Re: [PATCHv2 3/3] watchdog: sama5d4: fix NULL deref in irq handler

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The shared interrupt handler `sama5d4_wdt_irq_handler` unconditionally returns `IRQ_HANDLED`, defeating the generic IRQ subsystem's spurious interrupt detection and potentially leading to a system lockup.
--

commit b6b6fa431a5a5f7d84f57281a56bc7bf32bb62cb
Author: Rosen Penev <rosenp@gmail.com>

watchdog: sama5d4: fix NULL deref in irq handler

This commit moves platform_set_drvdata() before devm_request_irq() to ensure
the interrupt handler can safely dereference the driver data. This prevents a
possible NULL dereference if an interrupt on the shared System IRQ line fires
early.

> diff --git a/drivers/watchdog/sama5d4_wdt.c b/drivers/watchdog/sama5d4_wdt.c
> index 704b786cc2ec6..dcf5b8ac9e0d2 100644
> --- a/drivers/watchdog/sama5d4_wdt.c
> +++ b/drivers/watchdog/sama5d4_wdt.c
> @@ -268,6 +268,7 @@ static int sama5d4_wdt_probe(struct platform_device *pdev)
>  						: AT91_WDT_WDDIS;
>  
>  	watchdog_set_drvdata(wdd, wdt);
> +	platform_set_drvdata(pdev, wdt);

[Severity: High]
This is a pre-existing issue, but does sama5d4_wdt_irq_handler() defeat the
generic IRQ subsystem's spurious interrupt detection by unconditionally
returning IRQ_HANDLED?

The driver requests a shared interrupt line using the IRQF_SHARED flag. If
the status register check indicates the watchdog did not generate the
interrupt, the handler bypasses the emergency restart logic but still
returns IRQ_HANDLED:

drivers/watchdog/sama5d4_wdt.c:sama5d4_wdt_irq_handler() {
	...
	if (reg) {
		pr_crit("Atmel Watchdog Software Reset\n");
		emergency_restart();
		pr_crit("Reboot didn't succeed\n");
	}

	return IRQ_HANDLED;
}

Should this return IRQ_NONE when it did not service the interrupt to avoid
falsely claiming unhandled interrupts?

>  
>  	regs = devm_platform_ioremap_resource(pdev, 0);

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260608200933.18669-4-rosenp@gmail.com?part=1