tty: vt: three wedge paths on 5.15 (paste_selection spin, vcs_open hang, do_update_region spin) - family report + backport request

[Ivan]

Hi,

Three related reproducers on 5.15.216 (KASAN) covering the vt/console
family - one already has a fix upstream (not backported), two look
unreported. Together they make a 3-trigger-path family report:

1) soft lockup in tty_ioctl: tioclinux(TIOCL_PASTESEL) -> paste_selection()
   (drivers/tty/vt/selection.c:374). The throttled-tty loop does a bare
   schedule() without timeout; spurious wakeups spin it -> CPU soft lockup.
   The 2024 "[PATCH v2] tty: vt: selection: fix soft lockup in
   paste_selection()" series addresses exactly this and is NOT in
   5.15.216 -> backport request.

2) task hung in vcs_open (drivers/tty/vt/vc_screen.c:763): takes
   console_lock() and blocks in down() forever if the console semaphore is
   held by a wedged console path -> victims pile up (cascading hang,
   /dev/vcs* readers, printk, VT switch all freeze).

3) NEW: soft lockup in do_update_region (drivers/tty/vt/vt.c:664):
   writev() of binary blobs to /dev/tty1 (embedded VT sequences leave the
   VC in a bad state) -> insert_char -> do_update_region loops, CPU stuck
   22s+. Independent site: neither paste_selection nor console_lock.
   C reproducer available (syzkaller-generated + minimized).

Mechanistic link: one wedged paste_selection/console_lock holder freezes
every console consumer; the do_update_region spin is a third, independent
way to wedge the same console. On shared hosting any tenant with a tty can
trigger these -> cross-tenant DoS.

Patches/repros available on request; happy to test any fix on our fleet.

Thanks,
Ivan Vinichuk

Reported-by: Ivan Vinichuk <ivan.vin.ctf@xxxxxxxxx>