From e1301ab8a8411fccc7effe0711fc09939a94953c Mon Sep 17 00:00:00 2001 From: Samuel Thibault Date: Sat, 29 Aug 2026 18:49:45 +0200 Subject: [PATCH] speakup: Fix NULL pointer dereference on VT switch + selection When selecting/pasting very quickly after VT switch, the tty is not set yet, leading to a NULL dereference. We can just abort the operation. Reported-by: co+e5693071d903b832@bugs.sh Signed-off-by: Samuel Thibault Cc: stable@kernel.org Tested-by: Weiming Shi Link: https://patch.msgid.link/20260829164945.2691317-3-samuel.thibault@ens-lyon.org Signed-off-by: Greg Kroah-Hartman --- drivers/accessibility/speakup/selection.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/accessibility/speakup/selection.c b/drivers/accessibility/speakup/selection.c index 1713ce4e0ba5..a04a7e8c307b 100644 --- a/drivers/accessibility/speakup/selection.c +++ b/drivers/accessibility/speakup/selection.c @@ -61,6 +61,9 @@ static struct speakup_selection_work speakup_sel_work = { int speakup_set_selection(struct tty_struct *tty) { + if (!tty) + return -ENODEV; + /* we get kref here first in order to avoid a subtle race when * cancelling selection work. getting kref first establishes the * invariant that if speakup_sel_work.tty is not NULL when @@ -120,6 +123,9 @@ static struct speakup_selection_work speakup_paste_work = { int speakup_paste_selection(struct tty_struct *tty) { + if (!tty) + return -ENODEV; + tty_kref_get(tty); if (cmpxchg(&speakup_paste_work.tty, NULL, tty)) { tty_kref_put(tty);