[-next,v4] watchdog: Fix potential dereferencing of null pointer

Message ID 20201109130512.28121-1-wangwensheng4@huawei.com
State New
Headers show
Series
  • [-next,v4] watchdog: Fix potential dereferencing of null pointer
Related show

Commit Message

Wang Wensheng Nov. 9, 2020, 1:05 p.m.
A reboot notifier, which stops the WDT by calling the stop hook without
any check, would be registered when we set WDOG_STOP_ON_REBOOT flag.

Howerer we allow the WDT driver to omit the stop hook since commit
"d0684c8a93549" ("watchdog: Make stop function optional") and provide
a module parameter for user that controls the WDOG_STOP_ON_REBOOT flag
in commit 9232c80659e94 ("watchdog: Add stop_on_reboot parameter to
control reboot policy"). Together that commits make user potential to
insert a watchdog driver that don't provide a stop hook but with the
stop_on_reboot parameter set, then dereferencing of null pointer occurs
on system reboot.

Check the stop hook before registering the reboot notifier to fix the
issue.

Fixes: d0684c8a9354 ("watchdog: Make stop function optional")
Signed-off-by: Wang Wensheng <wangwensheng4@huawei.com>
---
 drivers/watchdog/watchdog_core.c | 22 +++++++++++++---------
 1 file changed, 13 insertions(+), 9 deletions(-)

Comments

Guenter Roeck Nov. 10, 2020, 4:01 p.m. | #1
On Mon, Nov 09, 2020 at 01:05:12PM +0000, Wang Wensheng wrote:
> A reboot notifier, which stops the WDT by calling the stop hook without

> any check, would be registered when we set WDOG_STOP_ON_REBOOT flag.

> 

> Howerer we allow the WDT driver to omit the stop hook since commit

> "d0684c8a93549" ("watchdog: Make stop function optional") and provide

> a module parameter for user that controls the WDOG_STOP_ON_REBOOT flag

> in commit 9232c80659e94 ("watchdog: Add stop_on_reboot parameter to

> control reboot policy"). Together that commits make user potential to

> insert a watchdog driver that don't provide a stop hook but with the

> stop_on_reboot parameter set, then dereferencing of null pointer occurs

> on system reboot.

> 

> Check the stop hook before registering the reboot notifier to fix the

> issue.

> 

> Fixes: d0684c8a9354 ("watchdog: Make stop function optional")

> Signed-off-by: Wang Wensheng <wangwensheng4@huawei.com>


Reviewed-by: Guenter Roeck <linux@roeck-us.net>


> ---

>  drivers/watchdog/watchdog_core.c | 22 +++++++++++++---------

>  1 file changed, 13 insertions(+), 9 deletions(-)

> 

> diff --git a/drivers/watchdog/watchdog_core.c b/drivers/watchdog/watchdog_core.c

> index 423844757812..0e9a99559609 100644

> --- a/drivers/watchdog/watchdog_core.c

> +++ b/drivers/watchdog/watchdog_core.c

> @@ -267,15 +267,19 @@ static int __watchdog_register_device(struct watchdog_device *wdd)

>  	}

>  

>  	if (test_bit(WDOG_STOP_ON_REBOOT, &wdd->status)) {

> -		wdd->reboot_nb.notifier_call = watchdog_reboot_notifier;

> -

> -		ret = register_reboot_notifier(&wdd->reboot_nb);

> -		if (ret) {

> -			pr_err("watchdog%d: Cannot register reboot notifier (%d)\n",

> -			       wdd->id, ret);

> -			watchdog_dev_unregister(wdd);

> -			ida_simple_remove(&watchdog_ida, id);

> -			return ret;

> +		if (!wdd->ops->stop)

> +			pr_warn("watchdog%d: stop_on_reboot not supported\n", wdd->id);

> +		else {

> +			wdd->reboot_nb.notifier_call = watchdog_reboot_notifier;

> +

> +			ret = register_reboot_notifier(&wdd->reboot_nb);

> +			if (ret) {

> +				pr_err("watchdog%d: Cannot register reboot notifier (%d)\n",

> +					wdd->id, ret);

> +				watchdog_dev_unregister(wdd);

> +				ida_simple_remove(&watchdog_ida, id);

> +				return ret;

> +			}

>  		}

>  	}

>  

> -- 

> 2.25.0

>

Patch

diff --git a/drivers/watchdog/watchdog_core.c b/drivers/watchdog/watchdog_core.c
index 423844757812..0e9a99559609 100644
--- a/drivers/watchdog/watchdog_core.c
+++ b/drivers/watchdog/watchdog_core.c
@@ -267,15 +267,19 @@  static int __watchdog_register_device(struct watchdog_device *wdd)
 	}
 
 	if (test_bit(WDOG_STOP_ON_REBOOT, &wdd->status)) {
-		wdd->reboot_nb.notifier_call = watchdog_reboot_notifier;
-
-		ret = register_reboot_notifier(&wdd->reboot_nb);
-		if (ret) {
-			pr_err("watchdog%d: Cannot register reboot notifier (%d)\n",
-			       wdd->id, ret);
-			watchdog_dev_unregister(wdd);
-			ida_simple_remove(&watchdog_ida, id);
-			return ret;
+		if (!wdd->ops->stop)
+			pr_warn("watchdog%d: stop_on_reboot not supported\n", wdd->id);
+		else {
+			wdd->reboot_nb.notifier_call = watchdog_reboot_notifier;
+
+			ret = register_reboot_notifier(&wdd->reboot_nb);
+			if (ret) {
+				pr_err("watchdog%d: Cannot register reboot notifier (%d)\n",
+					wdd->id, ret);
+				watchdog_dev_unregister(wdd);
+				ida_simple_remove(&watchdog_ida, id);
+				return ret;
+			}
 		}
 	}