linux.git/drivers/video, branch v6.18.21

fbcon: Remove struct fbcon_display.inverse

2026-03-04T12:21:32+00:00

[ Upstream commit 30baedeeeab524172abc0b58cb101e8df86b5be8 ]

The field inverse in struct fbcon_display is unused. Remove it.

Signed-off-by: Thomas Zimmermann 
Cc:  # v6.0+
Signed-off-by: Helge Deller 
Signed-off-by: Sasha Levin

fbdev: ffb: fix corrupted video output on Sun FFB1

2026-03-04T12:21:31+00:00

[ Upstream commit b28da0d092461ac239ff034a8ac3129320177ba3 ]

Fix Sun FFB1 corrupted video out ([1] and [2]) by disabling overlay and
initializing window mode to a known state. The issue never appeared on
my FFB2+/vertical nor Elite3D/M6. It could also depend on the PROM
version.

/SUNW,ffb@1e,0: FFB at 000001fc00000000, type 11, DAC pnum[236c] rev[10] manuf_rev[4]
X (II) /dev/fb0: Detected FFB1, Z-buffer, Single-buffered.
X (II) /dev/fb0: BT9068 (PAC1) ramdac detected (with normal cursor control)
X (II) /dev/fb0: Detected Creator/Creator3D

[1] https://www.instagram.com/p/DUTcSmSjSem/
[2] https://chaos.social/@ReneRebe/116023241660154102

Signed-off-by: René Rebe 
Cc: stable@kernel.org
Signed-off-by: Helge Deller 
Signed-off-by: Sasha Levin

fbdev: of: display_timing: fix refcount leak in of_get_display_timings()

2026-03-04T12:21:31+00:00

[ Upstream commit eacf9840ae1285a1ef47eb0ce16d786e542bd4d7 ]

of_parse_phandle() returns a device_node with refcount incremented,
which is stored in 'entry' and then copied to 'native_mode'. When the
error paths at lines 184 or 192 jump to 'entryfail', native_mode's
refcount is not decremented, causing a refcount leak.

Fix this by changing the goto target from 'entryfail' to 'timingfail',
which properly calls of_node_put(native_mode) before cleanup.

Fixes: cc3f414cf2e4 ("video: add of helper for display timings/videomode")
Cc: stable@vger.kernel.org
Signed-off-by: Weigang He 
Signed-off-by: Helge Deller 
Signed-off-by: Sasha Levin

fbdev: vt8500lcdfb: fix missing dma_free_coherent()

2026-03-04T12:21:31+00:00

[ Upstream commit 88b3b9924337336a31cefbe99a22ed09401be74a ]

fbi->fb.screen_buffer is allocated with dma_alloc_coherent() but is not
freed if the error path is reached.

Fixes: e7b995371fe1 ("video: vt8500: Add devicetree support for vt8500-fb and wm8505-fb")
Cc: 
Signed-off-by: Thomas Fourier 
Signed-off-by: Helge Deller 
Signed-off-by: Sasha Levin

fbcon: check return value of con2fb_acquire_newinfo()

2026-03-04T12:21:31+00:00

[ Upstream commit 011a0502801c8536f64141a2b61362c14f456544 ]

If fbcon_open() fails when called from con2fb_acquire_newinfo() then
info->fbcon_par pointer remains NULL which is later dereferenced.

Add check for return value of the function con2fb_acquire_newinfo() to
avoid it.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: d1baa4ffa677 ("fbcon: set_con2fb_map fixes")
Cc: stable@vger.kernel.org
Signed-off-by: Andrey Vatoropin 
Signed-off-by: Helge Deller 
Signed-off-by: Sasha Levin

fbdev: Use device_create_with_groups() to fix sysfs groups registration race

2026-03-04T12:21:31+00:00

[ Upstream commit 68eeb0871e986ae5462439dae881e3a27bcef85f ]

The fbdev sysfs attributes are registered after sending the uevent for
the device creation, leaving a race window where e.g. udev rules may
not be able to access the sysfs attributes because the registration is
not done yet.

Fix this by switching to device_create_with_groups(). This also results in
a nice cleanup. After switching to device_create_with_groups() all that
is left of fb_init_device() is setting the drvdata and that can be passed
to device_create[_with_groups]() too. After which fb_init_device() can
be completely removed.

Dropping fb_init_device() + fb_cleanup_device() in turn allows removing
fb_info.class_flag as they were the only user of this field.

Fixes: 5fc830d6aca1 ("fbdev: Register sysfs groups through device_add_group")
Cc: stable@vger.kernel.org
Cc: Shixiong Ou 
Signed-off-by: Hans de Goede 
Signed-off-by: Helge Deller 
Signed-off-by: Sasha Levin

backlight: qcom-wled: Change PM8950 WLED configurations

2026-02-26T22:59:35+00:00

[ Upstream commit 83333aa97441ba7ce32b91e8a007c72d316a1c67 ]

PMI8950 WLED needs same configurations as PMI8994 WLED.

Fixes: 10258bf4534b ("backlight: qcom-wled: Add PMI8950 compatible")
Signed-off-by: Barnabás Czémán 
Reviewed-by: Konrad Dybcio 
Reviewed-by: Daniel Thompson (RISCstar) 
Link: https://patch.msgid.link/20260116-pmi8950-wled-v3-4-e6c93de84079@mainlining.org
Signed-off-by: Lee Jones 
Signed-off-by: Sasha Levin

backlight: qcom-wled: Support ovp values for PMI8994

2026-02-26T22:59:35+00:00

[ Upstream commit f29f972a6e7e3f187ea4d89b98a76c1981ca4d53 ]

WLED4 found in PMI8994 supports different ovp values.

Fixes: 6fc632d3e3e0 ("video: backlight: qcom-wled: Add PMI8994 compatible")
Signed-off-by: Barnabás Czémán 
Reviewed-by: Konrad Dybcio 
Reviewed-by: Daniel Thompson (RISCstar) 
Link: https://patch.msgid.link/20260116-pmi8950-wled-v3-2-e6c93de84079@mainlining.org
Signed-off-by: Lee Jones 
Signed-off-by: Sasha Levin

fbdev: au1200fb: Fix a memory leak in au1200fb_drv_probe()

2026-02-26T22:59:28+00:00

[ Upstream commit ce4e25198a6aaaaf36248edf8daf3d744ec8e309 ]

In au1200fb_drv_probe(), when platform_get_irq fails(), it directly
returns from the function with an error code, which causes a memory
leak.

Replace it with a goto label to ensure proper cleanup.

Fixes: 4e88761f5f8c ("fbdev: au1200fb: Fix missing IRQ check in au1200fb_drv_probe")
Signed-off-by: Felix Gu 
Signed-off-by: Helge Deller 
Signed-off-by: Sasha Levin

fbdev: of_display_timing: Fix device node reference leak in of_get_display_timings()

2026-02-26T22:59:28+00:00

[ Upstream commit c39ee2d264f98efa14aa46c9942114cb03c7baa6 ]

Use for_each_child_of_node_scoped instead of for_each_child_of_node
to ensure automatic of_node_put on early exit paths, preventing
device node reference leak.

Fixes: cc3f414cf2e4 ("video: add of helper for display timings/videomode")
Signed-off-by: Felix Gu 
Signed-off-by: Helge Deller 
Signed-off-by: Sasha Levin