Commit 5fae9a928482 for kernel

commit 5fae9a928482d4845bca169a3a098789203a1ca4
Author: Ian Bridges <icb@fastmail.org>
Date:   Wed Jun 24 16:11:36 2026 -0500

    fbcon: fix NULL pointer dereference for a console without vc_data

    fbcon_new_modelist() runs when a framebuffer's modelist changes. For each
    console mapped to it with fb_display[i].mode set, it reads vc_cons[i].d and
    passes the vc_num to fbcon_set_disp(). This assumes a console with a mode
    set has a vc_data, but it can be NULL. fbcon_set_disp() sets
    fb_display[i].mode before it checks vc_data, and fbcon_deinit() leaves the
    mode set after the vc_data is freed. fbcon_new_modelist() then dereferences
    the NULL vc_data.

    Keep fb_display[i].mode set only while the console has a vc_data. Check
    vc_data before setting the mode in fbcon_set_disp(), and clear the mode in
    fbcon_deinit(). The existing mode check in fbcon_new_modelist() then skips
    such consoles.

    Reported-by: syzbot+42525d636f430fd5d983@syzkaller.appspotmail.com
    Closes: https://syzkaller.appspot.com/bug?extid=42525d636f430fd5d983
    Cc: stable@vger.kernel.org
    Assisted-by: Claude:claude-opus-4-8
    Signed-off-by: Ian Bridges <icb@fastmail.org>
    Signed-off-by: Helge Deller <deller@gmx.de>

diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
index 37beb93045af..9f5c4c101581 100644
--- a/drivers/video/fbdev/core/fbcon.c
+++ b/drivers/video/fbdev/core/fbcon.c
@@ -1273,6 +1273,7 @@ static void fbcon_deinit(struct vc_data *vc)
 	int idx;

 	fbcon_free_font(p);
+	p->mode = NULL;
 	idx = con2fb_map[vc->vc_num];

 	if (idx == -1)
@@ -1443,14 +1444,14 @@ static void fbcon_set_disp(struct fb_info *info, struct fb_var_screeninfo *var,

 	p = &fb_display[unit];

-	if (var_to_display(p, var, info))
-		return;
-
 	vc = vc_cons[unit].d;

 	if (!vc)
 		return;

+	if (var_to_display(p, var, info))
+		return;
+
 	default_mode = vc->vc_display_fg;
 	svc = *default_mode;
 	t = &fb_display[svc->vc_num];