On Tue, Nov 24, 2015 at 06:20:11PM -0800, Guenter Roeck wrote:
> On 11/24/2015 03:45 PM, Damien Riegel wrote:
> >device_create is called after watchdog_dev_register, so it makes more
> >sense to call the cleanup functions in reverse order, ie. device_destroy
> >before watchdog_dev_unregister.
> >
> >Signed-off-by: Damien Riegel <damien.riegel@xxxxxxxxxxxxxxxxxxxx>
>
> Reviewed-by: Guenter Roeck <linux@xxxxxxxxxxxx>
>
On second thought, I am wondering if the proper fix would not be to call
device_create before watchdog_dev_register. Consider the following
scenario:
watchdog_register_device
__watchdog_register_device
watchdog_dev_register returns successfully, char dev is live
device_create fails, setting wdd->dev to an ERR_PTR
...
meanwhile, a user opens the watchdog, hence ops->start is called.
If ops->start uses wdd->dev (to print a debug message for
instance), it will dereference an invalid pointer.
Admittedly, it should be quite rare, but there is still a chance for a
race condition here.
Damien
--
To unsubscribe from this list: send the line "unsubscribe linux-watchdog" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
