linux-kernel - [PATCH] drivers: watchdog: pc87413

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 13 Aug 2020 18:24:51 +0530
From:   madhuparnabhowmik10@...il.com
To:     wim@...ux-watchdog.org, linux@...ck-us.net
Cc:     linux-watchdog@...r.kernel.org, linux-kernel@...r.kernel.org,
        andrianov@...ras.ru, ldv-project@...uxtesting.org,
        Madhuparna Bhowmik <madhuparnabhowmik10@...il.com>
Subject: [PATCH] drivers: watchdog: pc87413_wdt: Fix Race condition bug

From: Madhuparna Bhowmik <madhuparnabhowmik10@...il.com>

After misc_register the open() callback can be called.
However the base address (swc_base_addr) is set after misc_register()
in init.
As a result, if open callback is called before pc87413_get_swc_base_addr()
then in the following call chain: pc87413_open() -> pc87413_refresh() ->
pc87413_swc_bank3() : The value of swc_base_addr will be -1.
Therefore, do misc_register() after pc87413_get_swc_base_addr().

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Madhuparna Bhowmik <madhuparnabhowmik10@...il.com>
---
 drivers/watchdog/pc87413_wdt.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/watchdog/pc87413_wdt.c b/drivers/watchdog/pc87413_wdt.c
index 73fbfc99083b..ad8b8af2bdc0 100644
--- a/drivers/watchdog/pc87413_wdt.c
+++ b/drivers/watchdog/pc87413_wdt.c
@@ -512,6 +512,10 @@ static int __init pc87413_init(void)
 	if (ret != 0)
 		pr_err("cannot register reboot notifier (err=%d)\n", ret);
 
+	pc87413_select_wdt_out();
+	pc87413_enable_swc();
+	pc87413_get_swc_base_addr();
+
 	ret = misc_register(&pc87413_miscdev);
 	if (ret != 0) {
 		pr_err("cannot register miscdev on minor=%d (err=%d)\n",
@@ -520,10 +524,6 @@ static int __init pc87413_init(void)
 	}
 	pr_info("initialized. timeout=%d min\n", timeout);
 
-	pc87413_select_wdt_out();
-	pc87413_enable_swc();
-	pc87413_get_swc_base_addr();
-
 	if (!request_region(swc_base_addr, 0x20, MODNAME)) {
 		pr_err("cannot request SWC region at 0x%x\n", swc_base_addr);
 		ret = -EBUSY;
-- 
2.17.1