Re: [PATCH] watchdog: nv_tco: Fix pci_dev reference leak in nv_tco_getdevice()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] watchdog: nv_tco: UAF of tco_pci in nv_tco_getdevice() after rebind
--

commit ebd2445ef6099c554744a2027e93f0a0d26346d1
Author: Wentao Liang <vulab@iscas.ac.cn>

watchdog: nv_tco: Fix pci_dev reference leak in nv_tco_getdevice()

This commit addresses a pci_dev reference leak in the nv_tco driver. It adds
pci_dev_put() calls to the error paths of nv_tco_getdevice() and also inside
nv_tco_cleanup() to properly drop the reference when the driver is removed or
encounters an error.

> diff --git a/drivers/watchdog/nv_tco.c b/drivers/watchdog/nv_tco.c
> index f16cee5173d50..9ce8325b4d3fd 100644
> --- a/drivers/watchdog/nv_tco.c
> +++ b/drivers/watchdog/nv_tco.c
[ ... ]
> @@ -373,6 +373,9 @@ static unsigned char nv_tco_getdevice(void)
>  	return 1;
>  out:
>  	release_region(tcobase, 0x10);
> +err:
> +	pci_dev_put(tco_pci);
> +	tco_pci = NULL;
>  	return 0;
>  }
>  
> @@ -443,6 +446,7 @@ static void nv_tco_cleanup(void)
>  	/* Deregister */
>  	misc_deregister(&nv_tco_miscdev);
>  	release_region(tcobase, 0x10);
> +	pci_dev_put(tco_pci);

[Severity: High]
Is tco_pci left as a dangling pointer here?

If the driver is unbound, nv_tco_cleanup() drops the reference. Since it isn't
set to NULL here like it is in nv_tco_getdevice(), a subsequent rebind attempt
could lead to a use-after-free.

If no matching PCI device is found during re-initialization, the stale
pointer bypasses the check and is dereferenced:

drivers/watchdog/nv_tco.c:nv_tco_getdevice() {
    ...
    if (!tco_pci)
        return 0;

    /* Find the base io port */
    pci_read_config_dword(tco_pci, 0x64, &val);
    ...
}

Could this cause memory corruption when the underlying PCI device is
hot-removed and the platform driver is rebound?

>  }
>  
>  static void nv_tco_remove(struct platform_device *dev)

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260916170240.2086046-1-vulab@iscas.ac.cn?part=1