Re: [PATCH v2] watchdog: pretimeout: Add "dump" pretimeout governor

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Unregistering the default watchdog pretimeout governor leaves dangling pointers in `default_gov` and active watchdogs, leading to a Use-After-Free.
--

--- Patch [1]: [PATCH v2] watchdog: pretimeout: Add "dump" pretimeout governor ---
commit fdc83bdc7fe1e2cb54902870250cd46dee161270
Author: Tzung-Bi Shih <[email protected]>

watchdog: pretimeout: Add "dump" pretimeout governor

This patch adds a new "dump" pretimeout governor that triggers an all-CPU
backtrace on watchdog pretimeout. It also updates the Kconfig logic to
ensure the "panic" governor is selected as a fallback when others are disabled.

Link: https://lore.kernel.org/all/[email protected]

> diff --git a/drivers/watchdog/pretimeout_dump.c b/drivers/watchdog/pretimeout_dump.c
> new file mode 100644
> index 0000000000000..c5d3dac2606c4
> --- /dev/null
> +++ b/drivers/watchdog/pretimeout_dump.c

[ ... ]

> +static void __exit watchdog_gov_dump_unregister(void)
> +{
> +	watchdog_unregister_governor(&watchdog_gov_dump);
> +}

[Severity: High]
This is a pre-existing issue, but does unregistering a default governor leave
dangling pointers in watchdog devices?

Looking at watchdog_unregister_governor() in
drivers/watchdog/watchdog_pretimeout.c:

void watchdog_unregister_governor(struct watchdog_governor *gov)
{
    ...
    list_for_each_entry(p, &pretimeout_list, entry)
        if (p->wdd->gov == gov)
            p->wdd->gov = default_gov;
    ...
}

If the governor being unregistered happens to be the current default governor,
default_gov is not cleared and still points to the governor being removed. The
fallback assignment reassigns the same dangling pointer back to the watchdog
device.

Could this lead to a use-after-free on the next pretimeout event if the
governor's memory is freed after unregistration?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1