Re: [BUG] drivers/tty: NULL pointer dereference in paste_selection()

[Samuel Thibault <samuel.thibault@ens-lyon.org>]

Hello,

Thanks for the notice, this is indeed a small timing window between
switching VT and pasting text. In practice only root can trigger this,
so this is not a security issue, but I will add a NULL check to avoid
it.

With regards,
Samuel

co, le jeu. 27 août 2026 12:42:57 +0000, a ecrit:
> We found a bug reachable in:
> 
>     path    drivers/tty/vt/selection.c` (fault site), `drivers/accessibility/speakup/main.c` + `drivers/accessibility/speakup
>     crash   NULL pointer dereference in paste_selection()
>     commit  f5098b6bae76 ("Linux 7.2-rc5")
> 
> Config, environment, the sanitizer report and a C reproducer follow.
> 
> == Notes ===============================================================
>     If you patch the bug based on our artifacts, a tag would be
>     appreciated:
> 
> Reported-by: co+e5693071d903b832@bugs.sh
> 
>     Everything in this mail is validated by the reproducer below.
> 
>     We also hold an LLM-generated root-cause analysis and a candidate
>     patch. The patch passes an A/B test: the same reproducer panics the
>     unpatched kernel and runs clean on the patched one. Neither has had
>     human review, so both still require validation before you send or
>     apply them. Available on:
> 
>         patch.diff  https://bugs.sh/b/e5693071d903b832/patch.diff
>         report.md   https://bugs.sh/b/e5693071d903b832/report.md
> 
>     This is an open science project. The code and the full set of PoCs
>     are not public at this moment, as we intend to disclose our findings
>     in an ethical way.
> 
>     Happy to test patches. Complaints and suggestions about our work
>     are welcome at:
> 
>         cedalion@bugs.sh
> 
> == Environment =========================================================
>     Reproduced on  f5098b6bae76 ("Linux 7.2-rc5")
>     VM setup       https://bugs.sh/b/e5693071d903b832/run.sh
>     config         https://bugs.sh/b/e5693071d903b832/config.gz
>     poc            https://bugs.sh/b/e5693071d903b832/repro.c
> 
> == Sanitizer Report ====================================================
> Oops: general protection fault, probably for non-canonical address 0xdffffc0000000044: 0000 [#1] SMP KASAN NOPTI
> KASAN: null-ptr-deref in range [0x0000000000000220-0x0000000000000227]
> CPU: 1 UID: 0 PID: 49 Comm: kworker/1:1 Not tainted 7.2.0-rc5 #10 PREEMPTLAZY
> Workqueue: events __speakup_paste_selection
> RIP: 0010:paste_selection (drivers/tty/vt/selection.c:393)
> Call Trace:
> __speakup_paste_selection (drivers/accessibility/speakup/selection.c:112)
> process_one_work (kernel/workqueue.c:3322)
> worker_thread (kernel/workqueue.c:3405 kernel/workqueue.c:3486)
> kthread (kernel/kthread.c:436)
> ret_from_fork (arch/x86/kernel/process.c:158)
> ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
> Kernel panic - not syncing: Fatal exception
> 
> 
> ---
> The report format is based on syzbot bug report.
> 
> This report is generated by a bot. It may contain errors.
> See https://github.com/n132/cedalion for more information.
> 
> For any issue with this report, reach out to cedalion@bugs.sh
> 
> If the report is already addressed, let us know by replying with:
> #co fix: <commit hash>
> 
> If the report is a duplicate of another one, reply with:
> #co dup: <lore link>
> 
> If you want to undo deduplication, reply with:
> #co undup
> 
> 

-- 
Samuel
<c> hiri, le cri ici, c des marrants
<c> j'ai un rep ".uglyhackdirectorywithoutacls" ds mon home
 -+- #ens-mim en stage -+-