Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4bcd615f authored by Guenter Roeck's avatar Guenter Roeck Committed by Wim Van Sebroeck
Browse files

watchdog: Fix potential kref imbalance when opening watchdog 



If a watchdog driver's open function sets WDOG_HW_RUNNING with the
expectation that the watchdog can not be stopped, but then stops the
watchdog anyway in its stop function, kref_get() wil not be called in
watchdog_open(). If the watchdog then stops on close, WDOG_HW_RUNNING
will be cleared and kref_put() will be called, causing a kref imbalance.
As result the character device data structure will be released, which in
turn will cause the system to crash on the next call to watchdog_open().

Fixes: ee142889 ("watchdog: Introduce WDOG_HW_RUNNING flag")
Signed-off-by: default avatarGuenter Roeck <linux@roeck-us.net>
Signed-off-by: default avatarWim Van Sebroeck <wim@iguana.be>
parent f3b5ad89

drivers/watchdog/watchdog_dev.c

+4 −2
Original line number Diff line number Diff line
@@ -769,6 +769,7 @@ static int watchdog_open(struct inode *inode, struct file *file) 
{

	struct watchdog_core_data *wd_data;

	struct watchdog_device *wdd;

	bool hw_running;

	int err;



	/* Get the corresponding watchdog device */
@@ -788,7 +789,8 @@ static int watchdog_open(struct inode *inode, struct file *file) 
	 * If the /dev/watchdog device is open, we don't want the module

	 * to be unloaded.

	 */

	if (!watchdog_hw_running(wdd) && !try_module_get(wdd->ops->owner)) {

	hw_running = watchdog_hw_running(wdd);

	if (!hw_running && !try_module_get(wdd->ops->owner)) {

		err = -EBUSY;

		goto out_clear;

	}
@@ -799,7 +801,7 @@ static int watchdog_open(struct inode *inode, struct file *file) 


	file->private_data = wd_data;



	if (!watchdog_hw_running(wdd))

	if (!hw_running)

		kref_get(&wd_data->kref);



	/* dev/watchdog is a virtual (and thus non-seekable) filesystem */