linux-kernel - [char-misc for 3.8] mei: avoid oops in watchdog unregister code path

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Sun, 16 Dec 2012 13:23:17 +0200
From:	Tomas Winkler <tomas.winkler@...el.com>
To:	gregkh@...uxfoundation.org, hdegoede@...hat.com, wim@...ana.be
Cc:	arnd@...db.de, alan@...ux.intel.com, linux-kernel@...r.kernel.org,
	linux-watchdog@...r.kernel.org,
	Tomas Winkler <tomas.winkler@...el.com>,
	Borislav Petkov <bp@...en8.de>,
	Wanlong Gao <gaowanlong@...fujitsu.com>,
	Jerry Snitselaar <jerry.snitselaar@...cle.com>
Subject: [char-misc for 3.8] mei: avoid oops in watchdog unregister code path

With commit c7d3df3 "mei: use internal watchdog device registration
tracking" will crash the kernel on shutdown path on systems
where ME watchdog is not present.
Since the watchdog was never initialized in such case
the WDOG_UNREGISTERED bit is never set and the system
crashes on access to uninitialized variables down the path.

To solve the issue we query for NULL on watchdog driver driver_data
to check whether the device is registered. This is handled in the
driver and doesn't depend on watchdog core internals.

Cc: Borislav Petkov <bp@...en8.de>
Cc: Wanlong Gao <gaowanlong@...fujitsu.com>
Signed-off-by: Jerry Snitselaar <jerry.snitselaar@...cle.com>
Signed-off-by: Tomas Winkler <tomas.winkler@...el.com>
---
 drivers/misc/mei/wd.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/drivers/misc/mei/wd.c b/drivers/misc/mei/wd.c
index 636409f..9299a8c 100644
--- a/drivers/misc/mei/wd.c
+++ b/drivers/misc/mei/wd.c
@@ -370,7 +370,7 @@ void mei_watchdog_register(struct mei_device *dev)
 
 void mei_watchdog_unregister(struct mei_device *dev)
 {
-	if (test_bit(WDOG_UNREGISTERED, &amt_wd_dev.status))
+	if (watchdog_get_drvdata(&amt_wd_dev) == NULL)
 		return;
 
 	watchdog_set_drvdata(&amt_wd_dev, NULL);
-- 
1.7.4.4

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/