* [PATCH -next v4] watchdog: Fix potential dereferencing of null pointer
@ 2020-11-09 13:05 Wang Wensheng
2020-11-10 16:01 ` Guenter Roeck
0 siblings, 1 reply; 2+ messages in thread
From: Wang Wensheng @ 2020-11-09 13:05 UTC (permalink / raw)
To: wim, linux, linux-watchdog, linux-kernel; +Cc: rui.xiang
A reboot notifier, which stops the WDT by calling the stop hook without
any check, would be registered when we set WDOG_STOP_ON_REBOOT flag.
Howerer we allow the WDT driver to omit the stop hook since commit
"d0684c8a93549" ("watchdog: Make stop function optional") and provide
a module parameter for user that controls the WDOG_STOP_ON_REBOOT flag
in commit 9232c80659e94 ("watchdog: Add stop_on_reboot parameter to
control reboot policy"). Together that commits make user potential to
insert a watchdog driver that don't provide a stop hook but with the
stop_on_reboot parameter set, then dereferencing of null pointer occurs
on system reboot.
Check the stop hook before registering the reboot notifier to fix the
issue.
Fixes: d0684c8a9354 ("watchdog: Make stop function optional")
Signed-off-by: Wang Wensheng <wangwensheng4@huawei.com>
---
drivers/watchdog/watchdog_core.c | 22 +++++++++++++---------
1 file changed, 13 insertions(+), 9 deletions(-)
diff --git a/drivers/watchdog/watchdog_core.c b/drivers/watchdog/watchdog_core.c
index 423844757812..0e9a99559609 100644
--- a/drivers/watchdog/watchdog_core.c
+++ b/drivers/watchdog/watchdog_core.c
@@ -267,15 +267,19 @@ static int __watchdog_register_device(struct watchdog_device *wdd)
}
if (test_bit(WDOG_STOP_ON_REBOOT, &wdd->status)) {
- wdd->reboot_nb.notifier_call = watchdog_reboot_notifier;
-
- ret = register_reboot_notifier(&wdd->reboot_nb);
- if (ret) {
- pr_err("watchdog%d: Cannot register reboot notifier (%d)\n",
- wdd->id, ret);
- watchdog_dev_unregister(wdd);
- ida_simple_remove(&watchdog_ida, id);
- return ret;
+ if (!wdd->ops->stop)
+ pr_warn("watchdog%d: stop_on_reboot not supported\n", wdd->id);
+ else {
+ wdd->reboot_nb.notifier_call = watchdog_reboot_notifier;
+
+ ret = register_reboot_notifier(&wdd->reboot_nb);
+ if (ret) {
+ pr_err("watchdog%d: Cannot register reboot notifier (%d)\n",
+ wdd->id, ret);
+ watchdog_dev_unregister(wdd);
+ ida_simple_remove(&watchdog_ida, id);
+ return ret;
+ }
}
}
--
2.25.0
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH -next v4] watchdog: Fix potential dereferencing of null pointer
2020-11-09 13:05 [PATCH -next v4] watchdog: Fix potential dereferencing of null pointer Wang Wensheng
@ 2020-11-10 16:01 ` Guenter Roeck
0 siblings, 0 replies; 2+ messages in thread
From: Guenter Roeck @ 2020-11-10 16:01 UTC (permalink / raw)
To: Wang Wensheng; +Cc: wim, linux-watchdog, linux-kernel, rui.xiang
On Mon, Nov 09, 2020 at 01:05:12PM +0000, Wang Wensheng wrote:
> A reboot notifier, which stops the WDT by calling the stop hook without
> any check, would be registered when we set WDOG_STOP_ON_REBOOT flag.
>
> Howerer we allow the WDT driver to omit the stop hook since commit
> "d0684c8a93549" ("watchdog: Make stop function optional") and provide
> a module parameter for user that controls the WDOG_STOP_ON_REBOOT flag
> in commit 9232c80659e94 ("watchdog: Add stop_on_reboot parameter to
> control reboot policy"). Together that commits make user potential to
> insert a watchdog driver that don't provide a stop hook but with the
> stop_on_reboot parameter set, then dereferencing of null pointer occurs
> on system reboot.
>
> Check the stop hook before registering the reboot notifier to fix the
> issue.
>
> Fixes: d0684c8a9354 ("watchdog: Make stop function optional")
> Signed-off-by: Wang Wensheng <wangwensheng4@huawei.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
> ---
> drivers/watchdog/watchdog_core.c | 22 +++++++++++++---------
> 1 file changed, 13 insertions(+), 9 deletions(-)
>
> diff --git a/drivers/watchdog/watchdog_core.c b/drivers/watchdog/watchdog_core.c
> index 423844757812..0e9a99559609 100644
> --- a/drivers/watchdog/watchdog_core.c
> +++ b/drivers/watchdog/watchdog_core.c
> @@ -267,15 +267,19 @@ static int __watchdog_register_device(struct watchdog_device *wdd)
> }
>
> if (test_bit(WDOG_STOP_ON_REBOOT, &wdd->status)) {
> - wdd->reboot_nb.notifier_call = watchdog_reboot_notifier;
> -
> - ret = register_reboot_notifier(&wdd->reboot_nb);
> - if (ret) {
> - pr_err("watchdog%d: Cannot register reboot notifier (%d)\n",
> - wdd->id, ret);
> - watchdog_dev_unregister(wdd);
> - ida_simple_remove(&watchdog_ida, id);
> - return ret;
> + if (!wdd->ops->stop)
> + pr_warn("watchdog%d: stop_on_reboot not supported\n", wdd->id);
> + else {
> + wdd->reboot_nb.notifier_call = watchdog_reboot_notifier;
> +
> + ret = register_reboot_notifier(&wdd->reboot_nb);
> + if (ret) {
> + pr_err("watchdog%d: Cannot register reboot notifier (%d)\n",
> + wdd->id, ret);
> + watchdog_dev_unregister(wdd);
> + ida_simple_remove(&watchdog_ida, id);
> + return ret;
> + }
> }
> }
>
> --
> 2.25.0
>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2020-11-10 16:01 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-11-09 13:05 [PATCH -next v4] watchdog: Fix potential dereferencing of null pointer Wang Wensheng
2020-11-10 16:01 ` Guenter Roeck
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).