Re: [PATCH AUTOSEL 6.18-6.12] watchdog: lenovo_se10_wdt: Add support for SE10 Gen 2 platform

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] This problem wasn't introduced by this patch, but if `platform_device_add()` fails in `se10_create_platform_device()`, the global pointer `se10_pdev` is freed via `platform_device_put()` but is not set to NULL. This leads to a use-after-free and double-free during module exit.
--

commit c17067068789e49fda2c6ba80c40320fe7102b48
Author: Mark Pearson <mpearson-lenovo@squebb.ca>

watchdog: lenovo_se10_wdt: Add support for SE10 Gen 2 platform
    
The Lenovo SE10 Gen 2 platform uses a watchdog chip from the same family.
Watchdog functionality is the same, so this updates the driver with the new
chip ID. The Gen 2 MTMs are also added to enable support on the platform.
    
Link: https://lore.kernel.org/r/20260428124954.1193450-1-mpearson-lenovo@squebb.ca

> diff --git a/drivers/watchdog/lenovo_se10_wdt.c b/drivers/watchdog/lenovo_se10_wdt.c
> index cd0500e5080b4..99ff01af41243 100644
> --- a/drivers/watchdog/lenovo_se10_wdt.c
> +++ b/drivers/watchdog/lenovo_se10_wdt.c

[ ... ]

> @@ -280,6 +280,70 @@ static const struct dmi_system_id se10_dmi_table[] __initconst = {
>  		},
>  		.callback = se10_create_platform_device,
>  	},
> +	{
> +		.ident = "LENOVO-SE10-G2",
> +		.matches = {
> +			DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
> +			DMI_MATCH(DMI_PRODUCT_NAME, "13LJ"),
> +		},
> +		.callback = se10_create_platform_device,
> +	},

[Severity: High]
This isn't a bug introduced by this patch, but while reviewing this callback
addition, I noticed a potential use-after-free and double-free in the module
teardown path.

If platform_device_add() fails in se10_create_platform_device(), the 
global se10_pdev pointer is freed but left dangling:

drivers/watchdog/lenovo_se10_wdt.c:se10_create_platform_device() {
    ...
	err = platform_device_add(se10_pdev);
	if (err)
		platform_device_put(se10_pdev);
    ...
}

Because dmi_check_system() returns a positive match count even when the 
callback returns an error, se10_wdt_init() will proceed to call 
platform_driver_register() and successfully load the module.

When the module is later unloaded, se10_wdt_exit() checks if the dangling 
pointer is non-NULL and calls platform_device_unregister() on it:

drivers/watchdog/lenovo_se10_wdt.c:se10_wdt_exit() {
    ...
	if (se10_pdev)
		platform_device_unregister(se10_pdev);
    ...
}

Should we set se10_pdev to NULL after calling platform_device_put() to 
prevent this?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260831133314.4125787-255-sashal@kernel.org?part=1