On Wed, Mar 13, 2024 at 09:45:29AM +0000, Yi Yang wrote: > Soft lockup occurs when vt device used n_null ldisc, n_null_receivebuf() > is not implemented in null_ldisc. So tty_ldisc_receive_buf always return > 0 in paste_selection(), this cause deadloop and cause soft lockup. Why is a vt using n_null? What is causing that? > > This can be reproduced as follows: > int ldisc = 0x1b; // 0x1b is n_null > struct{ > char subcode; > struct tiocl_selection sel; > } data; > date.subcode = TIOCL_SETSEL; > data.sel.xs = 0; > data.sel.xe = 1; > data.sel.ys = 0; > data.sel.ye = 1; > data.sel.sel_mode = TIOCL_SELCHAR; > char bytes[2] = {TIOCL_PASTESEL, 0}; > open("ttyxx", O_RDWR) // open a vt device > ioctl(fd, TIOCSETD, &ldisc) // set ldisc to n_null > ioctl(fd, TIOCLINUX, &data.subcode); > ioctl(fd, TIOCLINUX, bytes); // cause deadloop > > Fix soft lockup by check receive_buf() and receive_buf2() is NULL. As you had permissions to do this, why prevent it? > > Signed-off-by: Yi Yang <yiyang13@xxxxxxxxxx> > --- > > v2:Change Check Condition. > > drivers/tty/vt/selection.c | 6 ++++++ > 1 file changed, 6 insertions(+) > > diff --git a/drivers/tty/vt/selection.c b/drivers/tty/vt/selection.c > index 564341f1a74f..715e111376a7 100644 > --- a/drivers/tty/vt/selection.c > +++ b/drivers/tty/vt/selection.c > @@ -397,6 +397,12 @@ int paste_selection(struct tty_struct *tty) > ld = tty_ldisc_ref_wait(tty); > if (!ld) > return -EIO; /* ldisc was hung up */ > + > + /*tty_ldisc_receive_buf() won't do anything and cause deadloop later*/ Comments need to be properly formated. And I do not understand this comment sorry. > + if (!ld->ops->receive_buf && !ld->ops->receive_buf2) { Why check reciev_buf pointers here? What is that causing? This needs to be documented a lot better please. thanks, greg k-h