From: Samuel Thibault <samuel.thibault@ens-lyon.org>
To: Weiming Shi <bestswngs@gmail.com>
Cc: co <co+e5693071d903b832@bugs.sh>,
speakup@linux-speakup.org, William Hubbs <w.d.hubbs@gmail.com>,
Chris Brannon <chris@the-brannons.com>,
Kirk Reiser <kirk@reisers.ca>, Petr Mladek <pmladek@suse.com>,
Geert Uytterhoeven <geert+renesas@glider.be>,
Oleg Nesterov <oleg@redhat.com>,
Biju Das <biju.das.jz@bp.renesas.com>,
Sebastian Andrzej Siewior <bigeasy@linutronix.de>,
Song Liu <song@kernel.org>, Greg Kroah-Hartman <gregkh@suse.de>,
linux-kernel@vger.kernel.org
Subject: Re: [BUG] drivers/tty: NULL pointer dereference in paste_selection()
Date: Sat, 29 Aug 2026 11:11:38 +0200 [thread overview]
Message-ID: <apKiStBokkMZfNUy@end> (raw)
In-Reply-To: <CANgPUi0MxMtnx2JcWJtrTB+EwLbYExX9Lmp569Y+F=nkXMgY6w@mail.gmail.com>
Hello,
Weiming Shi, le sam. 29 août 2026 16:00:32 +0800, a ecrit:
> One correction: this is triggerable without root. I reproduced it on
> Debian 13.6 with espeakup enabled, from a tty1 session with:
>
> uid=1000(tester) gid=1000(tester)
> CapEff: 0000000000000000
>
> The process called VT_ACTIVATE on its controlling tty, which is allowed
> without CAP_SYS_TTY_CONFIG. Switching to VT8, which had no getty in this
> setup, left vc->port.tty NULL. Pressing the Speakup paste key
Pressing the speakup paste key either requires simulating it as root, or
pressing it physically, who in the speakup security model is rather
trusted.
Samuel
prev parent reply other threads:[~2026-08-29 9:11 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-27 12:42 co
2026-08-28 19:55 ` Samuel Thibault
2026-08-29 8:00 ` Weiming Shi
2026-08-29 9:11 ` Samuel Thibault [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=apKiStBokkMZfNUy@end \
--to=samuel.thibault@ens-lyon.org \
--cc=bestswngs@gmail.com \
--cc=bigeasy@linutronix.de \
--cc=biju.das.jz@bp.renesas.com \
--cc=chris@the-brannons.com \
--cc=co+e5693071d903b832@bugs.sh \
--cc=geert+renesas@glider.be \
--cc=gregkh@suse.de \
--cc=kirk@reisers.ca \
--cc=linux-kernel@vger.kernel.org \
--cc=oleg@redhat.com \
--cc=pmladek@suse.com \
--cc=song@kernel.org \
--cc=speakup@linux-speakup.org \
--cc=w.d.hubbs@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®