* [PATCH v3] vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection()
[not found] <aq5hK-fxgPUCe4cr@hovoldconsulting.com>
@ 2026-09-19 11:00 ` Hui Peng
2026-09-19 11:07 ` sashiko-bot
0 siblings, 1 reply; 2+ messages in thread
From: Hui Peng @ 2026-09-19 11:00 UTC (permalink / raw)
To: gregkh, jirislaby, johan; +Cc: linux-serial, linux-kernel
In paste_selection(), the loop copies min_t(unsigned int,
vc_sel.buf_len - pasted,tty->receive_room) bytes per iteration into
tty_ldisc_receive_buf() and increments pasted += count.
Because the selection mutex (vc_sel.lock) is dropped inside the loop
Whenever the line discipline buffer fills up and paste_selection()
sleeps on tty->write_wait, a concurrent TIOCLINUX (TIOCL_SETSEL) ioctl
can replace vc_sel.buffer with a shorter selection and reduce
vc_sel.buf_len below pasted.
When paste_selection() resumes, vc_sel.buf_len - pasted underflows as an
unsigned integer to a large positive value, causing
tty_ldisc_receive_buf(ld, vc_sel.buffer + pasted, NULL, count) to read
up to 4094 bytes out-of-bounds past the newly allocated vc_sel.buffer.
Fix this by terminating the loop when pasted >= vc_sel.buf_len.
Kernel stack trace (Linux 7.3.0-rc3):
==================================================================
BUG: KASAN: slab-out-of-bounds in n_tty_receive_buf_common+0xa01/0x1650
Read of size 4094 at addr ffff888101c58010 by task kworker/u17:1/65
Workqueue: events_unbound flush_to_ldisc
Call Trace:
<TASK>
dump_stack_lvl+0x70/0xa0
print_report+0x153/0x4c6
kasan_report+0xf1/0x120
kasan_check_range+0x11c/0x200
__asan_memcpy+0x29/0x70
n_tty_receive_buf_common+0xa01/0x1650
tty_ldisc_receive_buf+0x66/0x110
tty_port_default_receive_buf+0x6b/0xb0
flush_to_ldisc+0x1b4/0x410
process_one_work+0x6ff/0x1110
worker_thread+0x4a8/0xb70
kthread+0x307/0x3e0
ret_from_fork+0x3ed/0x680
</TASK>
==================================================================
Fixes: e8c75a30a23c ("vt: selection, push sel_lock up")
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>
---
v3: Correct the Fixes: tag. v2 cited 2f89e2299c58, which does not exist
in mainline; the commit that moved the sel_lock acquire/release pair and
created the window where the lock is dropped inside the paste loop is
e8c75a30a23c. Thanks to Johan Hovold for catching this.
Note that git blame on the two lines being changed points at
9256d09f1da1 ("vt: selection, create struct from console selection
globals"), but that commit only renames sel_buffer/sel_buffer_lth to
vc_sel.buffer/vc_sel.buf_len and leaves the locking untouched, so
e8c75a30a23c is the correct tag.
v2: Resend via git send-email with intact tab formatting and the
Assisted-by: LLM tag.
drivers/tty/vt/selection.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/tty/vt/selection.c b/drivers/tty/vt/selection.c
index 13f4e48b4..f1a3bc5b5 100644
--- a/drivers/tty/vt/selection.c
+++ b/drivers/tty/vt/selection.c
@@ -434,8 +434,8 @@ int paste_selection(struct tty_struct *tty)
bps = NULL;
}
- count = vc_sel.buf_len - pasted;
- if (count) {
+ if (vc_sel.buf_len > pasted) {
+ count = vc_sel.buf_len - pasted;
pasted += tty_ldisc_receive_buf(ld, vc_sel.buffer + pasted,
NULL, count);
if (vc_sel.buf_len > pasted)
--
2.55.0.1082.g2b9226bbc0-goog
^ permalink raw reply related [flat|nested] 2+ messages in thread