[BUG] drivers/tty: NULL pointer dereference in paste_selection()

[BUG] drivers/tty: NULL pointer dereference in paste_selection()

[co]

We found a bug reachable in:

    path    drivers/tty/vt/selection.c` (fault site), `drivers/accessibility/speakup/main.c` + `drivers/accessibility/speakup
    crash   NULL pointer dereference in paste_selection()
    commit  f5098b6bae76 ("Linux 7.2-rc5")

Config, environment, the sanitizer report and a C reproducer follow.

== Notes ===============================================================
    If you patch the bug based on our artifacts, a tag would be
    appreciated:

Reported-by: co+e5693071d903b832@bugs.sh

    Everything in this mail is validated by the reproducer below.

    We also hold an LLM-generated root-cause analysis and a candidate
    patch. The patch passes an A/B test: the same reproducer panics the
    unpatched kernel and runs clean on the patched one. Neither has had
    human review, so both still require validation before you send or
    apply them. Available on:

        patch.diff  https://bugs.sh/b/e5693071d903b832/patch.diff
        report.md   https://bugs.sh/b/e5693071d903b832/report.md

    This is an open science project. The code and the full set of PoCs
    are not public at this moment, as we intend to disclose our findings
    in an ethical way.

    Happy to test patches. Complaints and suggestions about our work
    are welcome at:

        cedalion@bugs.sh

== Environment =========================================================
    Reproduced on  f5098b6bae76 ("Linux 7.2-rc5")
    VM setup       https://bugs.sh/b/e5693071d903b832/run.sh
    config         https://bugs.sh/b/e5693071d903b832/config.gz
    poc            https://bugs.sh/b/e5693071d903b832/repro.c

== Sanitizer Report ====================================================
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000044: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000220-0x0000000000000227]
CPU: 1 UID: 0 PID: 49 Comm: kworker/1:1 Not tainted 7.2.0-rc5 #10 PREEMPTLAZY
Workqueue: events __speakup_paste_selection
RIP: 0010:paste_selection (drivers/tty/vt/selection.c:393)
Call Trace:
__speakup_paste_selection (drivers/accessibility/speakup/selection.c:112)
process_one_work (kernel/workqueue.c:3322)
worker_thread (kernel/workqueue.c:3405 kernel/workqueue.c:3486)
kthread (kernel/kthread.c:436)
ret_from_fork (arch/x86/kernel/process.c:158)
ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
Kernel panic - not syncing: Fatal exception


---
The report format is based on syzbot bug report.

This report is generated by a bot. It may contain errors.
See https://github.com/n132/cedalion for more information.

For any issue with this report, reach out to cedalion@bugs.sh

If the report is already addressed, let us know by replying with:
#co fix: <commit hash>

If the report is a duplicate of another one, reply with:
#co dup: <lore link>

If you want to undo deduplication, reply with:
#co undup

Re: [BUG] drivers/tty: NULL pointer dereference in paste_selection()

[Samuel Thibault]

Hello,

Thanks for the notice, this is indeed a small timing window between
switching VT and pasting text. In practice only root can trigger this,
so this is not a security issue, but I will add a NULL check to avoid
it.

With regards,
Samuel

co, le jeu. 27 août 2026 12:42:57 +0000, a ecrit:
> We found a bug reachable in:
> 
>     path    drivers/tty/vt/selection.c` (fault site), `drivers/accessibility/speakup/main.c` + `drivers/accessibility/speakup
>     crash   NULL pointer dereference in paste_selection()
>     commit  f5098b6bae76 ("Linux 7.2-rc5")
> 
> Config, environment, the sanitizer report and a C reproducer follow.
> 
> == Notes ===============================================================
>     If you patch the bug based on our artifacts, a tag would be
>     appreciated:
> 
> Reported-by: co+e5693071d903b832@bugs.sh
> 
>     Everything in this mail is validated by the reproducer below.
> 
>     We also hold an LLM-generated root-cause analysis and a candidate
>     patch. The patch passes an A/B test: the same reproducer panics the
>     unpatched kernel and runs clean on the patched one. Neither has had
>     human review, so both still require validation before you send or
>     apply them. Available on:
> 
>         patch.diff  https://bugs.sh/b/e5693071d903b832/patch.diff
>         report.md   https://bugs.sh/b/e5693071d903b832/report.md
> 
>     This is an open science project. The code and the full set of PoCs
>     are not public at this moment, as we intend to disclose our findings
>     in an ethical way.
> 
>     Happy to test patches. Complaints and suggestions about our work
>     are welcome at:
> 
>         cedalion@bugs.sh
> 
> == Environment =========================================================
>     Reproduced on  f5098b6bae76 ("Linux 7.2-rc5")
>     VM setup       https://bugs.sh/b/e5693071d903b832/run.sh
>     config         https://bugs.sh/b/e5693071d903b832/config.gz
>     poc            https://bugs.sh/b/e5693071d903b832/repro.c
> 
> == Sanitizer Report ====================================================
> Oops: general protection fault, probably for non-canonical address 0xdffffc0000000044: 0000 [#1] SMP KASAN NOPTI
> KASAN: null-ptr-deref in range [0x0000000000000220-0x0000000000000227]
> CPU: 1 UID: 0 PID: 49 Comm: kworker/1:1 Not tainted 7.2.0-rc5 #10 PREEMPTLAZY
> Workqueue: events __speakup_paste_selection
> RIP: 0010:paste_selection (drivers/tty/vt/selection.c:393)
> Call Trace:
> __speakup_paste_selection (drivers/accessibility/speakup/selection.c:112)
> process_one_work (kernel/workqueue.c:3322)
> worker_thread (kernel/workqueue.c:3405 kernel/workqueue.c:3486)
> kthread (kernel/kthread.c:436)
> ret_from_fork (arch/x86/kernel/process.c:158)
> ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
> Kernel panic - not syncing: Fatal exception
> 
> 
> ---
> The report format is based on syzbot bug report.
> 
> This report is generated by a bot. It may contain errors.
> See https://github.com/n132/cedalion for more information.
> 
> For any issue with this report, reach out to cedalion@bugs.sh
> 
> If the report is already addressed, let us know by replying with:
> #co fix: <commit hash>
> 
> If the report is a duplicate of another one, reply with:
> #co dup: <lore link>
> 
> If you want to undo deduplication, reply with:
> #co undup
> 
> 

-- 
Samuel
<c> hiri, le cri ici, c des marrants
<c> j'ai un rep ".uglyhackdirectorywithoutacls" ds mon home
 -+- #ens-mim en stage -+-

Re: [BUG] drivers/tty: NULL pointer dereference in paste_selection()

[Weiming Shi]

Samuel Thibault <samuel.thibault@ens-lyon.org> 于2026年8月29日周六 03:55写道：
>
> Hello,
>
> Thanks for the notice, this is indeed a small timing window between
> switching VT and pasting text. In practice only root can trigger this,
> so this is not a security issue, but I will add a NULL check to avoid
> it.
>
> With regards,
> Samuel
>


Hello Samuel,

Thanks for looking into this.

One correction: this is triggerable without root. I reproduced it on
Debian 13.6 with espeakup enabled, from a tty1 session with:

  uid=1000(tester) gid=1000(tester)
  CapEff: 0000000000000000

The process called VT_ACTIVATE on its controlling tty, which is allowed
without CAP_SYS_TTY_CONFIG. Switching to VT8, which had no getty in this
setup, left vc->port.tty NULL. Pressing the Speakup paste key then
reliably triggered the NULL dereference in paste_selection(); no race
was needed.

The Speakup setup was an administrative system configuration step, but
the triggering console user was unprivileged. Whether console access is
considered a security boundary is a separate question.

I look forward to your patch and would be happy to test it.

Best regards,
Weiming Shi

> co, le jeu. 27 août 2026 12:42:57 +0000, a ecrit:
> > We found a bug reachable in:
> >
> >     path    drivers/tty/vt/selection.c` (fault site), `drivers/accessibility/speakup/main.c` + `drivers/accessibility/speakup
> >     crash   NULL pointer dereference in paste_selection()
> >     commit  f5098b6bae76 ("Linux 7.2-rc5")
> >
> > Config, environment, the sanitizer report and a C reproducer follow.
> >
> > == Notes ===============================================================
> >     If you patch the bug based on our artifacts, a tag would be
> >     appreciated:
> >
> > Reported-by: co+e5693071d903b832@bugs.sh
> >
> >     Everything in this mail is validated by the reproducer below.
> >
> >     We also hold an LLM-generated root-cause analysis and a candidate
> >     patch. The patch passes an A/B test: the same reproducer panics the
> >     unpatched kernel and runs clean on the patched one. Neither has had
> >     human review, so both still require validation before you send or
> >     apply them. Available on:
> >
> >         patch.diff  https://bugs.sh/b/e5693071d903b832/patch.diff
> >         report.md   https://bugs.sh/b/e5693071d903b832/report.md
> >
> >     This is an open science project. The code and the full set of PoCs
> >     are not public at this moment, as we intend to disclose our findings
> >     in an ethical way.
> >
> >     Happy to test patches. Complaints and suggestions about our work
> >     are welcome at:
> >
> >         cedalion@bugs.sh
> >
> > == Environment =========================================================
> >     Reproduced on  f5098b6bae76 ("Linux 7.2-rc5")
> >     VM setup       https://bugs.sh/b/e5693071d903b832/run.sh
> >     config         https://bugs.sh/b/e5693071d903b832/config.gz
> >     poc            https://bugs.sh/b/e5693071d903b832/repro.c
> >
> > == Sanitizer Report ====================================================
> > Oops: general protection fault, probably for non-canonical address 0xdffffc0000000044: 0000 [#1] SMP KASAN NOPTI
> > KASAN: null-ptr-deref in range [0x0000000000000220-0x0000000000000227]
> > CPU: 1 UID: 0 PID: 49 Comm: kworker/1:1 Not tainted 7.2.0-rc5 #10 PREEMPTLAZY
> > Workqueue: events __speakup_paste_selection
> > RIP: 0010:paste_selection (drivers/tty/vt/selection.c:393)
> > Call Trace:
> > __speakup_paste_selection (drivers/accessibility/speakup/selection.c:112)
> > process_one_work (kernel/workqueue.c:3322)
> > worker_thread (kernel/workqueue.c:3405 kernel/workqueue.c:3486)
> > kthread (kernel/kthread.c:436)
> > ret_from_fork (arch/x86/kernel/process.c:158)
> > ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
> > Kernel panic - not syncing: Fatal exception
> >
> >
> > ---
> > The report format is based on syzbot bug report.
> >
> > This report is generated by a bot. It may contain errors.
> > See https://github.com/n132/cedalion for more information.
> >
> > For any issue with this report, reach out to cedalion@bugs.sh
> >
> > If the report is already addressed, let us know by replying with:
> > #co fix: <commit hash>
> >
> > If the report is a duplicate of another one, reply with:
> > #co dup: <lore link>
> >
> > If you want to undo deduplication, reply with:
> > #co undup
> >
> >
>
> --
> Samuel
> <c> hiri, le cri ici, c des marrants
> <c> j'ai un rep ".uglyhackdirectorywithoutacls" ds mon home
>  -+- #ens-mim en stage -+-
>

Re: [BUG] drivers/tty: NULL pointer dereference in paste_selection()

[Samuel Thibault]

Hello,

Weiming Shi, le sam. 29 août 2026 16:00:32 +0800, a ecrit:
> One correction: this is triggerable without root. I reproduced it on
> Debian 13.6 with espeakup enabled, from a tty1 session with:
> 
>   uid=1000(tester) gid=1000(tester)
>   CapEff: 0000000000000000
> 
> The process called VT_ACTIVATE on its controlling tty, which is allowed
> without CAP_SYS_TTY_CONFIG. Switching to VT8, which had no getty in this
> setup, left vc->port.tty NULL. Pressing the Speakup paste key

Pressing the speakup paste key either requires simulating it as root, or
pressing it physically, who in the speakup security model is rather
trusted.

Samuel