Re: [PATCH v2 5/9] watchdog: msc313e: Fix spurious reset on suspend

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Calling `watchdog_stop_ping_on_suspend()` opts the driver into a buggy watchdog core feature that leaks the PM notifier, causing a Use-After-Free upon device unbind or module unload.
--

commit f0550ce9d86164c3e7cb8c64fecb979c9936c149
Author: Tzung-Bi Shih <tzungbi@kernel.org>

watchdog: msc313e: Fix spurious reset on suspend
    
This commit addresses a spurious system reset on suspend when the watchdog
is started by the bootloader but not yet opened by userspace. It checks
both active and hardware running states, and stops the ping worker during
suspend.

> diff --git a/drivers/watchdog/msc313e_wdt.c b/drivers/watchdog/msc313e_wdt.c
> index 86e72aea96855..9cfe059fd31a7 100644
> --- a/drivers/watchdog/msc313e_wdt.c
> +++ b/drivers/watchdog/msc313e_wdt.c
> @@ -157,6 +157,7 @@ static int msc313e_wdt_probe(struct platform_device *pdev)
>  	watchdog_init_timeout(&priv->wdev, timeout, dev);
>  	watchdog_stop_on_reboot(&priv->wdev);
>  	watchdog_stop_on_unregister(&priv->wdev);
> +	watchdog_stop_ping_on_suspend(&priv->wdev);

[Severity: High]
Does adding this call expose the driver to a use-after-free regression
during device unbind or module unload?

Calling watchdog_stop_ping_on_suspend() sets the WDOG_NO_PING_ON_SUSPEND
flag. The watchdog core sees this flag and registers wdd->pm_nb to the
global PM notifier chain.

However, the core unregistration path in __watchdog_unregister_device()
fails to detach the PM notifier:

drivers/watchdog/watchdog_core.c:__watchdog_unregister_device() {
    ...
    if (test_bit(WDOG_STOP_ON_REBOOT, &wdd->status))
        unregister_reboot_notifier(&wdd->reboot_nb);

    watchdog_dev_unregister(wdd);
    ida_free(&watchdog_ida, wdd->id);
    ...
}

When the driver is unbound (e.g. via sysfs) or the module is unloaded, the
driver's memory containing pm_nb is freed, leaving a dangling pointer in the
global PM notifier list. The next system suspend could then trigger a panic.

While the missing unregister logic is a pre-existing flaw in the watchdog
core, this patch newly exposes the msc313e_wdt driver to this issue.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260828161348.13212-1-tzungbi@kernel.org?part=5