svn commit: r331298 - head/sys/dev/syscons

[Bruce Evans]

On Wed, 21 Mar 2018, Konstantin Belousov wrote:

> On Thu, Mar 22, 2018 at 04:53:22AM +1100, Bruce Evans wrote:
>> Serial console drivers with fast interrupt handlers have much more
>> broken locking for ddb special keys.  It is invalid to either drop locks
>> or call the "any" function from a fast interrupt handler, but buggy
>> serial console drivers calls kbd_alt_break(), and that now calls
>> shutdown_nice() and other functions that cannot be called from a fast
>> interrupt handler.  ddb keys supply most of the shutdown_nice()
>> functionality for serial consoles, and there are no escape sequence to
>> get this without ddb or maybe another debugger, so these bugs don't
>> affect most users.
>>
>> Handling this correctly requires much the same fix as an unsafe signal
>> handler, and fixes have much the same problems -- not much more than
>> setting a flag is safe, and the flag might never be looked at if the
>> system is in a bad state.  However, if a nice shutdown is possible then
>> the sytem must be in a good enough state to poll for flags.
>
> Are you saying that fast interrupt handlers call shutdown_nice() ?  This
> is the quite serious bug on its own.  To fix it, shutdown_nice() should
> use a fast taskqueue to schedule the task which would lock the process
> and send the signal.

Yes.  See kdb_reboot().  This is called for an escape sequence from
kdb_alt_break_internal().  The other calls in kdb_alt_break_internal()
don't wander into a function that calls shutdown_nice() and are
relatively safe.  They have to be not completely safe to work in "any"
context.  kdb_reboot() is the opposite -- we want it to fail if the
context is not nice enough to reboot nicely.

BTW, I've often wanted to be able to send more general signals to init
using keystrokes, independent of being logged in.  Mainly SIGHUP to
shut down to single user mode.  This has some security problems,
especially for the "any" signal to the "any" process.  At least syscons
defaults to allowing Ctrl-Alt-Del to reboot.  I like that and miss it
on serial consoles and on some non-FreeBSD OS's (the alt-break sequence
to reach kdb_reboot() is not equivalent, since it is only available
if much more insecure sequences are also allowed).  Shutdown isn't as
fundamentally insecure as sending arbitrary signals and most systems
allow it without much more than a password for users that have physical
access to the system.

OTOH, I don't like the syscons key that suspends.  This is also allowed
by default.  I sometimes press it by mistake on a system that can suspend
but not resume.  Unlike the reboot key, there are no knobs for controlling
it.  There are 3 static configuration knobs, 2 sysctls and the keymap
which must be understood for securing the main reboot key in syscons, and a
slightly different set of controls in vt :-(.  For suspend, there is only
the keymap.  Syscons also has a standby key and more shutdown keys, but
these are in more obscure parts of keymaps and I've never noticed typing
them by mistake.

Bruce