Soft lockup occurs when vt device used n_null ldisc, n_null_receivebuf() is not implemented in null_ldisc. So tty_ldisc_receive_buf always return 0 in paste_selection(), this cause deadloop and cause soft lockup. This can be reproduced as follows: int ldisc = 0x1b; // 0x1b is n_null struct{ char subcode; struct tiocl_selection sel; } data; date.subcode = TIOCL_SETSEL; data.sel.xs = 0; data.sel.xe = 1; data.sel.ys = 0; data.sel.ye = 1; data.sel.sel_mode = TIOCL_SELCHAR; char bytes[2] = {TIOCL_PASTESEL, 0}; open("ttyxx", O_RDWR) // open a vt device ioctl(fd, TIOCSETD, &ldisc) // set ldisc to n_null ioctl(fd, TIOCLINUX, &data.subcode); ioctl(fd, TIOCLINUX, bytes); // cause deadloop Fix soft lockup by check receive_buf() and receive_buf2() is NULL. Signed-off-by: Yi Yang <yiyang13@xxxxxxxxxx> --- v2:Change Check Condition. drivers/tty/vt/selection.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/tty/vt/selection.c b/drivers/tty/vt/selection.c index 564341f1a74f..715e111376a7 100644 --- a/drivers/tty/vt/selection.c +++ b/drivers/tty/vt/selection.c @@ -397,6 +397,12 @@ int paste_selection(struct tty_struct *tty) ld = tty_ldisc_ref_wait(tty); if (!ld) return -EIO; /* ldisc was hung up */ + + /*tty_ldisc_receive_buf() won't do anything and cause deadloop later*/ + if (!ld->ops->receive_buf && !ld->ops->receive_buf2) { + tty_ldisc_deref(ld); + return -EIO; + } tty_buffer_lock_exclusive(&vc->port); add_wait_queue(&vc->paste_wait, &wait); -- 2.25.1