Re: [PATCH v3] vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection()

[sashiko-bot@kernel.org]

> In paste_selection(), the loop copies min_t(unsigned int,
> vc_sel.buf_len - pasted,tty->receive_room) bytes per iteration into
> tty_ldisc_receive_buf() and increments pasted += count.
> 
> Because the selection mutex (vc_sel.lock) is dropped inside the loop
> Whenever the line discipline buffer fills up and paste_selection()
> sleeps on tty->write_wait, a concurrent TIOCLINUX (TIOCL_SETSEL) ioctl
> can replace vc_sel.buffer with a shorter selection and reduce
> vc_sel.buf_len below pasted.
> 
> When paste_selection() resumes, vc_sel.buf_len - pasted underflows as an
> unsigned integer to a large positive value, causing
> tty_ldisc_receive_buf(ld, vc_sel.buffer + pasted, NULL, count) to read
> up to 4094 bytes out-of-bounds past the newly allocated vc_sel.buffer.
> 
> [ ... ]
>  ==================================================================
> 
> Fixes: e8c75a30a23c ("vt: selection, push sel_lock up")
> Assisted-by: LLM
> Signed-off-by: Hui Peng <benquike@gmail.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260919110041.3763078-1-benquike@gmail.com?part=1