Re: [PATCH 3/3] watchdog: qcom: Register pretimeout interrupt as NMI

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Potential Use-After-Free and NULL pointer dereference in NMI teardown during driver unbind or probe failure.
--

--- Patch [3]: [PATCH 3/3] watchdog: qcom: Register pretimeout interrupt as NMI ---
commit 630edce3072ee30140f775e46b40445975b0d011
Author: Mayank Rungta <mrungta@google.com>

watchdog: qcom: Register pretimeout interrupt as NMI

Attempt to register the pretimeout interrupt as an NMI, falling back to a
standard IRQ if NMI registration fails. Explicitly arm and disarm the NMI
during start and stop operations, and register a devres action to free the
NMI on teardown.

> diff --git a/drivers/watchdog/qcom-wdt.c b/drivers/watchdog/qcom-wdt.c
> index 49bd04841f0c8..19d8e91cff408 100644
> --- a/drivers/watchdog/qcom-wdt.c
> +++ b/drivers/watchdog/qcom-wdt.c

[ ... ]

> +static void qcom_wdt_free_nmi(void *arg)
> +{
> +	struct qcom_wdt *wdt = arg;
> +
> +	qcom_wdt_disable_irq(wdt);
> +	free_nmi(wdt->irq, &wdt->wdd);

[Severity: High]
Is there a regression here that could cause a use-after-free during driver
unbind or probe failure?

Unlike free_irq(), free_nmi() does not synchronize with in-flight NMI handlers
on other CPUs. It immediately clears desc->action and calls kfree() on the
struct irqaction.

If the pretimeout NMI triggers concurrently just before the interrupt is
masked, could the architecture NMI handler be executing and dereference the
freed irqaction?

kernel/irq/chip.c:handle_fasteoi_nmi() {
    ...
    res = action->handler(irq, action->dev_id);
    ...
}

Additionally, since subsequent devres unwinding frees the struct qcom_wdt,
could qcom_wdt_isr() also dereference the freed wdd pointer when calling
watchdog_notify_pretimeout(wdd)?

Could this be triggered by root via sysfs unbind, or naturally during a
hardware-induced pretimeout racing with a module unload, leading to a crash?

> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260730-qcom-wdt-nmi-series-v1-0-3aa86d162914@google.com?part=3