Re: [PATCH 2/2] Fix NULL pointer dereference on VT switch + selection

[Weiming Shi]

Samuel Thibault <samuel.thibault@xxxxxxxxxxxx> 于2026年8月30日周日 00:49写道：
>
> When selecting/pasting very quickly after VT switch, the tty is not set
> yet, leading to a NULL dereference. We can just abort the operation.
>
> Reported-by: co+e5693071d903b832@xxxxxxx
> Signed-off-by: Samuel Thibault <samuel.thibault@xxxxxxxxxxxx>
> Cc: stable@xxxxxxxxxxxxxxx
> ---
>  drivers/accessibility/speakup/selection.c | 6 ++++++
>  1 file changed, 6 insertions(+)
>
> diff --git a/drivers/accessibility/speakup/selection.c b/drivers/accessibility/speakup/selection.c
> index 1713ce4e0ba5..a04a7e8c307b 100644
> --- a/drivers/accessibility/speakup/selection.c
> +++ b/drivers/accessibility/speakup/selection.c
> @@ -61,6 +61,9 @@ static struct speakup_selection_work speakup_sel_work = {
>
>  int speakup_set_selection(struct tty_struct *tty)
>  {
> +       if (!tty)
> +               return -ENODEV;
> +
>         /* we get kref here first in order to avoid a subtle race when
>          * cancelling selection work. getting kref first establishes the
>          * invariant that if speakup_sel_work.tty is not NULL when
> @@ -120,6 +123,9 @@ static struct speakup_selection_work speakup_paste_work = {
>
>  int speakup_paste_selection(struct tty_struct *tty)
>  {
> +       if (!tty)
> +               return -ENODEV;
> +
>         tty_kref_get(tty);
>         if (cmpxchg(&speakup_paste_work.tty, NULL, tty)) {
>                 tty_kref_put(tty);
> --
> 2.47.3
>
>

Tested-by: Weiming Shi <bestswngs@xxxxxxxxx>