Re: [PATCH] Input: sysrq - reset the per-device key state when reparsing reset_seq

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

On Fri, Oct 16, 2026 at 11:27:32AM +0800, Zhan Xusheng wrote:
> sysrq_parse_reset_sequence() rebuilds a device's view of the reset
> sequence, but only clears reset_seq_cnt.  reset_keybit is only ever
> __set_bit() and reset_seq_len is only ever incremented, and nothing else
> in the file clears either.  The struct sysrq_state holding them is
> allocated once per input device in sysrq_connect() and lives until the
> device goes away, so both accumulate across calls.
> 
> The function is called from sysrq_filter() whenever
> sysrq_reset_seq_version has moved on, which happens when the reset_seq
> module parameter is written.  It is mode 0644, so this is reachable at
> runtime:
> 
>   # echo 56,29,111 > /sys/module/sysrq/parameters/reset_seq
>   # echo 59,60     > /sys/module/sysrq/parameters/reset_seq
> 
> After the second write reset_seq_len is 5 rather than 2, and
> reset_keybit has five keys set rather than two.  The trigger in
> sysrq_detect_reset_sequence() is
> 
> 	if (++state->reset_seq_cnt == state->reset_seq_len &&
> 	    !state->reset_canceled)
> 
> and reset_seq_cnt cannot exceed the number of keys actually in the
> sequence, so holding the whole new sequence no longer resets the machine.
> The stale bits also make keys that were dropped from the sequence still
> test positive, so pressing one takes the increment path instead of
> cancelling, and releasing one decrements reset_seq_cnt, which can take it
> negative.
> 
> The boot path is not affected: both the command line and
> sysrq_of_get_keyreset_config() leave sysrq_reset_seq_version at its
> initial 1, so a freshly kzalloc'd state parses exactly once with both
> fields already zero.
> 
> Clear them along with reset_seq_cnt.
> 
> Note the error direction is towards not resetting, as reset_seq_len only
> grows, so this costs an emergency reset on systems that reconfigure the
> sequence rather than causing an unwanted one.
> 
> Fixes: 154b7a489a5b ("Input: sysrq - allow specifying alternate reset sequence")
> Signed-off-by: Zhan Xusheng <zhanxusheng@xiaomi.com>
> ---
>  drivers/tty/sysrq.c | 2 ++
>  1 file changed, 2 insertions(+)

Why is a tty patch prefix "Input:"?

thanks,

greg k-h