From nobody Thu Sep 24 17:02:54 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B4A9D376BC1; Tue, 22 Sep 2026 01:28:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790040499; cv=none; b=gU3ou+bn2QHEzCQkyJQ70x1kzfylhRl/g16b09FFUSuJvSSRXdTc5SwqCwhf69uDMpVD18oWKcp5UQVUbhv1GGKcYgqUvzOd61izfxumuGH6JOrZyK3FXoZ0OwqUH07ydduSSAOCrdgNLqyjfeaxa6gfWiROHmky6LbUnPjv2Mw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790040499; c=relaxed/simple; bh=ppAigkjatF9Z22OzgFgBPTCvL1UwNCJh+kedCBmVN3c=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=OHlsugF5FVR0i3Z048/vNzU5dvyp6gx6RGLplw4kbz/WvamQzuSYgeob2j4/61XTbAbeOIVQezsZE8xgW5VknthLjjYh0v1pCWA/S9jxFP+xWTnw6eO9UBbt9M1bLqibUZKfmBEqFQ+HtlpFCkYmT7TuMXkG0mBpfY+dNLizMl0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=coawoRHM; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="coawoRHM" Received: by smtp.kernel.org (Postfix) with ESMTPS id 75EF4C2BCFC; Tue, 22 Sep 2026 01:28:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1790040499; bh=ppAigkjatF9Z22OzgFgBPTCvL1UwNCJh+kedCBmVN3c=; h=From:Date:Subject:References:In-Reply-To:To:Cc:Reply-To:From; b=coawoRHMd1OwAl9lhdfCbZKO1f0Sk7AWLgF878IfAbc7s4WLnosiJrTpQdxtMRJjE Bzvm8NdCjWsBwIDxYf9/hXchbP6FKPD3NiQxp/zu+dNl5NM5kYVtzOE6yijUqmQOqH 0MG/b4bcGe3f42DhX72ANgvySeNd8ivUV6Z9nOJSp9mMJ1zjhtqRJS+HWY9Is/PGWK yX6e7om+PKRKWUD3DK5/qG4J7GgZHRWQSzJMVyXKSUbL7lYYWQFt9rSACRhCvnPqDv fi5tbDYgVBR78Yw0m6Xi4ZxdYHwiQHJEQD3Z1Sdc5utiwizsd2pqjyp2IGGU2ZhobS lqDWNEekKWNLQ== Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5E1AAC982FF; Tue, 22 Sep 2026 01:28:19 +0000 (UTC) From: Jaidev Shastri via B4 Relay Date: Mon, 21 Sep 2026 21:28:14 -0400 Subject: [PATCH 1/6] vt: keyboard: publish shift_state with release semantics Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260921-mb-keyboard-v1-1-d170228b80c0@vt.edu> References: <20260921-mb-keyboard-v1-0-d170228b80c0@vt.edu> In-Reply-To: <20260921-mb-keyboard-v1-0-d170228b80c0@vt.edu> To: Greg Kroah-Hartman , Jiri Slaby Cc: linux-kernel@vger.kernel.org, linux-serial@vger.kernel.org, Jaidev Shastri X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=ed25519-sha256; t=1790040498; l=1864; i=jaidevshastri@vt.edu; s=20260921; h=from:subject:message-id; bh=DZORQFC62iK2iCZRnS/XkfCIg2hwFuw7UKYfnaQuUPU=; b=UPuc8ERycqOPiQnTgiSO+VF/BAaQwbTGdO2XpaeEJXPgAq6q81guYo1In6Qq9UMuTmzdgh+S4 Lfm5Rt6i8lqDtWYfJUboPxbNdQPelQ5+vm/YJGZoqCYAZzQ/2tlA2bJ X-Developer-Key: i=jaidevshastri@vt.edu; a=ed25519; pk=J7+xYJRlTPds+pv5hbqFFRqGCpDeJDzmZT1ggRwj7/0= X-Endpoint-Received: by B4 Relay for jaidevshastri@vt.edu/20260921 with auth_id=1044 X-Original-From: Jaidev Shastri Reply-To: jaidevshastri@vt.edu From: Jaidev Shastri k_shift() updates shift_down[] and then shift_state under kbd_event_lock. vt_get_shift_state() reads shift_state without the lock for TIOCL_GETSHIFTSTATE, so the plain accesses leave the relation between the counters and the summary word unspecified. Store shift_state with smp_store_release() and read it with smp_load_acquire(). Found with MBCheck, a static herd7-based memory consistency checker. Signed-off-by: Jaidev Shastri --- drivers/tty/vt/keyboard.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c index c41d850b2..089f3b048 100644 --- a/drivers/tty/vt/keyboard.c +++ b/drivers/tty/vt/keyboard.c @@ -865,6 +865,7 @@ static void k_pad(struct vc_data *vc, unsigned char val= ue, char up_flag) static void k_shift(struct vc_data *vc, unsigned char value, char up_flag) { int old_state =3D shift_state; + int state; =20 if (rep) return; @@ -889,9 +890,11 @@ static void k_shift(struct vc_data *vc, unsigned char = value, char up_flag) shift_down[value]++; =20 if (shift_down[value]) - shift_state |=3D BIT(value); + state =3D shift_state | BIT(value); else - shift_state &=3D ~BIT(value); + state =3D shift_state & ~BIT(value); + /* Pairs with the smp_load_acquire() in vt_get_shift_state(). */ + smp_store_release(&shift_state, state); =20 /* kludge */ if (up_flag && shift_state !=3D old_state && npadch_active) { @@ -2212,8 +2215,11 @@ void vt_reset_unicode(unsigned int console) */ int vt_get_shift_state(void) { - /* Don't lock as this is a transient report */ - return shift_state; + /* + * Don't lock as this is a transient report. Pairs with the + * smp_store_release() in k_shift(). + */ + return smp_load_acquire(&shift_state); } =20 /** --=20 2.43.0 From nobody Thu Sep 24 17:02:54 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B49D0374745; Tue, 22 Sep 2026 01:28:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790040499; cv=none; b=Rdja2h76P4M3wjOflDPgwiPcVjCN2YLmVRPpbWGGr4Q3Heih2xyAtoRnBZHNiflL4VTehnslmmelUPH50ggn1GQT5Tad8Gg6SdqDFzzXyO+3NV8jh2NZUQLyCBm+Vw5ud9Oqb1/8jw1wVn8bCPKayKRmpZqAwhHM7mMWbCrcLGw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790040499; c=relaxed/simple; bh=fmZQKb1CLTlUV+ISJn/sBAq7bdq2mDqISoqzcVqgGcs=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=HHBY14j9VoUwqrIFfKDYFvoAsgcPID0eSqxr4af1+OQahaL1WiBFBWZ/0TxDUVTmtuWtS2SeoL/4lzczSbepCDmY8vcvhd4Hc+J1fU/1/rHmfyBtA3HlFChq80Y+46iOBSLXSIco3qeNJKwJRhylIhUOipiE8d/vs2KmMoNWcYc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=CZWJHFtA; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="CZWJHFtA" Received: by smtp.kernel.org (Postfix) with ESMTPS id 84A98C2BCF6; Tue, 22 Sep 2026 01:28:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1790040499; bh=fmZQKb1CLTlUV+ISJn/sBAq7bdq2mDqISoqzcVqgGcs=; h=From:Date:Subject:References:In-Reply-To:To:Cc:Reply-To:From; b=CZWJHFtA9ev5su5mYD3K3f8Jxkq3ppfGQ/48G3cvp1geZ8d/Uje9TS8t1MDYPlC1G YwBz9BIVHo1aR/vs9Wq5b919Oevs9o+ATsVXHze6d3TOunGrd+crw8BJtxMoYnxx1T SlZlApcH/xp/Kat87TorWAg0loasek/XZN1DxtQKjJ+/IvI9FkyudFtV0kyxXHmqkb H/wbmpSXQYEypscud1787jTXRFEcQ8bgXe4U9m8W5N4PIPwDkxPRNlGJ7YXZcnFjsV G7QdESG31Cde1UWuzA30MFSqwaUMbMCpAnshgVLRWCaMLC56v8jKjLvwl1UOtO0zDR osY8SRbtTwRPg== Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6B236C98304; Tue, 22 Sep 2026 01:28:19 +0000 (UTC) From: Jaidev Shastri via B4 Relay Date: Mon, 21 Sep 2026 21:28:15 -0400 Subject: [PATCH 2/6] vt: keyboard: publish npadch_value with release semantics Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260921-mb-keyboard-v1-2-d170228b80c0@vt.edu> References: <20260921-mb-keyboard-v1-0-d170228b80c0@vt.edu> In-Reply-To: <20260921-mb-keyboard-v1-0-d170228b80c0@vt.edu> To: Greg Kroah-Hartman , Jiri Slaby Cc: linux-kernel@vger.kernel.org, linux-serial@vger.kernel.org, Jaidev Shastri X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=ed25519-sha256; t=1790040498; l=1592; i=jaidevshastri@vt.edu; s=20260921; h=from:subject:message-id; bh=fmmEErRcPyO4zz0N6xCFkyoCjOBlv003JbWU2K7PoDE=; b=8byxCaFtSMphNyhtVoZMMVV38Hep9HPKKIzRXsDbE0X/YH1E+1pphIikQuhQvcNJ8X9VZ310/ pAThflcBo8zBTG2Hk64zw6dFBo3vZP4WY7+LlNVTQ8eAZlA0IfwXr9M X-Developer-Key: i=jaidevshastri@vt.edu; a=ed25519; pk=J7+xYJRlTPds+pv5hbqFFRqGCpDeJDzmZT1ggRwj7/0= X-Endpoint-Received: by B4 Relay for jaidevshastri@vt.edu/20260921 with auth_id=1044 X-Original-From: Jaidev Shastri Reply-To: jaidevshastri@vt.edu From: Jaidev Shastri k_ascii() accumulates the numeric keypad code in npadch_value after it has set npadch_active. k_shift() tests npadch_active and then emits npadch_value when the modifier is released. Store the accumulated value with smp_store_release() and read it with smp_load_acquire(). Found with MBCheck, a static herd7-based memory consistency checker. Signed-off-by: Jaidev Shastri --- drivers/tty/vt/keyboard.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c index 089f3b048..6f3472cd4 100644 --- a/drivers/tty/vt/keyboard.c +++ b/drivers/tty/vt/keyboard.c @@ -898,10 +898,13 @@ static void k_shift(struct vc_data *vc, unsigned char= value, char up_flag) =20 /* kludge */ if (up_flag && shift_state !=3D old_state && npadch_active) { + /* Pairs with the smp_store_release() in k_ascii(). */ + unsigned int npadch =3D smp_load_acquire(&npadch_value); + if (kbd->kbdmode =3D=3D VC_UNICODE) - to_utf8(vc, npadch_value); + to_utf8(vc, npadch); else - put_queue(vc, npadch_value & 0xff); + put_queue(vc, npadch & 0xff); npadch_active =3D false; } } @@ -939,7 +942,8 @@ static void k_ascii(struct vc_data *vc, unsigned char v= alue, char up_flag) npadch_active =3D true; } =20 - npadch_value =3D npadch_value * base + value; + /* Pairs with the smp_load_acquire() in k_shift(). */ + smp_store_release(&npadch_value, npadch_value * base + value); } =20 static void k_lock(struct vc_data *vc, unsigned char value, char up_flag) --=20 2.43.0 From nobody Thu Sep 24 17:02:54 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B90DF376BD7; Tue, 22 Sep 2026 01:28:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790040499; cv=none; b=UAbG5E2tRXLX9zr0QgCzzzHB0gkAuyLwXqUxacwHDgCdN6YRsegdwIZD3kvJX4CfGL/D71kDpKrYwAQt3fMWApA0BzuI/2MEAG0LN+zfcYp1LWe6V6CkbmZUqgerNYHLVZOhRbpNVa6LuL+GEAAa307BkcA1DYZmthTOFF6n97E= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790040499; c=relaxed/simple; bh=GyybeRC15agMtDiYIn4jTELsR928b09LKcug1Vvtd7M=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=cI6V7QPFx5xcmZcE3Ffe/Q/v32HuTsjEgYcI7Q49KvAl9xzOSCRZM3tsNDEiXDOQySH1tg4u0xUieUhBjfevD+ze2sWcccRmqb0WEGQg562ceG8sDJM/KSWvQX5k5MF4qihk/ynRtEGkjOBnNnh1J91QOHinXUWw7m8dVQ3JW84= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=GNvCTzYw; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="GNvCTzYw" Received: by smtp.kernel.org (Postfix) with ESMTPS id 921E4C2BD00; Tue, 22 Sep 2026 01:28:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1790040499; bh=GyybeRC15agMtDiYIn4jTELsR928b09LKcug1Vvtd7M=; h=From:Date:Subject:References:In-Reply-To:To:Cc:Reply-To:From; b=GNvCTzYwgep0pvQxyu0lYXChC2lPB1tqmB4Doql62sSk7Pkde5+u1roPy1td5Cnxv sozFnqDkgqudtoSLRwxZZ53HyUbk3ZU1y6Y+acJLHpRQM9xMWkUQf3S30Nc7tm9lL4 EPJwQpqVei8x9npH50RbnF+kMZgJHISBbIEjCh043uVkI8kF1nE2wRhuPYkkz/WCIM sCfqlmJNEylDuxvH/ZBBSn0hVT+tm+I2ZLeFoVu7L+9y+6MuM9q+WmsvOSAodzV/XT 8p8PUl4CqHPth3mSKIUw1oDR/tQr17OG/QMYJEZ0kvxnM52dwduzc+w7uRwehZFlYh VwRdn7G06yBnw== Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7ABD0C98306; Tue, 22 Sep 2026 01:28:19 +0000 (UTC) From: Jaidev Shastri via B4 Relay Date: Mon, 21 Sep 2026 21:28:16 -0400 Subject: [PATCH 3/6] vt: keyboard: publish dead_key_next with release semantics Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260921-mb-keyboard-v1-3-d170228b80c0@vt.edu> References: <20260921-mb-keyboard-v1-0-d170228b80c0@vt.edu> In-Reply-To: <20260921-mb-keyboard-v1-0-d170228b80c0@vt.edu> To: Greg Kroah-Hartman , Jiri Slaby Cc: linux-kernel@vger.kernel.org, linux-serial@vger.kernel.org, Jaidev Shastri X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=ed25519-sha256; t=1790040498; l=1229; i=jaidevshastri@vt.edu; s=20260921; h=from:subject:message-id; bh=Zt+gxI5ocGWwJ74nIWECJ+/LdypxLyX9sdrY+y+9ulM=; b=9M/duHJeMb15eWfiTq1xttTPwr5lz2qfehv4hzEQucqHB0Cihsliy9ePf4U0cMqNni3EhBjB2 UMIETRRa7wDAReKXSs1pA1WWlC6rrAmlc7l1rTjPYb4qjBn96OupyD/ X-Developer-Key: i=jaidevshastri@vt.edu; a=ed25519; pk=J7+xYJRlTPds+pv5hbqFFRqGCpDeJDzmZT1ggRwj7/0= X-Endpoint-Received: by B4 Relay for jaidevshastri@vt.edu/20260921 with auth_id=1044 X-Original-From: Jaidev Shastri Reply-To: jaidevshastri@vt.edu From: Jaidev Shastri fn_compose() arms the dead-key state in dead_key_next and k_unicode() consumes it together with diacr. Store the flag with smp_store_release() and read it with smp_load_acquire(). Found with MBCheck, a static herd7-based memory consistency checker. Signed-off-by: Jaidev Shastri --- drivers/tty/vt/keyboard.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c index 6f3472cd4..d7db5e226 100644 --- a/drivers/tty/vt/keyboard.c +++ b/drivers/tty/vt/keyboard.c @@ -618,7 +618,8 @@ static void fn_boot_it(struct vc_data *vc) =20 static void fn_compose(struct vc_data *vc) { - dead_key_next =3D true; + /* Pairs with the smp_load_acquire() in k_unicode(). */ + smp_store_release(&dead_key_next, true); } =20 static void fn_spawn_con(struct vc_data *vc) @@ -672,7 +673,8 @@ static void k_unicode(struct vc_data *vc, unsigned int = value, char up_flag) if (diacr) value =3D handle_diacr(vc, value); =20 - if (dead_key_next) { + /* Pairs with the smp_store_release() in fn_compose(). */ + if (smp_load_acquire(&dead_key_next)) { dead_key_next =3D false; diacr =3D value; return; --=20 2.43.0 From nobody Thu Sep 24 17:02:54 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C667B3749EA; Tue, 22 Sep 2026 01:28:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790040499; cv=none; b=figHa9HrO1jDvaTCUquuzpIp41TEc4BwQWRvkYCYLiq40IpSMJX/7d2oZeCDUdVQ6gE8fqZtc0+VvMfykthIK39xfBMkwb9+Rs42kCM89qreBx6c/qgabasdlTD5O9Ut0DXHwUzIpmVIzEMDj7iwajJGs6YmMKCz/L6WAt72XoQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790040499; c=relaxed/simple; bh=KVxIJYlmJlDAc+ya767V3Xib1Of5jx9U9dnR/a7E5tI=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=myCY6DAmf5zN6yspjK4BEJv3kULYe/c6tkftQCUAiU3rbNc6wpRbQvFlrfiooZrelqMq2GCMSHyNIMLquLZjrUeXd2KUUXCGKZVwe6BjNg6AVqyzetiYFIC2I40HNHng//zDgtzpmRhMgCAFgoC8OEXgmMLzRiN3aAisBOZoG+c= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=ggL0nChS; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="ggL0nChS" Received: by smtp.kernel.org (Postfix) with ESMTPS id 9EEE2C2BCFD; Tue, 22 Sep 2026 01:28:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1790040499; bh=KVxIJYlmJlDAc+ya767V3Xib1Of5jx9U9dnR/a7E5tI=; h=From:Date:Subject:References:In-Reply-To:To:Cc:Reply-To:From; b=ggL0nChSYmkp9fObZuCiHhrAeHQWO4XdntT0rH9gZsX6nGf1Ph4+1eMnmm1/RThr9 ow4DewBOe3eqr2GNAobqIk9HDthoCyfL+Svrtu+QPSzalgXtEnfw6tTGzWdFNgy0ri wUG75bt/3CMIRL35Ke+bR5Fy2VQCIaBwxYBVy6ZqpthIxa77RjsoLbkag9MxKSb+62 DkRSxJ/d1wrw9KNFZeUUq80ClVzEQoZyHvZjBcQbqyy3Px58eNMuW34/BABHpwN/TW O9PMzLiG9TEX5WahkAhX77YGuGcYuLyYWOUGpALFeDQMoAu5ZtS9UZdMvvIVe8Bipl nTHpwjfawsiTQ== Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8B9C3C982FF; Tue, 22 Sep 2026 01:28:19 +0000 (UTC) From: Jaidev Shastri via B4 Relay Date: Mon, 21 Sep 2026 21:28:17 -0400 Subject: [PATCH 4/6] vt: keyboard: publish accent_table_size with release semantics Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260921-mb-keyboard-v1-4-d170228b80c0@vt.edu> References: <20260921-mb-keyboard-v1-0-d170228b80c0@vt.edu> In-Reply-To: <20260921-mb-keyboard-v1-0-d170228b80c0@vt.edu> To: Greg Kroah-Hartman , Jiri Slaby Cc: linux-kernel@vger.kernel.org, linux-serial@vger.kernel.org, Jaidev Shastri X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=ed25519-sha256; t=1790040498; l=2353; i=jaidevshastri@vt.edu; s=20260921; h=from:subject:message-id; bh=jz9QWlgrM+e1IW3NtV23bxopg3rGmXRUjZjy2ORNDuo=; b=le4HBu17HaqoaiMIqaNTFlApg4kB1bR6lXBDVopy5d634aWIdAExWTKCWz3j3kAUVaRUlNyEq G+ESWeqdl7MCOw13YwOJ1dQEMe8cQI+UzyjAzEUhbq5I452VVS6xLdh X-Developer-Key: i=jaidevshastri@vt.edu; a=ed25519; pk=J7+xYJRlTPds+pv5hbqFFRqGCpDeJDzmZT1ggRwj7/0= X-Endpoint-Received: by B4 Relay for jaidevshastri@vt.edu/20260921 with auth_id=1044 X-Original-From: Jaidev Shastri Reply-To: jaidevshastri@vt.edu From: Jaidev Shastri vt_do_kdskbdiacr() and vt_do_kdskbdiacruc() rewrite accent_table[] and accent_table_size. handle_diacr() reads the size and then walks the table. vt_do_kdskbdiacr() sets the size before it converts the entries, so the size covers entries that have not been written yet. Set it after the loop in both paths and publish it with smp_store_release(); read it once with smp_load_acquire() before the walk. Found with MBCheck, a static herd7-based memory consistency checker. Signed-off-by: Jaidev Shastri --- drivers/tty/vt/keyboard.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c index d7db5e226..c2fd92e2b 100644 --- a/drivers/tty/vt/keyboard.c +++ b/drivers/tty/vt/keyboard.c @@ -447,7 +447,7 @@ void vt_set_leds_compute_shiftstate(void) static unsigned int handle_diacr(struct vc_data *vc, unsigned int ch) { unsigned int d =3D diacr; - unsigned int i; + unsigned int i, n; =20 diacr =3D 0; =20 @@ -455,7 +455,9 @@ static unsigned int handle_diacr(struct vc_data *vc, un= signed int ch) if ((ch & ~0xff) =3D=3D BRL_UC_ROW) return d | ch; } else { - for (i =3D 0; i < accent_table_size; i++) + /* Pairs with the smp_store_release() in vt_do_diacrit(). */ + n =3D smp_load_acquire(&accent_table_size); + for (i =3D 0; i < n; i++) if (accent_table[i].diacr =3D=3D d && accent_table[i].base =3D=3D ch) return accent_table[i].result; } @@ -1810,7 +1812,6 @@ static int vt_do_kdskbdiacr(void __user *udp, int per= m) } =20 guard(spinlock_irqsave)(&kbd_event_lock); - accent_table_size =3D ct; for (i =3D 0; i < ct; i++) { accent_table[i].diacr =3D conv_8bit_to_uni(dia[i].diacr); @@ -1819,6 +1820,8 @@ static int vt_do_kdskbdiacr(void __user *udp, int per= m) accent_table[i].result =3D conv_8bit_to_uni(dia[i].result); } + /* Pairs with the smp_load_acquire() in handle_diacr(). */ + smp_store_release(&accent_table_size, ct); =20 return 0; } @@ -1848,7 +1851,8 @@ static int vt_do_kdskbdiacruc(void __user *udp, int p= erm) if (ct) memcpy(accent_table, buf, ct * sizeof(struct kbdiacruc)); - accent_table_size =3D ct; + /* Pairs with the smp_load_acquire() in handle_diacr(). */ + smp_store_release(&accent_table_size, ct); return 0; } =20 --=20 2.43.0 From nobody Thu Sep 24 17:02:54 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E561E377AA3; Tue, 22 Sep 2026 01:28:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790040500; cv=none; b=tVFN5X7yUA5LlHpRUZO7CGar5ajJR2Vn/kw/SRVG3mdWFXAT7CSw7OOEr+cr+ylC9AEroacuh0d8eEdIMiCJjc/5NJgLRZZmPIzWo3kRGH3u1AjpPWHHIdLKyYA21Z+71zqTVypcUkmzigdVFkKG2sylBeH9l7AS45Cszhebqv0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790040500; c=relaxed/simple; bh=fGbyRoiQA+YKrlUzwLgdZZGqfMjdbaJkZeiXHveswLI=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=PaThedaH8shBK4k6i4yGCEJzYtq4uPIr/zdCC+laN79mS4YuktlUXyiLNEIreBURwiEYSjDXD18kLlkX1Vpy8hyGTu44UWtBeo3Y7kVAhVoY6gA9OLoKZMKc3KfMrCK0r6g+J6T067G8MSn7i0swd4QSZw5wCTp0SNIqXmvZnK8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=V7WS1uFf; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="V7WS1uFf" Received: by smtp.kernel.org (Postfix) with ESMTPS id AAB62C2BCB3; Tue, 22 Sep 2026 01:28:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1790040499; bh=fGbyRoiQA+YKrlUzwLgdZZGqfMjdbaJkZeiXHveswLI=; h=From:Date:Subject:References:In-Reply-To:To:Cc:Reply-To:From; b=V7WS1uFfK7ruVNa3+CsK7gpeqcl9xnL6w8vcHxY88XuP0moZgGXfgJS5r9Vav9BQy 9erkWLnX0PcEEMMixJmGm4uysVezwXzas3xFTlmNngJ0bGn658T6UCw7WghrQNhmlT McNDNB1itUmzE3DQ1JjmycJ6FsIDClg4mpkUVNyyIwguk3X+qzhta6vLKio8juzQIK ipokRfMqKlf+8wMAXwuNCtLDis1gpiBGLiqhbaT0p2F4vMb0d2Ts+1L8tVkx2Y5c/M TmaoS+WbzgxTyiN3r9QwKYW2dCTrj8/7GbWy2Rk7AXfmhCWLtfEqWULbkB0PFH6Rn9 A4Oam1CL9UULQ== Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9BCFBC98302; Tue, 22 Sep 2026 01:28:19 +0000 (UTC) From: Jaidev Shastri via B4 Relay Date: Mon, 21 Sep 2026 21:28:18 -0400 Subject: [PATCH 5/6] vt: keyboard: recompute the shift state into locals before publishing it Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260921-mb-keyboard-v1-5-d170228b80c0@vt.edu> References: <20260921-mb-keyboard-v1-0-d170228b80c0@vt.edu> In-Reply-To: <20260921-mb-keyboard-v1-0-d170228b80c0@vt.edu> To: Greg Kroah-Hartman , Jiri Slaby Cc: linux-kernel@vger.kernel.org, linux-serial@vger.kernel.org, Jaidev Shastri X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=ed25519-sha256; t=1790040498; l=1670; i=jaidevshastri@vt.edu; s=20260921; h=from:subject:message-id; bh=Pcy9gXCqUcOIXjrml7UXFL+N6Nxn53Hov/Dv8U22J58=; b=/S5sFva/qHPrN7SkZipZS8wgJoIDFwKtAIrLhgQAV0p9/Gtkd2AibWMh0YcCmzStXavDablxR 1ml1JWaxjzyDDA7cTOBcOPf/20vP8sN4/D6Xv9VHsfNULO8pSLdOFlW X-Developer-Key: i=jaidevshastri@vt.edu; a=ed25519; pk=J7+xYJRlTPds+pv5hbqFFRqGCpDeJDzmZT1ggRwj7/0= X-Endpoint-Received: by B4 Relay for jaidevshastri@vt.edu/20260921 with auth_id=1044 X-Original-From: Jaidev Shastri Reply-To: jaidevshastri@vt.edu From: Jaidev Shastri do_compute_shiftstate() clears shift_state and shift_down[] and rebuilds them in place while it iterates key_down[]. vt_get_shift_state() reads shift_state without kbd_event_lock and can observe the cleared or partially rebuilt value. Compute the new state into locals, copy shift_down[] first and publish shift_state last with smp_store_release(). Found with MBCheck, a static herd7-based memory consistency checker. Signed-off-by: Jaidev Shastri --- drivers/tty/vt/keyboard.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c index c2fd92e2b..87970415a 100644 --- a/drivers/tty/vt/keyboard.c +++ b/drivers/tty/vt/keyboard.c @@ -403,10 +403,9 @@ static void set_leds(void) =20 static void do_compute_shiftstate(void) { + unsigned char down[NR_SHIFT] =3D { 0 }; unsigned int k, sym, val; - - shift_state =3D 0; - memset(shift_down, 0, sizeof(shift_down)); + int state =3D 0; =20 for_each_set_bit(k, key_down, min(NR_KEYS, KEY_CNT)) { sym =3D U(key_maps[0][k]); @@ -417,9 +416,17 @@ static void do_compute_shiftstate(void) if (val =3D=3D KVAL(K_CAPSSHIFT)) val =3D KVAL(K_SHIFT); =20 - shift_down[val]++; - shift_state |=3D BIT(val); + down[val]++; + state |=3D BIT(val); } + + memcpy(shift_down, down, sizeof(shift_down)); + /* + * Publish the recomputed state in one step. vt_get_shift_state() + * reads shift_state without kbd_event_lock; pairs with its + * smp_load_acquire(). + */ + smp_store_release(&shift_state, state); } =20 /* We still have to export this method to vt.c */ --=20 2.43.0 From nobody Thu Sep 24 17:02:54 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E5BFD377AA7; Tue, 22 Sep 2026 01:28:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790040500; cv=none; b=sPbS9w9LdaFMihHaXkAPE+PZ7p4PJnDytPxabhiAO9E9n0SBxNyTepMNPKyiGg2ktmQwYFWlFnAFEFxC1+Dgxf83RO1AWFPf9fUwTdviJT68VGwgvfxCE1zWF2C9n6dcNWboWkcupm2h7RniMFwDAbdSigV9g15kOTM2wHlh3NI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790040500; c=relaxed/simple; bh=IDTPd/U2oV0Vo+v46Xy2gTCYZA3biDjLara5HxCRNu4=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:References: In-Reply-To:To:Cc; b=iGvBQpWrTvPDBrCCjJq0yV9S1SwTmAGYromELCMBdOPteo+YsUnowG0XQrLsBypxDPIi/xGi9xaxwuCJskfNTS2A81Ip7PvGRh/pdLkWAHlDXPxF5zW1YADCcrhGXtucyn7Otvx+CycQIh4r8rVd1fe4i1TawWOfDdsfM2DDOqo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=PBUYp/S9; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="PBUYp/S9" Received: by smtp.kernel.org (Postfix) with ESMTPS id B9655C2BCF7; Tue, 22 Sep 2026 01:28:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1790040499; bh=IDTPd/U2oV0Vo+v46Xy2gTCYZA3biDjLara5HxCRNu4=; h=From:Date:Subject:References:In-Reply-To:To:Cc:Reply-To:From; b=PBUYp/S9bdxZuBni4H0O4UMekMbP5mMBlN0HlRGkw0Oh2xMfBjDGBxCbz+ZKS+/9T WZSAGwdyRtugcB8GDnAIgre9Ft/BMHL4ZUy2za4co+nOcbROyz4OD/junLhQXaaYt7 fkkzzZAhNqPUzHX8yhHuuq69zsfwtRDztIAV8UY+7jTenAQte+zZ9aSgOWfi5WeSMB xu+2NTWWElWjeI8IIcy+VGr267AqtLvLD43YyPgqsRaOm9NmTxfB3kXNKe56kT4DMV uF+XerUo+OgTE3i9nJ4p0Pu63xuM28Wu18t79pvgzU4e0jR/OFG1kRlnKmfSGNQ6F/ EUmZOsC5Sl7rQ== Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id A8C2CC98304; Tue, 22 Sep 2026 01:28:19 +0000 (UTC) From: Jaidev Shastri via B4 Relay Date: Mon, 21 Sep 2026 21:28:19 -0400 Subject: [PATCH 6/6] vt: keyboard: publish the shift_down[] counters with release semantics Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260921-mb-keyboard-v1-6-d170228b80c0@vt.edu> References: <20260921-mb-keyboard-v1-0-d170228b80c0@vt.edu> In-Reply-To: <20260921-mb-keyboard-v1-0-d170228b80c0@vt.edu> To: Greg Kroah-Hartman , Jiri Slaby Cc: linux-kernel@vger.kernel.org, linux-serial@vger.kernel.org, Jaidev Shastri X-Mailer: b4 0.16.0 X-Developer-Signature: v=1; a=ed25519-sha256; t=1790040498; l=1912; i=jaidevshastri@vt.edu; s=20260921; h=from:subject:message-id; bh=KnTNjEcgHMMpVCPx3XbhLE+RN8D0Cwj3lZFOas1PfsM=; b=GlDBlN86FER15lgRBvlYa0LSOQ81HR/YvfKC6lQD9Jtc/CmZOAIpmHp5AxhRbJQlcx8HrJ+He NuoQNEbI2kLBI/9wvBB/z6B+hyoeIbVELZ6tiaOPPsHObOH+SvV31yx X-Developer-Key: i=jaidevshastri@vt.edu; a=ed25519; pk=J7+xYJRlTPds+pv5hbqFFRqGCpDeJDzmZT1ggRwj7/0= X-Endpoint-Received: by B4 Relay for jaidevshastri@vt.edu/20260921 with auth_id=1044 X-Original-From: Jaidev Shastri Reply-To: jaidevshastri@vt.edu From: Jaidev Shastri k_shift() maintains the per-modifier depress counters in shift_down[] and k_pad() tests shift_down[KG_SHIFT] to choose between application and numeric keypad codes. Update the counter with smp_store_release() and read it with smp_load_acquire(). Found with MBCheck, a static herd7-based memory consistency checker. Signed-off-by: Jaidev Shastri --- drivers/tty/vt/keyboard.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c index 87970415a..e6112e0db 100644 --- a/drivers/tty/vt/keyboard.c +++ b/drivers/tty/vt/keyboard.c @@ -823,7 +823,8 @@ static void k_pad(struct vc_data *vc, unsigned char val= ue, char up_flag) return; /* no action, if this is a key release */ =20 /* kludge... shift forces cursor/number keys */ - if (vc_kbd_mode(kbd, VC_APPLIC) && !shift_down[KG_SHIFT]) { + /* Pairs with the smp_store_release() in k_shift(). */ + if (vc_kbd_mode(kbd, VC_APPLIC) && !smp_load_acquire(&shift_down[KG_SHIFT= ])) { applkey(vc, app_map[value], 1); return; } @@ -877,6 +878,7 @@ static void k_shift(struct vc_data *vc, unsigned char v= alue, char up_flag) { int old_state =3D shift_state; int state; + unsigned char cnt; =20 if (rep) return; @@ -890,15 +892,18 @@ static void k_shift(struct vc_data *vc, unsigned char= value, char up_flag) clr_vc_kbd_led(kbd, VC_CAPSLOCK); } =20 + cnt =3D shift_down[value]; if (up_flag) { /* * handle the case that two shift or control * keys are depressed simultaneously */ - if (shift_down[value]) - shift_down[value]--; + if (cnt) + cnt--; } else - shift_down[value]++; + cnt++; + /* Pairs with the smp_load_acquire() in k_pad(). */ + smp_store_release(&shift_down[value], cnt); =20 if (shift_down[value]) state =3D shift_state | BIT(value); --=20 2.43.0