mode (`KD_GRAPHICS`).

### Step 1.2: Commit Tags
**Record:** Tags present:
- `Signed-off-by: Lu Yao <yaolu@kylinos.cn>` (author)
- `Signed-off-by: Helge Deller <deller@gmx.de>` (fbdev maintainer)

Notable absences (expected for manual review):
- No `Fixes:` tag
- No `Reported-by:` tag
- No `Cc: stable@vger.kernel.org`
- No `Link:` to bug report or syzbot
- No `Tested-by:` / `Reviewed-by:` / `Acked-by:`

### Step 1.3: Commit Body Analysis
**Record:**
- **Bug:** `fbcon_suspended()` / `fbcon_resumed()` run fbcon
  cursor/screen update logic even when the VC is in graphics mode (Xorg
  owns the display).
- **Symptom:** After multi-monitor hotplug + Xorg logout + S3
  suspend/resume, fbdev metadata can point at the wrong connector; fbcon
  resume triggers an atomic framebuffer switch while Xorg keeps using
  the old framebuffer, leaving the display in a broken state.
- **Root cause (author):** fbcon should not touch the framebuffer in
  graphics mode; resume path can call into `update_screen()` →
  `fbcon_switch()` → `fb_set_var()`, provoking DRM atomic
  reconfiguration.
- **Version info:** None stated.

### Step 1.4: Hidden Bug Fix Detection
**Record:** Yes — despite the short message, this is a real
suspend/resume correctness fix, not cosmetic cleanup. It aligns
`fbcon_suspended()` / `fbcon_resumed()` with the `KD_TEXT` guards
already used in `fbcon_modechanged()`, `fbcon_init()`, and other fbcon
paths.

---

## Phase 2: Diff Analysis

### Step 2.1: Change Inventory
**Record:**
- **File:** `drivers/video/fbdev/core/fbcon.c` (+3 net lines)
- **Functions:** `fbcon_suspended()`, `fbcon_resumed()`
- **Scope:** Single-file, surgical fix

### Step 2.2: Code Flow Change
**Record:**

| Hunk | Before | After |
|------|--------|-------|
| `fbcon_suspended()` | Always calls `fbcon_cursor(vc, false)` | Only if
`vc->vc_mode == KD_TEXT && con_is_visible(vc)` |
| `fbcon_resumed()` | Always calls `update_screen(vc)` | Only if
`vc->vc_mode == KD_TEXT && con_is_visible(vc)` |

Affected path: system suspend/resume via `fb_set_suspend()` →
`fbcon_suspended()` / `fbcon_resumed()`, commonly reached from DRM fbdev
(`drm_fb_helper_set_suspend()` → `drm_fbdev_client_suspend/resume`).

### Step 2.3: Bug Mechanism
**Record:** **Logic / correctness fix** in suspend/resume path.

- `update_screen(vc)` expands to `redraw_screen(vc, 0)`
  (`include/linux/vt_kern.h`).
- `redraw_screen()` always calls `vc->vc_sw->con_switch(vc)` — for fbcon
  that is `fbcon_switch()`, which calls `fb_set_var()` and can reprogram
  the DRM framebuffer.
- `redraw_screen()` only skips the final `do_update_region()` when
  `vc->vc_mode == KD_GRAPHICS`; it still runs `con_switch` /
  `fb_set_var` in graphics mode.
- `fbcon_modechanged()` already bails out on `vc->vc_mode != KD_TEXT`;
  `fbcon_suspended/resumed` did not — that inconsistency is the bug.

For `fbcon_suspended()`, `fbcon_cursor()` already returns early when
`!fbcon_is_active()`, and `fbcon_is_active()` requires `KD_TEXT`. The
suspend-side change is mostly consistency plus a `con_is_visible()`
guard; the resume-side `update_screen()` guard is the substantive fix.

### Step 2.4: Fix Quality
**Record:**
- **Quality:** High — matches existing pattern at lines 642, 1124, 2074,
  2686 in the same file.
- **Regression risk:** Very low — fbcon should not manipulate the
  framebuffer while X/compositor holds graphics mode.
- **Red flags:** None.

---

## Phase 3: Git History Investigation

### Step 3.1: Blame / Introduction
**Record:**
- `fbcon_suspended()` / `fbcon_resumed()` core logic dates to the
  original fbcon import (`1da177e4c3f4`, 2005).
- Wrapper path via `fb_set_suspend()` consolidated in `50c5056356340`
  (2019, "fbdev: directly call fbcon_suspended/resumed").
- Buggy unconditional `update_screen()` in `fbcon_resumed()` has been
  present for many years; it only becomes problematic with modern DRM
  atomic fbdev emulation and multi-connector setups.

### Step 3.2: Fixes: Tag
**Record:** N/A — no `Fixes:` tag in the commit message.

### Step 3.3: Related File History
**Record:** Recent `fbcon.c` changes in this tree are unrelated fbcon
bug fixes (NULL deref, OOB read, type fixes). No prior fix for this
graphics-mode suspend/resume issue found. Standalone patch, not part of
a series.

### Step 3.4: Author Context
**Record:**
- Lu Yao (Kylin OS) — platform vendor reporting a real multi-monitor +
  S3 scenario.
- Helge Deller — active fbdev maintainer with recent fbcon fixes in this
  tree (e.g. `d78bd6cc68276 fbcon: Fix null-ptr-deref in soft_cursor`).

### Step 3.5: Dependencies
**Record:** No dependencies. Uses `KD_TEXT`, `con_is_visible()`, and
existing helpers already in 6.18.44. Applies standalone.

---

## Phase 4: Mailing List and External Research

### Step 4.1–4.5: Lore / b4 dig
**Record:**
- `b4 dig -c <commit>` could not be run — this commit is not in the
  checked-out tree (candidate only, no commit hash).
- Direct lore.kernel.org fetch returned 403 (bot protection).
- No matching `.mbx` file found in the workspace.
- **UNVERIFIED:** Full mailing-list review thread, reviewer stable
  nominations, and patch series evolution.

---

## Phase 5: Code Semantic Analysis

### Step 5.1: Key Functions
**Record:** `fbcon_suspended()`, `fbcon_resumed()`, callers
`fb_set_suspend()`, `fbcon_switch()`, `redraw_screen()`.

### Step 5.2: Callers
**Record:** `fb_set_suspend()` called from:
- `drm_fb_helper_set_suspend()` / `drm_fbdev_client_suspend/resume()`
  (DRM fbdev path — relevant to the reported bug)
- Legacy fbdev drivers (i915 intelfb, nvidia, aty, etc.)
- `fbsysfs.c` sysfs interface

Suspend/resume is a common system-wide path on laptops/desktops.

### Step 5.3: Callees
**Record:** `fbcon_cursor()`, `update_screen()` → `redraw_screen()` →
`hide_cursor()`, `con_switch()` (`fbcon_switch()`), `fb_set_var()`,
potential `fb_set_par()`.

### Step 5.4: Reachability
**Record:** Reachable on every S3/hibernate cycle while DRM fbdev
emulation is active. Trigger requires graphics mode (typical when
Xorg/Wayland compositor is running, or after logout with VC still in
graphics mode). Userspace does not need special privileges beyond normal
suspend.

### Step 5.5: Similar Patterns
**Record:** Same `con_is_visible(vc) && vc->vc_mode == KD_TEXT` guard
used elsewhere in `fbcon.c` (lines 642, 1124, 2074).
`fbcon_modechanged()` uses `vc->vc_mode != KD_TEXT` early return (line
2686).

---

## Phase 6: Cross-Reference Against Local Tree (v6.18.44)

### Step 6.1: Buggy Code Present?
**Record:** **Yes.** Current tree at
`drivers/video/fbdev/core/fbcon.c:2651-2674` still has unconditional
`fbcon_cursor()` and `update_screen()` with no `KD_TEXT` check. Fix is
not yet applied (`git log -S "Update screen when in text mode only"`
returned empty).

### Step 6.2: Backport Complications
**Record:** **Clean apply expected** — 3-line logical change in a stable
area of `fbcon.c`, no structural conflicts with recent local changes.

### Step 6.3: Related Fixes Already Present?
**Record:** No equivalent fix found in this tree.

---

## Phase 7: Subsystem Context

### Step 7.1: Subsystem / Criticality
**Record:** `drivers/video/fbdev/core/` — framebuffer console over DRM
fbdev emulation. **IMPORTANT** for desktop/laptop users relying on fbdev
+ suspend/resume; not universal core-kernel, but widely used on
Intel/AMD DRM systems with fbdev client enabled.

### Step 7.2: Activity
**Record:** fbcon remains actively maintained in 6.18.y (multiple fbcon
fixes in recent history on this branch).

---

## Phase 8: Impact and Risk Assessment

### Step 8.1: Who Is Affected
**Record:** Users of DRM fbdev emulation with:
- Graphics mode active (`KD_GRAPHICS`, typical under Xorg)
- Multi-connector hotplug scenarios
- System suspend (S3) / resume

Config-dependent on `CONFIG_DRM_FBDEV_CLIENT` / fbdev emulation, but
that is common on desktop distros.

### Step 8.2: Trigger Conditions
**Record:** Specific but realistic: external monitor hotplug while X
running, logout, then S3. Not every boot, but reproducible on real
hardware per commit message. Unprivileged users can trigger via normal
suspend.

### Step 8.3: Failure Mode Severity
**Record:** Wrong framebuffer bound after resume; display corruption /
broken Xorg ioctl path. Not a kernel oops, but a **HIGH** functional
failure on resume — system may need reboot to recover display.
Suspend/resume breakage is a common stable backport category.

### Step 8.4: Risk-Benefit
**Record:**
- **Benefit:** Prevents fbcon from disturbing DRM framebuffer state
  during S3 when graphics mode is active.
- **Risk:** Very low — only skips work that should never run in graphics
  mode.
- **Ratio:** Strong benefit, minimal risk.

---

## Phase 9: Final Synthesis

### Step 9.1: Evidence Summary

**FOR backport:**
- Real, described hardware scenario (multi-monitor + S3 + Xorg/fbdev)
- Maintainer sign-off (Helge Deller)
- Tiny, obviously correct fix matching existing fbcon guards
- Bug mechanism verified in code: `update_screen()` → `fbcon_switch()` →
  `fb_set_var()` runs even in `KD_GRAPHICS`
- Buggy code present since early fbcon, still unfixed in v6.18.44
- Suspend/resume display breakage is user-visible and painful

**AGAINST backport:**
- No syzbot/KASAN report or `Reported-by:` from upstream
- Failure mode is display corruption, not kernel crash/panic
- Suspend-side change is partially redundant (`fbcon_cursor` already
  inactive in graphics mode)
- Mailing-list review unverified

**Unresolved:**
- Full lore review thread not accessible
- No independent `Tested-by:` confirmation

### Step 9.2: Stable Rules Checklist
1. Obviously correct and tested? **PASS** — logic matches established
   fbcon patterns; maintainer SOB; scenario described (no independent
   test tag).
2. Fixes a real bug affecting users? **PASS** — concrete multi-monitor
   S3 scenario.
3. Important issue? **PASS** — suspend/resume display corruption on
   common laptop/desktop setup (**HIGH** severity).
4. Small and contained? **PASS** — 3 net lines, one file, two functions.
5. No new features or APIs? **PASS**.
6. Can apply to local tree? **PASS** — buggy code present, no
   prerequisites.

### Step 9.3: Exception Categories
**Record:** None (not a device ID, quirk, DT, build, or docs fix).
Qualifies on straight bug-fix merits.

### Step 9.4: Decision Rationale
For **v6.18.44**, this commit closes a long-standing gap where fbcon
resume can invoke `fb_set_var()` through `update_screen()` while the VC
is in graphics mode. That is exactly the wrong time for fbcon to
reprogram the DRM framebuffer. The fix is minimal, consistent with the
rest of `fbcon.c`, endorsed by the fbdev maintainer, and addresses a
real suspend/resume regression path on DRM+fbdev systems. The missing
lore verification does not outweigh the clear code-path analysis.

---

## Verification

- **[Phase 1]** Parsed commit message and tags manually from user-
  provided text.
- **[Phase 2]** Read diff and current `fbcon.c` at lines 2651–2710;
  confirmed `update_screen` → `redraw_screen` → `con_switch` path in
  `vt.c:929-987`.
- **[Phase 2]** Confirmed `fbcon_switch()` calls `fb_set_var()` at
  `fbcon.c:2134`.
- **[Phase 2]** Confirmed `fbcon_is_active()` requires `KD_TEXT` at
  `fbcon.c:287-292`.
- **[Phase 3]** `git describe HEAD` → `v6.18.44`; `make kernelversion` →
  `6.18.44`.
- **[Phase 3]** `git blame` on `fbcon_suspended/resumed` — original code
  from 2005, structure unchanged.
- **[Phase 3]** `git show 50c5056356340` — `fb_set_suspend` → fbcon path
  since 2019.
- **[Phase 3]** `git log -S "Update screen when in text mode only"` —
  fix not in tree.
- **[Phase 4]** `b4 dig` — cannot run without commit hash (candidate not
  merged).
- **[Phase 4]** lore.kernel.org fetch — 403 Forbidden; **UNVERIFIED**
  mailing-list discussion.
- **[Phase 5]** `grep fb_set_suspend` — callers include
  `drm_fbdev_client.c:65-86`, `drm_fb_helper.c:729-737`.
- **[Phase 5]** Read `drm_fbdev_client_suspend/resume` and
  `fb_set_suspend` in `fbmem.c:650-661`.
- **[Phase 5]** Confirmed `KD_TEXT` + `con_is_visible` pattern at
  `fbcon.c:642,1124,2074`.
- **[Phase 6]** Buggy unconditional code confirmed present at
  `fbcon.c:2660-2673`.
- **[Phase 6]** No duplicate fix found via `git log --grep` / `-S`
  searches.
- **[Phase 8]** Failure mode assessed as display corruption after S3,
  not kernel crash.

**YES**The background searches finished and match what we already
concluded:

- **Commit lookup:** The fix (`fbcon: don't suspend/resume when vc is
  graphics mode`) is **not in v6.18.44** yet. A pickaxe search for
  `vc->vc_mode == KD_TEXT` in `fbcon.c` only turned up older, unrelated
  commits.
- **Author / b4 dig:** `git log --author="Lu Yao"` didn’t find this
  patch in the tree (only unrelated commits). `b4 dig` couldn’t be run
  without a merged commit hash.

That supports the earlier **YES** for backport: the bug is still present
in this tree, and the patch is a small, standalone guard around
`fbcon_suspended()` / `fbcon_resumed()` when the VC is in graphics
mode.The author-email search (`git log --author="yaolu"`) also didn’t
find the fbcon patch in this tree — only unrelated amdgpu, btrfs, and
x86 commits. That further confirms it’s a candidate not yet merged into
v6.18.44, consistent with the **YES** backport recommendation.

 drivers/video/fbdev/core/fbcon.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
index 35210f2bb7b2b..532522c2aed05 100644
--- a/drivers/video/fbdev/core/fbcon.c
+++ b/drivers/video/fbdev/core/fbcon.c
@@ -2657,8 +2657,9 @@ void fbcon_suspended(struct fb_info *info)
 		return;
 	vc = vc_cons[par->currcon].d;
 
-	/* Clear cursor, restore saved data */
-	fbcon_cursor(vc, false);
+	/* Clear cursor, restore saved data when in text mode */
+	if ((vc->vc_mode == KD_TEXT) && con_is_visible(vc))
+		fbcon_cursor(vc, false);
 }
 
 void fbcon_resumed(struct fb_info *info)
@@ -2670,7 +2671,9 @@ void fbcon_resumed(struct fb_info *info)
 		return;
 	vc = vc_cons[par->currcon].d;
 
-	update_screen(vc);
+	/* Update screen when in text mode only */
+	if ((vc->vc_mode == KD_TEXT) && con_is_visible(vc))
+		update_screen(vc);
 }
 
 static void fbcon_modechanged(struct fb_info *info)
-- 
2.53.0

[PATCH AUTOSEL 6.18-5.10] fbdev: pm2fb: unwind WC setup on probe failure

[Sasha Levin]

From: Haoxiang Li <haoxiang_li2024@163.com>

[ Upstream commit 16eb19f0c90af03bda6ba66586d7bb0e9cf85b43 ]

Add arch_phys_wc_del() on error path to keep the
write-combining setup balanced when later probe
steps fail.

Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---

LLM Generated explanations, may be completely bogus:

# Stable Backport Analysis: `fbdev: pm2fb: unwind WC setup on probe
failure`

**Local tree:** `v6.18.44` (`stable/linux-6.18.y`, `HEAD` detached)
**Candidate commit:** `16eb19f0c90af03bda6ba66586d7bb0e9cf85b43`
(mainline only; **not** in this tree)

---

## PHASE 1: COMMIT MESSAGE FORENSICS

### Step 1.1: Subject line
**Record:** `[fbdev: pm2fb]` `[unwind]` — Add missing write-combining
teardown when `pm2fb_probe()` fails after WC setup.

### Step 1.2: Tags
**Record:**
- `Signed-off-by: Haoxiang Li <haoxiang_li2024@163.com>` (author)
- `Signed-off-by: Helge Deller <deller@gmx.de>` (fbdev maintainer,
  applied the patch)
- No `Fixes:`, `Reported-by:`, `Tested-by:`, `Reviewed-by:`, `Cc:
  stable@vger.kernel.org`, or `Link:` tags
- Notable: maintainer ack via application; no user/fuzzer reports

### Step 1.3: Body analysis
**Record:**
- **Bug:** `arch_phys_wc_add()` is called during probe, but later probe
  failures skip `arch_phys_wc_del()`.
- **Symptom:** Leaked MTRR/WC mapping on x86 systems where
  `arch_phys_wc_add()` actually allocates an MTRR (PAT disabled, MTRR
  enabled, `nomtrr` unset).
- **Root cause:** Missing symmetric cleanup on `err_exit_pixmap` and
  downstream error labels (`err_exit_both`, `err_exit_all`).
- **Version info:** None in the message.

### Step 1.4: Hidden bug fix?
**Record:** Yes. Although titled “unwind WC setup,” this is a probe
error-path **resource leak** fix, not cosmetic cleanup.

---

## PHASE 2: DIFF ANALYSIS

### Step 2.1: Inventory
**Record:**
- **Files:** `drivers/video/fbdev/pm2fb.c` (+1 / −0)
- **Functions:** `pm2fb_probe()` error path only
- **Scope:** Single-file, surgical one-liner

### Step 2.2: Code flow change
**Record:**
- **Before:** After `arch_phys_wc_add()` at lines 1655–1657, failures at
  pixmap alloc (`err_exit_pixmap`), cmap alloc (`err_exit_both`), or
  `register_framebuffer()` (`err_exit_all`) skipped WC teardown.
- **After:** `err_exit_pixmap` calls
  `arch_phys_wc_del(default_par->wc_cookie)` before unmapping smem —
  matching `pm2fb_remove()` at line 1738.
- **Affected paths:** Error paths only (not the success path).

### Step 2.3: Bug mechanism
**Record:**
- **Category:** Error-path resource leak
- **Mechanism:** `arch_phys_wc_add()` may consume an MTRR slot on PAT-
  less x86; without `arch_phys_wc_del()`, that slot stays allocated
  after failed probe. On PAT-enabled or non-x86 systems,
  `arch_phys_wc_add()` is effectively a no-op and `arch_phys_wc_del(0)`
  is also a no-op.

### Step 2.4: Fix quality
**Record:**
- Obviously correct; mirrors `pm2fb_remove()` and the pattern in
  `tdfxfb.c` (line 1556).
- Minimal, no API changes.
- **Regression risk:** Very low — `arch_phys_wc_del()` is documented to
  be safe for handle `0` and error returns.

---

## PHASE 3: GIT HISTORY INVESTIGATION

### Step 3.1: Blame
**Record:**
- `arch_phys_wc_add()` introduced in `f8f05cdc767fa` (Apr 2015, “use
  arch_phys_wc_add() and ioremap_wc()”).
- `f8f05cdc767fa` **is** an ancestor of this tree (`merge-base` exit 0).
- Error-path labels date to 2005–2008; WC cleanup on error was never
  added when MTRR code was converted in 2015.

### Step 3.2: Fixes: tag
**Record:** N/A — no `Fixes:` tag. Bug introduced by `f8f05cdc767fa`,
which is present in 6.18.y.

### Step 3.3: Related file history
**Record:**
- `a943710407120` — identical fix for `uvesafb_probe()` error path,
  **already in 6.18.y**
- `ed359a464846b` — `pm2fb` missing `pci_disable_device()` on probe
  error path, **already in 6.18.y**
- `tdfxfb.c` already has `arch_phys_wc_del()` on probe error path (line
  1556)
- Standalone patch; not part of a series

### Step 3.4: Author context
**Record:** Haoxiang Li submits probe error-path leak fixes across
subsystems; Helge Deller (fbdev maintainer) applied this patch.

### Step 3.5: Dependencies
**Record:** None. Requires only
`arch_phys_wc_add()`/`arch_phys_wc_del()` and `wc_cookie` in `struct
pm2fb_par`, all present since `f8f05cdc767fa`. Applies cleanly.

---

## PHASE 4: MAILING LIST AND EXTERNAL RESEARCH

### Step 4.1: Original discussion
**Record:**
- `b4 dig -c 16eb19f0c90af`: https://patch.msgid.link/20260621071935.380
  2673-1-haoxiang_li2024@163.com
- Single-patch submission; Helge Deller replied “applied. Thanks!”
- No series revisions (`-a` not needed; single patch)
- No stable nomination in thread
- No NAKs or concerns

### Step 4.2: Reviewers
**Record:** `b4 dig -w`: To/Cc — Haoxiang Li, Helge Deller, `linux-
fbdev@vger.kernel.org`, `linux-kernel@vger.kernel.org`

### Step 4.3: Bug reports
**Record:** N/A — no `Reported-by:` or `Link:` tags; no syzbot/fuzzer
involvement.

### Step 4.4: Related patches
**Record:** Direct analogue: `a943710407120` (uvesafb, same maintainer,
same pattern).

### Step 4.5: Stable list history
**Record:** Lore fetch blocked by bot protection; no stable-list
discussion found via `b4`. Precedent established in-tree via uvesafb
backport.

---

## PHASE 5: CODE SEMANTIC ANALYSIS

### Step 5.1: Key functions
**Record:** `pm2fb_probe()`, `arch_phys_wc_add()`, `arch_phys_wc_del()`

### Step 5.2: Callers
**Record:** `pm2fb_probe()` registered as `.probe` in `pm2fb_driver`
(PCI core during device enumeration/module load). Not a hot path; runs
once per device attach attempt.

### Step 5.3: Callees
**Record:** On failure after WC setup: `kfree()`, `fb_dealloc_cmap()`,
`iounmap()`, `release_mem_region()`, `framebuffer_release()`,
`pci_disable_device()`. WC teardown was the missing piece.

### Step 5.4: Reachability
**Record:** Trigger requires `CONFIG_FB_PM2` built/loaded, Permedia2
hardware present, probe progressing past smem ioremap + WC add, then
failing at:
1. `kmalloc(PM2_PIXMAP_SIZE)` → `-ENOMEM`
2. `fb_alloc_cmap()` failure
3. `register_framebuffer()` failure

Reachable from module load / PCI hotplug; no userspace syscall needed
beyond normal device binding.

### Step 5.5: Similar patterns
**Record:**
- `tdfxfb.c`: has probe-error `arch_phys_wc_del()` ✓
- `uvesafb.c`: fixed in `a943710407120` (in this tree) ✓
- `s3fb.c`, `i740fb.c`: WC add after success point or missing probe-
  error del (latent issues elsewhere; out of scope)

---

## PHASE 6: CROSS-REFERENCE AGAINST LOCAL TREE

### Step 6.1: Buggy code present?
**Record:** **Yes.** Lines 1655–1657 call `arch_phys_wc_add()`; lines
1713–1715 (`err_exit_pixmap`) lack `arch_phys_wc_del()`. Bug present
since `f8f05cdc767fa` (2015).

### Step 6.2: Backport complications
**Record:** Clean apply expected — one line at `err_exit_pixmap`,
identical context to mainline diff.

### Step 6.3: Related fixes already present?
**Record:**
- `a943710407120` (uvesafb WC probe-error fix) — **present**
- `ed359a464846b` (pm2fb `pci_disable_device` probe fix) — **present**
- `16eb19f0c90af` (this fix) — **absent** (`merge-base --is-ancestor`
  exit 1)

---

## PHASE 7: SUBSYSTEM CONTEXT

### Step 7.1: Subsystem criticality
**Record:** `drivers/video/fbdev/pm2fb.c` — legacy framebuffer driver
(`CONFIG_FB_PM2`, tristate). **PERIPHERAL** — affects users of 1990s-era
Permedia2 hardware (PCI/SPARC).

### Step 7.2: Activity
**Record:** Low churn; occasional maintenance fixes from Helge Deller’s
fbdev tree.

---

## PHASE 8: IMPACT AND RISK ASSESSMENT

### Step 8.1: Who is affected
**Record:** Users with Permedia2 hardware, `CONFIG_FB_PM2` enabled,
probe failing after WC setup. Narrow population.

### Step 8.2: Trigger conditions
**Record:**
- **Real leak only on:** x86, PAT disabled, MTRR enabled, `nomtrr=0`
- **Failure modes:** ENOMEM or framebuffer registration failure after WC
  add
- **Likelihood:** Low (legacy hardware + rare probe failure)
- **Unprivileged trigger:** Indirectly via module load / device
  presence; not a typical attack vector

### Step 8.3: Failure severity
**Record:** Leaked MTRR slot (finite resource, typically ~8–10 entries).
Can degrade performance or block other drivers needing MTRR on PAT-less
systems. **Not** a crash, deadlock, or data corruption. **Severity:
LOW–MEDIUM** (resource leak, not security).

### Step 8.4: Risk–benefit
**Record:**
- **Benefit:** Correct probe teardown; consistency with uvesafb/tdfxfb;
  prevents MTRR exhaustion on affected configs
- **Risk:** Negligible — one line, symmetric with remove path, no-op on
  modern PAT-enabled systems
- **Ratio:** Low benefit magnitude, but also near-zero risk; established
  fbdev stable pattern

---

## PHASE 9: FINAL SYNTHESIS

### Step 9.1: Evidence summary

**FOR backport:**
- Real, verifiable resource leak since 2015 WC conversion
- One-line, obviously correct fix
- Identical pattern already backported in this tree (`a943710407120`
  uvesafb)
- Same maintainer (Helge Deller) applied both uvesafb and pm2fb fixes
- Buggy code confirmed present in 6.18.y; fix not yet applied
- Matches `tdfxfb` probe-error pattern already in tree

**AGAINST backport:**
- Very obscure hardware (Permedia2)
- No user reports, syzbot, or security angle
- Effective only on PAT-less x86 with MTRR (rare on 6.18 deployments)
- Impact is resource leak, not crash/corruption
- “Important issue” bar is borderline for severity

**Unresolved:** None material to the decision.

### Step 9.2: Stable rules checklist
1. Obviously correct and tested? **PASS** — mirrors remove path;
   maintainer applied; no objections
2. Fixes a real bug? **PASS** — MTRR leak on probe failure (on affected
   configs)
3. Important issue? **PASS (borderline)** — resource leak, not
   crash/security; but same class already accepted for uvesafb in this
   tree
4. Small and contained? **PASS** — 1 line, 1 file
5. No new features/APIs? **PASS**
6. Can apply to local tree? **PASS** — prerequisite code present; clean
   apply

### Step 9.3: Exception categories
**Record:** None (not device ID, quirk, DT, build, or docs). Standard
probe error-path resource cleanup.

### Step 9.4: Decision rationale

For **linux-6.18.y**, this is a legitimate probe error-path resource
leak fix. Severity is low and the hardware is legacy, but the patch is
trivial, zero-risk, and the **same tree already carries the identical
uvesafb fix** (`a943710407120`). Backporting maintains consistency in
fbdev probe teardown and closes a gap that has existed since the 2015
`arch_phys_wc_add()` conversion.

---

## Verification

- **[Phase 1]** Parsed subject, tags, body; no Reported-by/syzbot
- **[Phase 2]** Diff: +1 line `arch_phys_wc_del()` at `err_exit_pixmap`
  in `pm2fb_probe()`
- **[Phase 3]** `git describe HEAD` → `v6.18.44`; `git blame` → WC add
  from `f8f05cdc767fa` (2015)
- **[Phase 3]** `git merge-base --is-ancestor f8f05cdc767fa HEAD` → exit
  0 (bug source in tree)
- **[Phase 3]** `git merge-base --is-ancestor 16eb19f0c90af HEAD` → exit
  1 (fix not in tree)
- **[Phase 3]** `git log stable/linux-6.18.y..master -- pm2fb.c` → only
  `16eb19f` and unrelated pci_device_id change
- **[Phase 3]** Related: `a943710407120` (uvesafb), `ed359a464846b`
  (pm2fb pci_disable) in tree
- **[Phase 4]** `b4 dig -c 16eb19f` → lore URL found; maintainer
  “applied”
- **[Phase 4]** `b4 dig -w` → fbdev maintainers CC’d
- **[Phase 5]** Read `arch_phys_wc_add/del` in
  `arch/x86/kernel/cpu/mtrr/mtrr.c` and stubs in `include/linux/io.h`
- **[Phase 5]** Compared `tdfxfb.c:1556` (has probe-error del) and
  `pm2fb.c:1738` (remove-path del)
- **[Phase 6]** Confirmed missing `arch_phys_wc_del` at lines 1713–1715
  in current tree
- **[Phase 6]** `git show a943710407120` — identical uvesafb probe-error
  fix already in 6.18.y
- **[Phase 8]** Assessed impact: MTRR leak on PAT-less x86 only;
  LOW–MEDIUM severity

**YES**The background lookups finished and matched what the analysis
used:

- **pm2fb history:** The commit isn’t in this `v6.18.44` tree yet;
  recent `pm2fb.c` history shows maintenance fixes like the
  `pci_disable_device()` probe cleanup.
- **Candidate hash:** Mainline commit is `16eb19f0c90af` (“fbdev: pm2fb:
  unwind WC setup on probe failure”).
- **Stable precedent:** `6.18.y` already has the same pattern for
  uvesafb (`a943710407120`); this pm2fb fix is not in stable yet.

**Verdict for 6.18.y: YES** — one-line probe error-path MTRR/WC cleanup,
same class of fix already accepted in this tree.

 drivers/video/fbdev/pm2fb.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/video/fbdev/pm2fb.c b/drivers/video/fbdev/pm2fb.c
index f34429829b7d7..82408503c2812 100644
--- a/drivers/video/fbdev/pm2fb.c
+++ b/drivers/video/fbdev/pm2fb.c
@@ -1711,6 +1711,7 @@ static int pm2fb_probe(struct pci_dev *pdev, const struct pci_device_id *id)
  err_exit_both:
 	kfree(info->pixmap.addr);
  err_exit_pixmap:
+	arch_phys_wc_del(default_par->wc_cookie);
 	iounmap(info->screen_base);
 	release_mem_region(pm2fb_fix.smem_start, pm2fb_fix.smem_len);
  err_exit_mmio:
-- 
2.53.0

[PATCH AUTOSEL 6.18] fbdev: Wrap user-invoked calls to fb_set_var() in helper

[Sasha Levin]

From: Thomas Zimmermann <tzimmermann@suse.de>

[ Upstream commit 6f611e5e5f3327cf2e2daabe6ee5acac58cc784e ]

Handle fbcon during display updates in fb_set_var_from_user(). Check
with fbcon if the mode change is possible, update hardware state and
finally update fbcon. Update all callers.

Only the FBIOPUT_VSCREENINFO ioctl currently does all steps. Other
mode-changes callers in sysfs and driver code are missing fbcon-related
steps.

With the new helper, ps3fb and sh_mobile_lcdcfb no longer maintain
fbcon state themselves.

Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---

LLM Generated explanations, may be completely bogus:

# Stable Backport Analysis: `fbdev: Wrap user-invoked calls to
fb_set_var() in helper`

**Local tree:** `v6.18.44` (6.18.y stable)
**Commit under review:** `6f611e5e5f3327cf2e2daabe6ee5acac58cc784e` (not
in HEAD; present as git object, applies cleanly)

---

## PHASE 1: COMMIT MESSAGE FORENSICS

### Step 1.1: Subject line
**Record:** `[fbdev]` `[wrap/consolidate]` — Introduce
`fb_set_var_from_user()` helper and route all user-invoked mode-change
paths through it.

### Step 1.2: Tags
**Record:**
- **Signed-off-by:** Thomas Zimmermann `<tzimmermann@suse.de>` (author)
- **Signed-off-by:** Helge Deller `<deller@gmx.de>` (fbdev maintainer)
- No `Fixes:`, `Reported-by:`, `Cc: stable@vger.kernel.org`, `Link:`,
  `Reviewed-by:`, `Tested-by:`, or `Acked-by:` tags

Notable: maintainer sign-off; absence of stable tag is expected for
manual review.

### Step 1.3: Body analysis
**Record:**
- **Bug described:** Only `FBIOPUT_VSCREENINFO` ioctl performs the full
  fbcon sequence (`fbcon_modechange_possible` → `fb_set_var` →
  `fbcon_update_vcs`). Sysfs mode-change paths and driver ioctl/reconfig
  paths skip the `fbcon_modechange_possible` check.
- **Symptom/failure mode:** Incomplete fbcon synchronization on mode
  changes; missing validation that resolution is not smaller than
  console font size.
- **Version info:** None in message.
- **Root cause:** Inconsistent fbcon handling across user-facing entry
  points after the ioctl-only fix from 2022.

### Step 1.4: Hidden bug fix detection
**Record:** Yes — despite refactor-style wording, this completes a real
correctness/safety gap. The original `fbcon_modechange_possible()`
commit (`e64242caef18b`, 2022) explicitly warned that undersized
resolutions cause character rendering to access memory outside the
graphics region. That check was ioctl-only; sysfs and driver paths
remained vulnerable.

---

## PHASE 2: DIFF ANALYSIS

### Step 2.1: Change inventory
**Record:**
| File | Change |
|------|--------|
| `fb_chrdev.c` | −5/+1 |
| `fbcon.c` | −2 (remove exports) |
| `fbmem.c` | +13 (new helper) |
| `fbsysfs.c` | −3/+1 |
| `ps3fb.c` | −4/+1 |
| `sh_mobile_lcdcfb.c` | −4/+1 |
| `include/linux/fb.h` | +2 |

**Functions modified:** `do_fb_ioctl()`, `activate()`,
`fb_set_var_from_user()` (new), `ps3fb_ioctl()`,
`sh_mobile_fb_reconfig()`
**Scope:** Small, multi-file but tightly focused consolidation.

### Step 2.2: Code flow per hunk
**Record:**
1. **`fb_chrdev.c` / `FBIOPUT_VSCREENINFO`:** Three-step inline sequence
   → single `fb_set_var_from_user()` call. Behavior unchanged.
2. **`fbmem.c`:** New helper encapsulates the three-step sequence.
3. **`fbsysfs.c` / `activate()`:** Before: `fb_set_var` +
   `fbcon_update_vcs` (no validation). After: `fb_set_var_from_user`
   (adds `fbcon_modechange_possible`).
4. **`ps3fb.c`:** Same — gains validation via helper; drops direct
   `fbcon.h` usage.
5. **`sh_mobile_lcdcfb.c`:** Before: `fb_set_var` then separate
   `fbcon_update_vcs`. After: single helper call with validation.
6. **`fbcon.c`:** Removes `EXPORT_SYMBOL` / `EXPORT_SYMBOL_GPL` from
   `fbcon_update_vcs` and `fbcon_modechange_possible`.

### Step 2.3: Bug mechanism
**Record:**
- **Category:** Memory safety / logic correctness (OOB access prevention
  + fbcon state consistency).
- **Mechanism:** `fbcon_modechange_possible()` rejects resolutions where
  font width/height exceeds effective `xres`/`yres` (with rotation).
  Sysfs (`store_mode`, `store_rotate`, `store_virtual`, `store_bpp` via
  `activate()`) and ps3fb/sh_mobile paths bypassed this check.
  Undersized modes could proceed to `fb_set_var` and fbcon rendering,
  risking out-of-bounds framebuffer access — the same failure mode
  documented in `e64242caef18b`.

### Step 2.4: Fix quality
**Record:**
- Fix is obviously correct: extracts ioctl’s already-proven three-step
  pattern.
- Minimal, no unrelated changes.
- **Regression risk:** Low for in-tree code. Removing exports of
  `fbcon_update_vcs` / `fbcon_modechange_possible` could affect out-of-
  tree GPL modules; in-tree users (`ps3fb`, `sh_mobile_lcdcfb`) are
  updated in the same patch. ps3fb/sh_mobile may now reject mode changes
  that previously succeeded but were unsafe — intentional behavior
  change.

---

## PHASE 3: GIT HISTORY INVESTIGATION

### Step 3.1: Blame
**Record:**
- `fb_chrdev.c:88-92`: Added in `588b35634a5aa` (Thomas Zimmermann,
  2023) with full three-step sequence.
- `fbsysfs.c:23-25`: `fb_set_var` since 2005; `fbcon_update_vcs` added
  in `d88ca7e1a27eb` (2020, syzbot OOB fix); never gained
  `fbcon_modechange_possible`.
- **Bug introduced:** Gap since `e64242caef18b` (Jun 2022) when
  validation was ioctl-only.

### Step 3.2: Fixes tag
**Record:** N/A — no `Fixes:` tag. Related fix `e64242caef18b` is in
this tree (`git merge-base --is-ancestor` confirms).

### Step 3.3: Related file history
**Record:**
- `e64242caef18b` — ioctl-only font-size validation (Cc: stable # v5.4+)
- `d88ca7e1a27eb` — syzbot OOB in `vc_do_resize`, pulled
  `fbcon_update_vcs` out of `fb_set_var`
- Recent stable-relevant fbcon fixes in tree: OOB/null-ptr fixes
  (`076b1aa65f77a`, `6617df8c24631`)
- **Standalone:** Patch 1/4 of “Internalize fbcon” series; does not
  require patches 2–4 to function.

### Step 3.4: Author context
**Record:** Thomas Zimmermann is active fbdev/fbcon maintainer. Helge
Deller (co-author of original `fbcon_modechange_possible`) signed off.

### Step 3.5: Dependencies
**Record:** No prerequisite commits required.
`fbcon_modechange_possible` and `fbcon_update_vcs` exist in tree. `git
apply --check` passes cleanly on 6.18.44.

---

## PHASE 4: MAILING LIST AND EXTERNAL RESEARCH

### Step 4.1: Original discussion
**Record:**
- **b4 dig URL:**
  https://patch.msgid.link/20260527151551.258659-2-tzimmermann@suse.de
- **Series revisions:** v1 (2026-05-20), v2 (2026-05-22), v3
  (2026-05-27) — committed version is v3.
- **WebFetch of lore:** Blocked by Anubis bot protection; could not read
  full thread.
- **From search snippets:** AI review noted ps3fb gains
  `fbcon_modechange_possible` check as intentional behavioral change.

### Step 4.2: Reviewers
**Record:** CC list includes Helge Deller, Geert Uytterhoeven, Simona
Vetter, airlied, linux-fbdev, dri-devel, linuxppc-dev — appropriate
subsystem coverage.

### Step 4.3: Bug reports
**Record:** No direct bug report in this commit. Underlying issue
matches `e64242caef18b` rationale (OOB framebuffer access). Related
syzbot fix `d88ca7e1a27eb` addressed a different fbcon/OOB path.

### Step 4.4: Series context
**Record:** Part of 4-patch “fbdev: Internalize fbcon” series. Patches
2–4 handle `fb_blank_from_user` and unexporting fbcon symbols more
broadly. This patch is self-contained for the `fb_set_var` path.

### Step 4.5: Stable list history
**Record:** UNVERIFIED — could not search lore stable list due to fetch
blocking. Original `e64242caef18b` was explicitly nominated `Cc:
stable@vger.kernel.org # v5.4+`.

---

## PHASE 5: CODE SEMANTIC ANALYSIS

### Step 5.1: Key functions
**Record:** `fb_set_var_from_user()` (new), `activate()`,
`do_fb_ioctl()`, `ps3fb_ioctl()`, `sh_mobile_fb_reconfig()`.

### Step 5.2: Callers
**Record:**
- `activate()` ← `store_mode`, `store_bpp`, `store_rotate`,
  `store_virtual` (sysfs, root-writable framebuffer attributes)
- `do_fb_ioctl()` ← `FBIOPUT_VSCREENINFO` (userspace ioctl on
  `/dev/fb*`)
- `ps3fb_ioctl()` ← `PS3FB_IOCTL_SETMODE` (PS3 platform)
- `sh_mobile_fb_reconfig()` ← `sh_mobile_lcdc_release()` on display
  hotplug/reconfig (SH Mobile embedded)

### Step 5.3: Callees
**Record:** `fbcon_modechange_possible()` → `fb_set_var()` →
`fbcon_update_vcs()`. Requires `console_lock()` + `lock_fb_info()` at
all call sites (already present).

### Step 5.4: Reachability
**Record:**
- Sysfs paths: reachable by privileged users (root) on any system with
  framebuffer sysfs nodes.
- Ioctl: reachable by users with framebuffer device access.
- ps3fb/sh_mobile: platform-specific but real hardware paths.
- **Userspace triggerable:** Yes (sysfs/ioctl, privileged).

### Step 5.5: Similar patterns
**Record:** ioctl path in `fb_chrdev.c` already had the correct three-
step pattern since 2022/2023. Sysfs and drivers were the inconsistent
outliers.

---

## PHASE 6: CROSS-REFERENCE AGAINST LOCAL TREE (6.18.44)

### Step 6.1: Buggy code present?
**Record:** **Yes.** Current tree at `fbsysfs.c:23-25` calls
`fb_set_var` + `fbcon_update_vcs` without `fbcon_modechange_possible`.
Same gap in `ps3fb.c:833-835` and `sh_mobile_lcdcfb.c:1768-1772`. Commit
`6f611e5` is **NOT** in HEAD.

### Step 6.2: Backport complications
**Record:** `git apply --check` on commit patch: **clean apply**. No
structural conflicts observed.

### Step 6.3: Related fixes already present?
**Record:** `e64242caef18b` (ioctl-only validation) is in tree. No
`fb_set_var_from_user` or equivalent consolidation. Gap remains open.

---

## PHASE 7: SUBSYSTEM CONTEXT

### Step 7.1: Subsystem criticality
**Record:** `drivers/video/fbdev` / `fbcon` — **IMPORTANT** (framebuffer
console on servers, embedded, legacy platforms; less universal than
mm/net but affects console stability).

### Step 7.2: Activity
**Record:** Actively maintained — recent fixes include UAF, null-ptr-
deref, and OOB fixes in fbdev/fbcon on this branch.

---

## PHASE 8: IMPACT AND RISK ASSESSMENT

### Step 8.1: Who is affected
**Record:** Users of fbdev with active fbcon text console who change
modes via sysfs or affected drivers (not only ioctl). Embedded (SH
Mobile), PS3, and general framebuffer sysfs users.

### Step 8.2: Trigger conditions
**Record:** Set framebuffer mode/rotation/virtual resolution via sysfs
to a value smaller than current console font dimensions while fbcon is
active in text mode. Requires privileged access. Not everyday, but
realistic for admin tooling and embedded hotplug scenarios.

### Step 8.3: Failure mode severity
**Record:** Out-of-bounds framebuffer memory access during console
character rendering → potential kernel oops, memory corruption.
**Severity: HIGH** (same class as the 2022 ioctl fix that went to
stable).

### Step 8.4: Risk-benefit
**Record:**
- **Benefit:** HIGH — closes a known validation gap left by incomplete
  application of `e64242caef18b`.
- **Risk:** LOW — ~37 lines, behavior matches existing ioctl path;
  applies cleanly.
- **Ratio:** Strong benefit, low risk.

---

## PHASE 9: FINAL SYNTHESIS

### Step 9.1: Evidence summary

**FOR backport:**
- Fixes real OOB/corruption-class bug (documented in `e64242caef18b`)
- Completes ioctl-only fix from 2022 across sysfs and driver paths
- Small, surgical, applies cleanly to 6.18.44
- Maintainer sign-off (Helge Deller)
- Same bug class previously deemed stable-worthy (`Cc: stable` on
  original)
- Privileged userspace can trigger via sysfs

**AGAINST backport:**
- Adds new exported helper `fb_set_var_from_user` (kernel-internal, not
  userspace API)
- Removes exports of `fbcon_update_vcs` / `fbcon_modechange_possible`
  (minor ABI concern for OOT modules)
- Part of larger “internalize fbcon” series (but functionally
  standalone)
- No syzbot/user bug report for this specific gap

**Unresolved:** Full lore review thread content (fetch blocked).

### Step 9.2: Stable rules checklist
1. Obviously correct and tested? **PASS** — logic mirrors proven ioctl
   path; maintainer SOB.
2. Fixes real bug affecting users? **PASS** — sysfs/driver paths lack
   font-size validation.
3. Important issue? **PASS** — OOB memory access / potential crash or
   corruption (**HIGH**).
4. Small and contained? **PASS** — 7 files, ~37 lines net.
5. No new features/APIs? **PASS** (with nuance) — new kernel helper
   export only; no userspace API; behavior fix not feature addition.
6. Can apply to local tree? **PASS** — `git apply --check` succeeds.

### Step 9.3: Exception categories
**Record:** None (not device ID, quirk, DT, build, or docs). Qualifies
as a correctness/memory-safety bug fix.

### Step 9.4: Problem summary for stable users
When the 2022 fix added `fbcon_modechange_possible()` to prevent console
font rendering past framebuffer bounds, it was wired only into the
`FBIOPUT_VSCREENINFO` ioctl. Sysfs mode/rotation/virtual-resolution
writes and ps3fb/sh_mobile driver paths still allowed undersized modes,
risking the same out-of-bounds access. This commit routes all user-
invoked `fb_set_var` paths through one helper that performs validation,
hardware update, and fbcon refresh — closing that gap on 6.18.y.

---

## Verification

- **[Phase 1]** Parsed subject, tags, body; no Reported-by/syzbot/Fixes
  tags.
- **[Phase 1]** Identified hidden bug fix via cross-reference to
  `e64242caef18b` message.
- **[Phase 2]** Diff inventory: 7 files, functions listed; bug = missing
  `fbcon_modechange_possible` on non-ioctl paths.
- **[Phase 3]** `git describe HEAD` → `v6.18.44`; `make kernelversion` →
  `6.18.44`.
- **[Phase 3]** `git blame` on `fb_chrdev.c:86-92` and
  `fbsysfs.c:16-26`.
- **[Phase 3]** `git show e64242caef18b` — original OOB rationale and
  ioctl-only placement confirmed.
- **[Phase 3]** `git merge-base --is-ancestor e64242caef18b HEAD` → in
  tree.
- **[Phase 3]** `git merge-base --is-ancestor 6f611e5 HEAD` → NOT in
  tree.
- **[Phase 3]** `git log -S fbcon_modechange_possible` — introduced
  `e64242caef18b`, ioctl placement `588b35634a5aa`.
- **[Phase 4]** `b4 dig -c 6f611e5` → lore URL found; v1/v2/v3 revisions
  listed.
- **[Phase 4]** `b4 dig -w` → CC list with Deller, Geert, linux-fbdev,
  dri-devel.
- **[Phase 4]** WebFetch lore URL → blocked (Anubis); thread content
  UNVERIFIED.
- **[Phase 5]** `grep` callers: `activate()` used by `store_mode`,
  `store_bpp`, `store_rotate`, `store_virtual`.
- **[Phase 5]** `grep` for `fbcon_update_vcs` /
  `fbcon_modechange_possible` — only fbdev core + ps3fb + sh_mobile.
- **[Phase 6]** Read current `fbsysfs.c`, `fb_chrdev.c`, `ps3fb.c`,
  `sh_mobile_lcdcfb.c` — buggy pattern confirmed.
- **[Phase 6]** `git show 6f611e5 | git apply --check` → clean apply.
- **[Phase 6]** `grep fb_set_var_from_user` → not in tree.
- **[Phase 8]** Failure mode from `e64242caef18b`: OOB graphics memory
  access; severity HIGH.

**YES****Verdict for 6.18.44:** **YES** — backport this commit.

It closes a real gap left by the 2022 ioctl-only
`fbcon_modechange_possible()` fix: sysfs mode/rotation/virtual writes
and ps3fb/sh_mobile paths could still set resolutions smaller than the
console font, risking out-of-bounds framebuffer access. The patch is
small (~37 lines), applies cleanly, and mirrors the ioctl path’s
existing three-step sequence.

**Commit:** `6f611e5e5f3327cf2e2daabe6ee5acac58cc784e` (not yet in this
tree).

 drivers/video/fbdev/core/fb_chrdev.c   |  6 +-----
 drivers/video/fbdev/core/fbcon.c       |  2 --
 drivers/video/fbdev/core/fbmem.c       | 13 +++++++++++++
 drivers/video/fbdev/core/fbsysfs.c     |  4 +---
 drivers/video/fbdev/ps3fb.c            |  5 +----
 drivers/video/fbdev/sh_mobile_lcdcfb.c |  5 +----
 include/linux/fb.h                     |  2 ++
 7 files changed, 19 insertions(+), 18 deletions(-)

diff --git a/drivers/video/fbdev/core/fb_chrdev.c b/drivers/video/fbdev/core/fb_chrdev.c
index 4ebd16b7e3b8d..54f926fb411bd 100644
--- a/drivers/video/fbdev/core/fb_chrdev.c
+++ b/drivers/video/fbdev/core/fb_chrdev.c
@@ -85,11 +85,7 @@ static long do_fb_ioctl(struct fb_info *info, unsigned int cmd,
 		var.activate &= ~FB_ACTIVATE_KD_TEXT;
 		console_lock();
 		lock_fb_info(info);
-		ret = fbcon_modechange_possible(info, &var);
-		if (!ret)
-			ret = fb_set_var(info, &var);
-		if (!ret)
-			fbcon_update_vcs(info, var.activate & FB_ACTIVATE_ALL);
+		ret = fb_set_var_from_user(info, &var);
 		unlock_fb_info(info);
 		console_unlock();
 		if (!ret && copy_to_user(argp, &var, sizeof(var)))
diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
index df1ecbf3f5d02..35210f2bb7b2b 100644
--- a/drivers/video/fbdev/core/fbcon.c
+++ b/drivers/video/fbdev/core/fbcon.c
@@ -2754,7 +2754,6 @@ void fbcon_update_vcs(struct fb_info *info, bool all)
 	else
 		fbcon_modechanged(info);
 }
-EXPORT_SYMBOL(fbcon_update_vcs);
 
 /* let fbcon check if it supports a new screen resolution */
 int fbcon_modechange_possible(struct fb_info *info, struct fb_var_screeninfo *var)
@@ -2782,7 +2781,6 @@ int fbcon_modechange_possible(struct fb_info *info, struct fb_var_screeninfo *va
 
 	return 0;
 }
-EXPORT_SYMBOL_GPL(fbcon_modechange_possible);
 
 int fbcon_mode_deleted(struct fb_info *info,
 		       struct fb_videomode *mode)
diff --git a/drivers/video/fbdev/core/fbmem.c b/drivers/video/fbdev/core/fbmem.c
index 30a2c0d47e5c8..1533d43a0a0c9 100644
--- a/drivers/video/fbdev/core/fbmem.c
+++ b/drivers/video/fbdev/core/fbmem.c
@@ -346,6 +346,19 @@ fb_set_var(struct fb_info *info, struct fb_var_screeninfo *var)
 }
 EXPORT_SYMBOL(fb_set_var);
 
+int fb_set_var_from_user(struct fb_info *info, struct fb_var_screeninfo *var)
+{
+	int ret = fbcon_modechange_possible(info, var);
+
+	if (!ret)
+		ret = fb_set_var(info, var);
+	if (!ret)
+		fbcon_update_vcs(info, var->activate & FB_ACTIVATE_ALL);
+
+	return ret;
+}
+EXPORT_SYMBOL(fb_set_var_from_user);
+
 static void fb_lcd_notify_blank(struct fb_info *info)
 {
 	int power;
diff --git a/drivers/video/fbdev/core/fbsysfs.c b/drivers/video/fbdev/core/fbsysfs.c
index fe8bd33e64ab1..d363f94207c3e 100644
--- a/drivers/video/fbdev/core/fbsysfs.c
+++ b/drivers/video/fbdev/core/fbsysfs.c
@@ -20,9 +20,7 @@ static int activate(struct fb_info *fb_info, struct fb_var_screeninfo *var)
 	var->activate |= FB_ACTIVATE_FORCE;
 	console_lock();
 	lock_fb_info(fb_info);
-	err = fb_set_var(fb_info, var);
-	if (!err)
-		fbcon_update_vcs(fb_info, var->activate & FB_ACTIVATE_ALL);
+	err = fb_set_var_from_user(fb_info, var);
 	unlock_fb_info(fb_info);
 	console_unlock();
 	if (err)
diff --git a/drivers/video/fbdev/ps3fb.c b/drivers/video/fbdev/ps3fb.c
index dbcda307f6a67..1376d19b19aeb 100644
--- a/drivers/video/fbdev/ps3fb.c
+++ b/drivers/video/fbdev/ps3fb.c
@@ -29,7 +29,6 @@
 #include <linux/freezer.h>
 #include <linux/uaccess.h>
 #include <linux/fb.h>
-#include <linux/fbcon.h>
 #include <linux/init.h>
 
 #include <asm/cell-regs.h>
@@ -830,9 +829,7 @@ static int ps3fb_ioctl(struct fb_info *info, unsigned int cmd,
 				/* Force, in case only special bits changed */
 				var.activate |= FB_ACTIVATE_FORCE;
 				par->new_mode_id = val;
-				retval = fb_set_var(info, &var);
-				if (!retval)
-					fbcon_update_vcs(info, var.activate & FB_ACTIVATE_ALL);
+				retval = fb_set_var_from_user(info, &var);
 				console_unlock();
 			}
 			break;
diff --git a/drivers/video/fbdev/sh_mobile_lcdcfb.c b/drivers/video/fbdev/sh_mobile_lcdcfb.c
index dd950e4ab5ceb..6038f217ab427 100644
--- a/drivers/video/fbdev/sh_mobile_lcdcfb.c
+++ b/drivers/video/fbdev/sh_mobile_lcdcfb.c
@@ -15,7 +15,6 @@
 #include <linux/ctype.h>
 #include <linux/dma-mapping.h>
 #include <linux/delay.h>
-#include <linux/fbcon.h>
 #include <linux/init.h>
 #include <linux/interrupt.h>
 #include <linux/ioctl.h>
@@ -1765,11 +1764,9 @@ static void sh_mobile_fb_reconfig(struct fb_info *info)
 	var.height = ch->display.height;
 	var.activate = FB_ACTIVATE_NOW;
 
-	if (fb_set_var(info, &var) < 0)
+	if (fb_set_var_from_user(info, &var) < 0)
 		/* Couldn't reconfigure, hopefully, can continue as before */
 		return;
-
-	fbcon_update_vcs(info, true);
 }
 
 /*
diff --git a/include/linux/fb.h b/include/linux/fb.h
index da2fdabd18cb3..f622f5f520cf0 100644
--- a/include/linux/fb.h
+++ b/include/linux/fb.h
@@ -541,6 +541,8 @@ extern int fb_set_var(struct fb_info *info, struct fb_var_screeninfo *var);
 extern int fb_pan_display(struct fb_info *info, struct fb_var_screeninfo *var);
 extern int fb_blank(struct fb_info *info, int blank);
 
+int fb_set_var_from_user(struct fb_info *info, struct fb_var_screeninfo *var);
+
 /*
  * Helpers for framebuffers in I/O memory
  */
-- 
2.53.0