[PATCH v4 0/2] tty: sysrq: fix the reset sequence kept per input device

[Zhan Xusheng]

From: Zhan Xusheng <zhanxusheng@xxxxxxxxxx>

v3 1/2 was wrong and is dropped.  It stopped a truncated parse from being
cached, but the parse still reached sysrq_detect_reset_sequence() in the
same call and could complete a reset.  param_array() publishes every
intermediate sequence with a fresh version, so no reader-side check can
tell them from the final one; 1/2 now parses the whole parameter in one
callback and replaces it under a seqlock.  2/2 is the same fix adapted to
the new 1/2, and depends on it.

Both fix bugs from the same 2013 commit and apply to every stable tree,
but 1/2 is over the 100-line limit in stable-kernel-rules.rst, so I left
the stable tags out.  The two have to go together.

Tested in QEMU with a uinput keyboard, one device per scenario so the
per-device state survives the parameter writes:

                                           before       after
  hold the full sequence                   reboots      reboots
  hold one key of two                      no           no
  hold the old sequence after a rewrite    no           no
  0x3b,0x3c                                reboots      reboots
  hold the new sequence after a rewrite    no           reboots
  release a stale key, then hold the new   no           reboots
  press key 1 while the write is mid-way   reboots      no

The last row needs a 500 ms delay to widen the window, in
sysrq_reset_seq_param_set() before the series and inside the seqlock
section after it.  Without 2/2's timer_delete() the armed reset survives
the replacement and fires.  Rejected input is the same apart from the
two cases listed in 1/2, and reset_seq reads back the same.

Changes in v4:
 - Dropped v3 1/2 and replaced it with the seqlock patch (Sashiko flagged
   the window on v3 1/2).
 - Reject KEY_RESERVED in the parameter instead of storing it.
 - Dropped the stable tags.
 - Tested in QEMU rather than by inspection only.

Changes in v3:
 - Added a first patch so that a truncated parse no longer sticks
   (Sashiko).
 - Added Fixes: to both patches.

Changes in v2:
 - Retitled from "Input:" to "tty: sysrq:" (Greg Kroah-Hartman).
 - Delete keyreset_timer, otherwise an already armed reset survives the
   reparse (Sashiko).

v3: https://lore.kernel.org/all/20261021022007.1717207-1-zhanxusheng1024@xxxxxxxxx/
v2: https://lore.kernel.org/all/20261016070636.2559899-1-zhanxusheng@xxxxxxxxxx/
v1: https://lore.kernel.org/all/20261016032732.2328852-1-zhanxusheng@xxxxxxxxxx/

Zhan Xusheng (2):
  tty: sysrq: don't expose a partially written reset_seq
  tty: sysrq: reset the per-device key state when reparsing reset_seq

 drivers/tty/sysrq.c | 142 +++++++++++++++++++++++++++++++++-----------
 1 file changed, 107 insertions(+), 35 deletions(-)


base-commit: c339f4010dea8b0d754f84ace70cd1b089878ef8
-- 
2.43.0