[PATCH] Input: sysrq - reset the per-device key state when reparsing reset_seq

[Zhan Xusheng <zhanxusheng1024@gmail.com>]

sysrq_parse_reset_sequence() rebuilds a device's view of the reset
sequence, but only clears reset_seq_cnt.  reset_keybit is only ever
__set_bit() and reset_seq_len is only ever incremented, and nothing else
in the file clears either.  The struct sysrq_state holding them is
allocated once per input device in sysrq_connect() and lives until the
device goes away, so both accumulate across calls.

The function is called from sysrq_filter() whenever
sysrq_reset_seq_version has moved on, which happens when the reset_seq
module parameter is written.  It is mode 0644, so this is reachable at
runtime:

  # echo 56,29,111 > /sys/module/sysrq/parameters/reset_seq
  # echo 59,60     > /sys/module/sysrq/parameters/reset_seq

After the second write reset_seq_len is 5 rather than 2, and
reset_keybit has five keys set rather than two.  The trigger in
sysrq_detect_reset_sequence() is

	if (++state->reset_seq_cnt == state->reset_seq_len &&
	    !state->reset_canceled)

and reset_seq_cnt cannot exceed the number of keys actually in the
sequence, so holding the whole new sequence no longer resets the machine.
The stale bits also make keys that were dropped from the sequence still
test positive, so pressing one takes the increment path instead of
cancelling, and releasing one decrements reset_seq_cnt, which can take it
negative.

The boot path is not affected: both the command line and
sysrq_of_get_keyreset_config() leave sysrq_reset_seq_version at its
initial 1, so a freshly kzalloc'd state parses exactly once with both
fields already zero.

Clear them along with reset_seq_cnt.

Note the error direction is towards not resetting, as reset_seq_len only
grows, so this costs an emergency reset on systems that reconfigure the
sequence rather than causing an unwanted one.

Fixes: 154b7a489a5b ("Input: sysrq - allow specifying alternate reset sequence")
Signed-off-by: Zhan Xusheng <zhanxusheng@xiaomi.com>
---
 drivers/tty/sysrq.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/drivers/tty/sysrq.c b/drivers/tty/sysrq.c
index c2e4b31b699aa..d28a4726b07fc 100644
--- a/drivers/tty/sysrq.c
+++ b/drivers/tty/sysrq.c
@@ -689,6 +689,8 @@ static void sysrq_parse_reset_sequence(struct sysrq_state *state)
 	int i;
 	unsigned short key;
 
+	bitmap_zero(state->reset_keybit, KEY_CNT);
+	state->reset_seq_len = 0;
 	state->reset_seq_cnt = 0;
 
 	for (i = 0; i < sysrq_reset_seq_len; i++) {

base-commit: 2f2f7eeef8b0a1a9b9ca998231419873ccae8d4e
-- 
2.43.0