Re: [PATCH v2 1/2] watchdog: core: call device_destroy before watchdog_dev_unregister

[Damien Riegel <damien.riegel@savoirfairelinux.com>]

On Tue, Nov 24, 2015 at 06:20:11PM -0800, Guenter Roeck wrote:
> On 11/24/2015 03:45 PM, Damien Riegel wrote:
> >device_create is called after watchdog_dev_register, so it makes more
> >sense to call the cleanup functions in reverse order, ie. device_destroy
> >before watchdog_dev_unregister.
> >
> >Signed-off-by: Damien Riegel <damien.riegel@savoirfairelinux.com>
> 
> Reviewed-by: Guenter Roeck <linux@roeck-us.net>
> 

On second thought, I am wondering if the proper fix would not be to call
device_create before watchdog_dev_register. Consider the following
scenario:

  watchdog_register_device
    __watchdog_register_device
	  watchdog_dev_register returns successfully, char dev is live
      device_create fails, setting wdd->dev to an ERR_PTR
	  ...
	  meanwhile, a user opens the watchdog, hence ops->start is called.
	  If ops->start uses wdd->dev (to print a debug message for
	  instance), it will dereference an invalid pointer.

Admittedly, it should be quite rare, but there is still a chance for a
race condition here.

Damien