Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6ad31f85 authored by Guenter Roeck's avatar Guenter Roeck Committed by Greg Kroah-Hartman
Browse files

watchdog: Fix potential kref imbalance when opening watchdog 




[ Upstream commit 4bcd615fad6adddc68b058d498b30a9e0e0db77a ]

If a watchdog driver's open function sets WDOG_HW_RUNNING with the
expectation that the watchdog can not be stopped, but then stops the
watchdog anyway in its stop function, kref_get() wil not be called in
watchdog_open(). If the watchdog then stops on close, WDOG_HW_RUNNING
will be cleared and kref_put() will be called, causing a kref imbalance.
As result the character device data structure will be released, which in
turn will cause the system to crash on the next call to watchdog_open().

Fixes: ee142889 ("watchdog: Introduce WDOG_HW_RUNNING flag")
Signed-off-by: default avatarGuenter Roeck <linux@roeck-us.net>
Signed-off-by: default avatarWim Van Sebroeck <wim@iguana.be>
Signed-off-by: default avatarSasha Levin <alexander.levin@microsoft.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 32dc29cf

drivers/watchdog/watchdog_dev.c

+4 −2
Original line number Diff line number Diff line
@@ -760,6 +760,7 @@ static int watchdog_open(struct inode *inode, struct file *file) 
{

	struct watchdog_core_data *wd_data;

	struct watchdog_device *wdd;

	bool hw_running;

	int err;



	/* Get the corresponding watchdog device */
@@ -779,7 +780,8 @@ static int watchdog_open(struct inode *inode, struct file *file) 
	 * If the /dev/watchdog device is open, we don't want the module

	 * to be unloaded.

	 */

	if (!watchdog_hw_running(wdd) && !try_module_get(wdd->ops->owner)) {

	hw_running = watchdog_hw_running(wdd);

	if (!hw_running && !try_module_get(wdd->ops->owner)) {

		err = -EBUSY;

		goto out_clear;

	}
@@ -790,7 +792,7 @@ static int watchdog_open(struct inode *inode, struct file *file) 


	file->private_data = wd_data;



	if (!watchdog_hw_running(wdd))

	if (!hw_running)

		kref_get(&wd_data->kref);



	/* dev/watchdog is a virtual (and thus non-seekable) filesystem */