Commit 6f733cb2 authored by Wang Wensheng's avatar Wang Wensheng Committed by Wim Van Sebroeck

watchdog: Fix potential dereferencing of null pointer

A reboot notifier, which stops the WDT by calling the stop hook without
any check, would be registered when we set WDOG_STOP_ON_REBOOT flag.

Howerer we allow the WDT driver to omit the stop hook since commit
"d0684c8a" ("watchdog: Make stop function optional") and provide
a module parameter for user that controls the WDOG_STOP_ON_REBOOT flag
in commit 9232c806 ("watchdog: Add stop_on_reboot parameter to
control reboot policy"). Together that commits make user potential to
insert a watchdog driver that don't provide a stop hook but with the
stop_on_reboot parameter set, then dereferencing of null pointer occurs
on system reboot.

Check the stop hook before registering the reboot notifier to fix the
issue.

Fixes: d0684c8a ("watchdog: Make stop function optional")
Signed-off-by: default avatarWang Wensheng <wangwensheng4@huawei.com>
Reviewed-by: default avatarGuenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/r/20201109130512.28121-1-wangwensheng4@huawei.comSigned-off-by: default avatarGuenter Roeck <linux@roeck-us.net>
Signed-off-by: default avatarWim Van Sebroeck <wim@linux-watchdog.org>
parent 24f98562
...@@ -267,15 +267,19 @@ static int __watchdog_register_device(struct watchdog_device *wdd) ...@@ -267,15 +267,19 @@ static int __watchdog_register_device(struct watchdog_device *wdd)
} }
if (test_bit(WDOG_STOP_ON_REBOOT, &wdd->status)) { if (test_bit(WDOG_STOP_ON_REBOOT, &wdd->status)) {
wdd->reboot_nb.notifier_call = watchdog_reboot_notifier; if (!wdd->ops->stop)
pr_warn("watchdog%d: stop_on_reboot not supported\n", wdd->id);
ret = register_reboot_notifier(&wdd->reboot_nb); else {
if (ret) { wdd->reboot_nb.notifier_call = watchdog_reboot_notifier;
pr_err("watchdog%d: Cannot register reboot notifier (%d)\n",
wdd->id, ret); ret = register_reboot_notifier(&wdd->reboot_nb);
watchdog_dev_unregister(wdd); if (ret) {
ida_simple_remove(&watchdog_ida, id); pr_err("watchdog%d: Cannot register reboot notifier (%d)\n",
return ret; wdd->id, ret);
watchdog_dev_unregister(wdd);
ida_simple_remove(&watchdog_ida, id);
return ret;
}
} }
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment