[PATCH v1] rtc: m41t80: clean up watchdog on probe failure

[PATCH v1] rtc: m41t80: clean up watchdog on probe failure

[Yuho Choi]

m41t80_probe() registers the watchdog misc device and reboot notifier
before registering the RTC device. If RTC device registration fails,
probe returns without calling m41t80_remove(), leaving the watchdog misc
device and reboot notifier registered.

Both watchdog paths use the global save_client pointer, which can
outlive the failed probe and point at driver state that has been
released by devres.

Unregister the watchdog misc device and reboot notifier before returning
from the RTC registration failure path.

Fixes: 10d0c768cc6d ("rtc: m41t80: fix race conditions")
Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
---
 drivers/rtc/rtc-m41t80.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/drivers/rtc/rtc-m41t80.c b/drivers/rtc/rtc-m41t80.c
index b26afef37d9c..f4a30320c6ed 100644
--- a/drivers/rtc/rtc-m41t80.c
+++ b/drivers/rtc/rtc-m41t80.c
@@ -1009,9 +1009,17 @@ static int m41t80_probe(struct i2c_client *client)
 
 	rc = devm_rtc_register_device(m41t80_data->rtc);
 	if (rc)
-		return rc;
+		goto err_wdt;
 
 	return 0;
+err_wdt:
+#ifdef CONFIG_RTC_DRV_M41T80_WDT
+	if (m41t80_data->features & M41T80_FEATURE_HT) {
+		misc_deregister(&wdt_dev);
+		unregister_reboot_notifier(&wdt_notifier);
+	}
+#endif
+	return rc;
 }
 
 static void m41t80_remove(struct i2c_client *client)
-- 
2.43.0

Re: [PATCH v1] rtc: m41t80: clean up watchdog on probe failure

[최유호]

Hi,

Just a gentle ping on this patch.

I would appreciate any feedback when you have a chance to review this.

Thanks

On Mon, 1 Jun 2026 at 15:46, Yuho Choi <dbgh9129@gmail.com> wrote:
>
> m41t80_probe() registers the watchdog misc device and reboot notifier
> before registering the RTC device. If RTC device registration fails,
> probe returns without calling m41t80_remove(), leaving the watchdog misc
> device and reboot notifier registered.
>
> Both watchdog paths use the global save_client pointer, which can
> outlive the failed probe and point at driver state that has been
> released by devres.
>
> Unregister the watchdog misc device and reboot notifier before returning
> from the RTC registration failure path.
>
> Fixes: 10d0c768cc6d ("rtc: m41t80: fix race conditions")
> Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
> ---
>  drivers/rtc/rtc-m41t80.c | 10 +++++++++-
>  1 file changed, 9 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/rtc/rtc-m41t80.c b/drivers/rtc/rtc-m41t80.c
> index b26afef37d9c..f4a30320c6ed 100644
> --- a/drivers/rtc/rtc-m41t80.c
> +++ b/drivers/rtc/rtc-m41t80.c
> @@ -1009,9 +1009,17 @@ static int m41t80_probe(struct i2c_client *client)
>
>         rc = devm_rtc_register_device(m41t80_data->rtc);
>         if (rc)
> -               return rc;
> +               goto err_wdt;
>
>         return 0;
> +err_wdt:
> +#ifdef CONFIG_RTC_DRV_M41T80_WDT
> +       if (m41t80_data->features & M41T80_FEATURE_HT) {
> +               misc_deregister(&wdt_dev);
> +               unregister_reboot_notifier(&wdt_notifier);
> +       }
> +#endif
> +       return rc;
>  }
>
>  static void m41t80_remove(struct i2c_client *client)
> --
> 2.43.0
>

Re: [PATCH v1] rtc: m41t80: clean up watchdog on probe failure

[Alexandre Mergnat]

On Mon, 01 Jun 2026 15:46:15 -0400, Yuho Choi <dbgh9129@gmail.com> wrote:
> diff --git a/drivers/rtc/rtc-m41t80.c b/drivers/rtc/rtc-m41t80.c
> index b26afef37d9c..f4a30320c6ed 100644
> --- a/drivers/rtc/rtc-m41t80.c
> +++ b/drivers/rtc/rtc-m41t80.c
> @@ -1009,9 +1009,17 @@ static int m41t80_probe(struct i2c_client *client)
>  
>  	rc = devm_rtc_register_device(m41t80_data->rtc);
>  	if (rc)
> -		return rc;
> +		goto err_wdt;

IMHO the right fix is to move the watchdog to the watchdog core.

The leak comes from the watchdog being built on three non-devres
save_client. A probe failure strands all three, after which the watchdog
dereferences freed driver state (wdt_ping() reads
i2c_get_clientdata(save_client), i.e. the devres-freed m41t80_data).

Built on the watchdog core (CONFIG_WATCHDOG_CORE), none of that
machinery is needed:

- devm_watchdog_register_device() unregisters automatically on any probe
  failure and on unbind.
- watchdog_stop_on_reboot() replaces the reboot notifier.
- watchdog_set/get_drvdata() replaces the global save_client, closing
  the use-after-free surface itself.
- m41t80_remove() does nothing but watchdog teardown today, so it goes
  away too.

This is exactly what was done for the sibling driver rtc-ds1374, which
carried the same legacy pattern: d3de4beb14a8 ("rtc: ds1374: wdt: Use
watchdog core for watchdog part"), net -135 lines, adding "select
WATCHDOG_CORE" in Kconfig. It is a usable template.

primitives: a misc device, a reboot notifier, and the global

primitives: a misc device, a reboot notifier, and the global

-- 
Alexandre Mergnat <amergnat@baylibre.com>

Re: [PATCH v1] rtc: m41t80: clean up watchdog on probe failure

[최유호]

On Fri, 26 Jun 2026 at 20:33, Alexandre Mergnat <amergnat@baylibre.com> wrote:
> IMHO the right fix is to move the watchdog to the watchdog core.
>
> The leak comes from the watchdog being built on three non-devres
> save_client. A probe failure strands all three, after which the watchdog
> dereferences freed driver state (wdt_ping() reads
> i2c_get_clientdata(save_client), i.e. the devres-freed m41t80_data).
>
> Built on the watchdog core (CONFIG_WATCHDOG_CORE), none of that
> machinery is needed:
>
> - devm_watchdog_register_device() unregisters automatically on any probe
>   failure and on unbind.
> - watchdog_stop_on_reboot() replaces the reboot notifier.
> - watchdog_set/get_drvdata() replaces the global save_client, closing
>   the use-after-free surface itself.
> - m41t80_remove() does nothing but watchdog teardown today, so it goes
>   away too.
>
> This is exactly what was done for the sibling driver rtc-ds1374, which
> carried the same legacy pattern: d3de4beb14a8 ("rtc: ds1374: wdt: Use
> watchdog core for watchdog part"), net -135 lines, adding "select
> WATCHDOG_CORE" in Kconfig. It is a usable template.
>
> primitives: a misc device, a reboot notifier, and the global

Thanks for the detailed suggestion, Alexandre.

Moving to the watchdog core sounds like a better approach. I will
rework this based on the rtc-ds1374 example and send v2.

Thanks,
Yuho