diff options
| author | Samuel Thibault <samuel.thibault@ens-lyon.org> | 2026-08-29 18:49:45 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2026-10-13 16:27:46 +0200 |
| commit | e1301ab8a8411fccc7effe0711fc09939a94953c (patch) | |
| tree | f644d65882fed2143608752bd8a01105cf159a48 /drivers | |
| parent | 6b2175ccecaed99489ce0616115f09215a5c934c (diff) | |
| download | linux-e1301ab8a8411fccc7effe0711fc09939a94953c.tar.gz linux-e1301ab8a8411fccc7effe0711fc09939a94953c.zip | |
speakup: Fix NULL pointer dereference on VT switch + selection
When selecting/pasting very quickly after VT switch, the tty is not set
yet, leading to a NULL dereference. We can just abort the operation.
Reported-by: co+e5693071d903b832@bugs.sh
Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Cc: stable@kernel.org
Tested-by: Weiming Shi <bestswngs@gmail.com>
Link: https://patch.msgid.link/20260829164945.2691317-3-samuel.thibault@ens-lyon.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/accessibility/speakup/selection.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/drivers/accessibility/speakup/selection.c b/drivers/accessibility/speakup/selection.c index 1713ce4e0ba5..a04a7e8c307b 100644 --- a/drivers/accessibility/speakup/selection.c +++ b/drivers/accessibility/speakup/selection.c @@ -61,6 +61,9 @@ static struct speakup_selection_work speakup_sel_work = { int speakup_set_selection(struct tty_struct *tty) { + if (!tty) + return -ENODEV; + /* we get kref here first in order to avoid a subtle race when * cancelling selection work. getting kref first establishes the * invariant that if speakup_sel_work.tty is not NULL when @@ -120,6 +123,9 @@ static struct speakup_selection_work speakup_paste_work = { int speakup_paste_selection(struct tty_struct *tty) { + if (!tty) + return -ENODEV; + tty_kref_get(tty); if (cmpxchg(&speakup_paste_work.tty, NULL, tty)) { tty_kref_put(tty); |