Commit 4b2e7f99 authored by Madhuparna Bhowmik's avatar Madhuparna Bhowmik Committed by Wim Van Sebroeck

drivers: watchdog: rdc321x_wdt: Fix race condition bugs

In rdc321x_wdt_probe(), rdc321x_wdt_device.queue is initialized
after misc_register(), hence if ioctl is called before its
initialization which can call rdc321x_wdt_start() function,
it will see an uninitialized value of rdc321x_wdt_device.queue,
hence initialize it before misc_register().
Also, rdc321x_wdt_device.default_ticks is accessed in reset()
function called from write callback, thus initialize it before
misc_register().

Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: default avatarMadhuparna Bhowmik <madhuparnabhowmik10@gmail.com>
Reviewed-by: default avatarGuenter Roeck <linux@roeck-us.net>
Reviewed-by: default avatarFlorian Fainelli <f.fainelli@gmail.com>
Link: https://lore.kernel.org/r/20200807112902.28764-1-madhuparnabhowmik10@gmail.comSigned-off-by: default avatarGuenter Roeck <linux@roeck-us.net>
Signed-off-by: default avatarWim Van Sebroeck <wim@linux-watchdog.org>
parent a1b8638b
...@@ -231,6 +231,8 @@ static int rdc321x_wdt_probe(struct platform_device *pdev) ...@@ -231,6 +231,8 @@ static int rdc321x_wdt_probe(struct platform_device *pdev)
rdc321x_wdt_device.sb_pdev = pdata->sb_pdev; rdc321x_wdt_device.sb_pdev = pdata->sb_pdev;
rdc321x_wdt_device.base_reg = r->start; rdc321x_wdt_device.base_reg = r->start;
rdc321x_wdt_device.queue = 0;
rdc321x_wdt_device.default_ticks = ticks;
err = misc_register(&rdc321x_wdt_misc); err = misc_register(&rdc321x_wdt_misc);
if (err < 0) { if (err < 0) {
...@@ -245,14 +247,11 @@ static int rdc321x_wdt_probe(struct platform_device *pdev) ...@@ -245,14 +247,11 @@ static int rdc321x_wdt_probe(struct platform_device *pdev)
rdc321x_wdt_device.base_reg, RDC_WDT_RST); rdc321x_wdt_device.base_reg, RDC_WDT_RST);
init_completion(&rdc321x_wdt_device.stop); init_completion(&rdc321x_wdt_device.stop);
rdc321x_wdt_device.queue = 0;
clear_bit(0, &rdc321x_wdt_device.inuse); clear_bit(0, &rdc321x_wdt_device.inuse);
timer_setup(&rdc321x_wdt_device.timer, rdc321x_wdt_trigger, 0); timer_setup(&rdc321x_wdt_device.timer, rdc321x_wdt_trigger, 0);
rdc321x_wdt_device.default_ticks = ticks;
dev_info(&pdev->dev, "watchdog init success\n"); dev_info(&pdev->dev, "watchdog init success\n");
return 0; return 0;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment