[PATCH] watchdog: nv_tco: Fix pci_dev reference leak in nv_tco_getdevice()

[PATCH] watchdog: nv_tco: Fix pci_dev reference leak in nv_tco_getdevice()

[Wentao Liang]

nv_tco_getdevice() leaves the reference taken by for_each_pci_dev()
stored in the global tco_pci, but nothing in the driver ever drops it:
the error paths of nv_tco_getdevice() (bad BAR, request_region()
failure, SMI/NO_REBOOT failures) return with the reference held, and
nv_tco_cleanup() never puts tco_pci either.  Every failed probe and
every module load/unload cycle therefore leaks one pci_dev reference.

Release the reference on the error paths of nv_tco_getdevice() and in
nv_tco_cleanup() after the last use of tco_pci.

Fixes: 456c730153fe ("watchdog: Add TCO support for nVidia chipsets")
Cc: stable@vger.kernel.org
Signed-off-by: Wentao Liang <vulab@iscas.ac.cn>
---
 drivers/watchdog/nv_tco.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/drivers/watchdog/nv_tco.c b/drivers/watchdog/nv_tco.c
index f16cee5173d5..9ce8325b4d3f 100644
--- a/drivers/watchdog/nv_tco.c
+++ b/drivers/watchdog/nv_tco.c
@@ -324,14 +324,14 @@ static unsigned char nv_tco_getdevice(void)
 	if (val == 0x0001 || val == 0x0000) {
 		/* Something is wrong here, bar isn't setup */
 		pr_err("failed to get tcobase address\n");
-		return 0;
+		goto err;
 	}
 	val &= 0xff00;
 	tcobase = val + 0x40;
 
 	if (!request_region(tcobase, 0x10, "NV TCO")) {
 		pr_err("I/O address 0x%04x already in use\n", tcobase);
-		return 0;
+		goto err;
 	}
 
 	/* Set a reasonable heartbeat before we stop the timer */
@@ -373,6 +373,9 @@ static unsigned char nv_tco_getdevice(void)
 	return 1;
 out:
 	release_region(tcobase, 0x10);
+err:
+	pci_dev_put(tco_pci);
+	tco_pci = NULL;
 	return 0;
 }
 
@@ -443,6 +446,7 @@ static void nv_tco_cleanup(void)
 	/* Deregister */
 	misc_deregister(&nv_tco_miscdev);
 	release_region(tcobase, 0x10);
+	pci_dev_put(tco_pci);
 }
 
 static void nv_tco_remove(struct platform_device *dev)
-- 
2.34.1

Re: [PATCH] watchdog: nv_tco: Fix pci_dev reference leak in nv_tco_getdevice()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] watchdog: nv_tco: UAF of tco_pci in nv_tco_getdevice() after rebind
--

commit ebd2445ef6099c554744a2027e93f0a0d26346d1
Author: Wentao Liang <vulab@iscas.ac.cn>

watchdog: nv_tco: Fix pci_dev reference leak in nv_tco_getdevice()

This commit addresses a pci_dev reference leak in the nv_tco driver. It adds
pci_dev_put() calls to the error paths of nv_tco_getdevice() and also inside
nv_tco_cleanup() to properly drop the reference when the driver is removed or
encounters an error.

> diff --git a/drivers/watchdog/nv_tco.c b/drivers/watchdog/nv_tco.c
> index f16cee5173d50..9ce8325b4d3fd 100644
> --- a/drivers/watchdog/nv_tco.c
> +++ b/drivers/watchdog/nv_tco.c
[ ... ]
> @@ -373,6 +373,9 @@ static unsigned char nv_tco_getdevice(void)
>  	return 1;
>  out:
>  	release_region(tcobase, 0x10);
> +err:
> +	pci_dev_put(tco_pci);
> +	tco_pci = NULL;
>  	return 0;
>  }
>  
> @@ -443,6 +446,7 @@ static void nv_tco_cleanup(void)
>  	/* Deregister */
>  	misc_deregister(&nv_tco_miscdev);
>  	release_region(tcobase, 0x10);
> +	pci_dev_put(tco_pci);

[Severity: High]
Is tco_pci left as a dangling pointer here?

If the driver is unbound, nv_tco_cleanup() drops the reference. Since it isn't
set to NULL here like it is in nv_tco_getdevice(), a subsequent rebind attempt
could lead to a use-after-free.

If no matching PCI device is found during re-initialization, the stale
pointer bypasses the check and is dereferenced:

drivers/watchdog/nv_tco.c:nv_tco_getdevice() {
    ...
    if (!tco_pci)
        return 0;

    /* Find the base io port */
    pci_read_config_dword(tco_pci, 0x64, &val);
    ...
}

Could this cause memory corruption when the underlying PCI device is
hot-removed and the platform driver is rebound?

>  }
>  
>  static void nv_tco_remove(struct platform_device *dev)

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260916170240.2086046-1-vulab@iscas.ac.cn?part=1