Re: [BUG] drivers/tty: NULL pointer dereference in paste_selection()

[Weiming Shi]

Samuel Thibault <samuel.thibault@xxxxxxxxxxxx> 于2026年8月29日周六 03:55写道：
>
> Hello,
>
> Thanks for the notice, this is indeed a small timing window between
> switching VT and pasting text. In practice only root can trigger this,
> so this is not a security issue, but I will add a NULL check to avoid
> it.
>
> With regards,
> Samuel
>


Hello Samuel,

Thanks for looking into this.

One correction: this is triggerable without root. I reproduced it on
Debian 13.6 with espeakup enabled, from a tty1 session with:

  uid=1000(tester) gid=1000(tester)
  CapEff: 0000000000000000

The process called VT_ACTIVATE on its controlling tty, which is allowed
without CAP_SYS_TTY_CONFIG. Switching to VT8, which had no getty in this
setup, left vc->port.tty NULL. Pressing the Speakup paste key then
reliably triggered the NULL dereference in paste_selection(); no race
was needed.

The Speakup setup was an administrative system configuration step, but
the triggering console user was unprivileged. Whether console access is
considered a security boundary is a separate question.

I look forward to your patch and would be happy to test it.

Best regards,
Weiming Shi

> co, le jeu. 27 août 2026 12:42:57 +0000, a ecrit:
> > We found a bug reachable in:
> >
> >     path    drivers/tty/vt/selection.c` (fault site), `drivers/accessibility/speakup/main.c` + `drivers/accessibility/speakup
> >     crash   NULL pointer dereference in paste_selection()
> >     commit  f5098b6bae76 ("Linux 7.2-rc5")
> >
> > Config, environment, the sanitizer report and a C reproducer follow.
> >
> > == Notes ===============================================================
> >     If you patch the bug based on our artifacts, a tag would be
> >     appreciated:
> >
> > Reported-by: co+e5693071d903b832@xxxxxxx
> >
> >     Everything in this mail is validated by the reproducer below.
> >
> >     We also hold an LLM-generated root-cause analysis and a candidate
> >     patch. The patch passes an A/B test: the same reproducer panics the
> >     unpatched kernel and runs clean on the patched one. Neither has had
> >     human review, so both still require validation before you send or
> >     apply them. Available on:
> >
> >         patch.diff  https://bugs.sh/b/e5693071d903b832/patch.diff
> >         report.md   https://bugs.sh/b/e5693071d903b832/report.md
> >
> >     This is an open science project. The code and the full set of PoCs
> >     are not public at this moment, as we intend to disclose our findings
> >     in an ethical way.
> >
> >     Happy to test patches. Complaints and suggestions about our work
> >     are welcome at:
> >
> >         cedalion@xxxxxxx
> >
> > == Environment =========================================================
> >     Reproduced on  f5098b6bae76 ("Linux 7.2-rc5")
> >     VM setup       https://bugs.sh/b/e5693071d903b832/run.sh
> >     config         https://bugs.sh/b/e5693071d903b832/config.gz
> >     poc            https://bugs.sh/b/e5693071d903b832/repro.c
> >
> > == Sanitizer Report ====================================================
> > Oops: general protection fault, probably for non-canonical address 0xdffffc0000000044: 0000 [#1] SMP KASAN NOPTI
> > KASAN: null-ptr-deref in range [0x0000000000000220-0x0000000000000227]
> > CPU: 1 UID: 0 PID: 49 Comm: kworker/1:1 Not tainted 7.2.0-rc5 #10 PREEMPTLAZY
> > Workqueue: events __speakup_paste_selection
> > RIP: 0010:paste_selection (drivers/tty/vt/selection.c:393)
> > Call Trace:
> > __speakup_paste_selection (drivers/accessibility/speakup/selection.c:112)
> > process_one_work (kernel/workqueue.c:3322)
> > worker_thread (kernel/workqueue.c:3405 kernel/workqueue.c:3486)
> > kthread (kernel/kthread.c:436)
> > ret_from_fork (arch/x86/kernel/process.c:158)
> > ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
> > Kernel panic - not syncing: Fatal exception
> >
> >
> > ---
> > The report format is based on syzbot bug report.
> >
> > This report is generated by a bot. It may contain errors.
> > See https://github.com/n132/cedalion for more information.
> >
> > For any issue with this report, reach out to cedalion@xxxxxxx
> >
> > If the report is already addressed, let us know by replying with:
> > #co fix: <commit hash>
> >
> > If the report is a duplicate of another one, reply with:
> > #co dup: <lore link>
> >
> > If you want to undo deduplication, reply with:
> > #co undup
> >
> >
>
> --
> Samuel
> <c> hiri, le cri ici, c des marrants
> <c> j'ai un rep ".uglyhackdirectorywithoutacls" ds mon home
>  -+- #ens-mim en stage -+-
>