Re: [PATCH] watchdog: cpwd: serialize device access against cpwd_remove()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] watchdog: cpwd: AB-BA deadlock between misc_mtx and cpwd_mutex
--

commit b2d69e49e806eb6cb2c3610179ff17ccacb7cf1b
Author: Muhammad Bilal <meatuni001@gmail.com>

watchdog: cpwd: serialize device access against cpwd_remove()

This commit adds synchronization using cpwd_mutex across device operations 
and teardown. It guards cpwd_remove, cpwd_open, cpwd_ioctl, and cpwd_write 
to prevent race conditions that could lead to use-after-free or NULL pointer 
dereferences.

> diff --git a/drivers/watchdog/cpwd.c b/drivers/watchdog/cpwd.c
> index 13a4d47e68cd8..48f5e92b8cbd0 100644
> --- a/drivers/watchdog/cpwd.c
> +++ b/drivers/watchdog/cpwd.c

[ ... ]

> @@ -618,6 +631,8 @@ static void cpwd_remove(struct platform_device *op)
>  	struct cpwd *p = platform_get_drvdata(op);
>  	int i;
>  
> +	guard(mutex)(&cpwd_mutex);
> +
>  	for (i = 0; i < WD_NUMDEVS; i++) {
>  		misc_deregister(&p->devs[i].misc);

[Severity: High]
Could this introduction of guard(mutex)(&cpwd_mutex) here create an AB-BA
deadlock with the misc subsystem's misc_mtx?

When a user opens the device, the misc subsystem acquires misc_mtx before
calling the driver's open function:

drivers/char/misc.c:misc_open() {
    mutex_lock(&misc_mtx);
    ...
    if (file->f_op->open)
        err = file->f_op->open(inode, file);
}

Then, in cpwd_open(), the driver acquires cpwd_mutex:

drivers/watchdog/cpwd.c:cpwd_open() {
    guard(mutex)(&cpwd_mutex);
    ...
}

This establishes the lock order: misc_mtx -> cpwd_mutex.

However, during device removal, this new code acquires cpwd_mutex first,
and then calls misc_deregister(), which attempts to acquire misc_mtx:

drivers/char/misc.c:misc_deregister() {
    mutex_lock(&misc_mtx);
    ...
}

This creates a reverse lock dependency (cpwd_mutex -> misc_mtx), which
could deadlock if a module removal or device unbind occurs concurrently
with a user-space open on the watchdog device.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260919192301.272194-1-meatuni001@gmail.com?part=1