Re: tty: vt: three wedge paths on 5.15 (paste_selection spin, vcs_open hang, do_update_region spin) - family report + backport request

[Ivan]

Hi,

My 26 October report to this list does not appear to have reached the
public archives (most likely held by moderation), and my 29 October
resend was silently rejected because my mail was wrapped with an HTML
part -- apologies for the noise. Resending as plain text. One new data
point since the original: a fourth wedge path was observed in the
meantime -- INFO: task hung in tty_mode_ioctl with agetty as the
blocked victim -- same cascading pattern as (2).

--- original report ---

Hi,

Three related reproducers on 5.15.216 (KASAN) covering the vt/console
family - one already has a fix upstream (not backported), two look
unreported. Together they make a 3-trigger-path family report:

1) soft lockup in tty_ioctl: tioclinux(TIOCL_PASTESEL) -> paste_selection()
   (drivers/tty/vt/selection.c:374). The throttled-tty loop does a bare
   schedule() without timeout; spurious wakeups spin it -> CPU soft lockup.
   The 2024 "[PATCH v2] tty: vt: selection: fix soft lockup in
   paste_selection()" series addresses exactly this and is NOT in
   5.15.216 -> backport request.

2) task hung in vcs_open (drivers/tty/vt/vc_screen.c:763): takes
   console_lock() and blocks in down() forever if the console semaphore is
   held by a wedged console path -> victims pile up (cascading hang,
   /dev/vcs* readers, printk, VT switch all freeze).

3) NEW: soft lockup in do_update_region (drivers/tty/vt/vt.c:664):
   writev() of binary blobs to /dev/tty1 (embedded VT sequences leave the
   VC in a bad state) -> insert_char -> do_update_region loops, CPU stuck
   22s+. Independent site: neither paste_selection nor console_lock.
   C reproducer available (syzkaller-generated + minimized).

Mechanistic link: one wedged paste_selection/console_lock holder freezes
every console consumer; the do_update_region spin is a third, independent
way to wedge the same console. On shared hosting any tenant with a tty can
trigger these -> cross-tenant DoS.

Patches/repros available on request.

Thanks,
Ivan Vinichuk

Reported-by: Ivan Vinichuk <ivan.vin.ctf@xxxxxxxxx>