From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pf1-f175.google.com (mail-pf1-f175.google.com [209.85.210.175]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4A6FB3812EB for ; Wed, 8 Jul 2026 14:06:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.175 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783519602; cv=none; b=g2o/RXL/h577/5V57UTiRqw+b7Y8HNke2qQfLVLeKm1H71yQHJBMgxINRh1VQP1w5p9S9ezRHOA/mkK/vIok8bit7qrIqknwqLe/WCNbkYreLf3RrD4zPch2Vk9rFKERC5MQXbhAKKebCvQj03r9ev4wGH47A4h6eNf/gLr4uNQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783519602; c=relaxed/simple; bh=aXgo+e761iyuCc1PWGxqEqIs/mRUPjvJJfiris3RnFM=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=rKBnrrS+Og5BRd9JL6uHjXyxr2qe/L6tQieD2nbXGfkN9+S2k13i1a6dAFUCgTp6v3tS4TarievnEVhgfRLa7+I7Z4gtfwO9AK+WWgBnML57mKI2jnrNdHSH03oBPkV/RXVZGQuPRSy6cH6uc5hSpwjhXUPbm66VtvqJWZJLYjc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=roeck-us.net; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=JMPKnq0j; arc=none smtp.client-ip=209.85.210.175 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=roeck-us.net Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="JMPKnq0j" Received: by mail-pf1-f175.google.com with SMTP id d2e1a72fcca58-8478cc93299so786277b3a.2 for ; Wed, 08 Jul 2026 07:06:41 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1783519600; x=1784124400; darn=vger.kernel.org; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:sender:from:to:cc:subject:date:message-id :reply-to; bh=dC/nOx9vHqaWylarfPd/ddYlW7L4srZulQ/ldH+lsnI=; b=JMPKnq0jiCYi6USc9opqn4orf8TejlWqhV8WUtXzL4E7ChcvnDEOngt24xVWSzTLM9 iO/3QfNzt4p6sT0koxbOyUaufd7RmeG+H4nB8H6vnybDBRBWZDSIRhKCUX5MA8nC8UhK y8Hr1m91BJwtn3CwAnGR47gPChef/pVeUlVDl503VI3t9mK5HOFIXvTU0th/soo917Vl eBIiOxM/Bd7hNeXVFBNi5zuUGTPyq5g2y49Jo8NTqos1sQXdF1nW30QA8M7TnY2xAlxR XO3xngflFBIpdDizayszQYMc1lfCsJETPBlgpMIWcvanGWp8TXkBpuGg3e6vTMsXD7J0 VBCw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783519600; x=1784124400; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:sender:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=dC/nOx9vHqaWylarfPd/ddYlW7L4srZulQ/ldH+lsnI=; b=lNX/MmEqdLpL3M9hkC0e80M4qVYg35/WOBh0ji7QLbmuKQ0isWd7OZDKK+9ScXH0HX gIF4RMf6ccMrlU4WfvY9Q3XOx2UhF5D8nkEJGkTrVYV42oUSyBN0/rQozoASK2t+0I1X AJoxZcdzgWaZdlqUUL6DBPI3XEdOcUydPkcT4OGGhn9xVSUaNM/BiP/EgGbrTDygw9pJ krGOdApwcT9+xv2YB9I2qzSLiDhJNqAMSsN56SbPV6nyfusjSr+alpBiEmUQuxzNhMPZ wNiYGOGGxh+SOhd/zOgiVE/usrkPXjeg1JVAlU/TvrDJmDDVU4pDWShRk26nHkGkbJkG UyPw== X-Forwarded-Encrypted: i=1; AHgh+RrBorE/pHpQjZ5ucDtv2SZTMPSVmQESclT85gnSHtXh9Dv2bu0C20PGFsuw59YvASZS+sLYkukprx38ik4=@vger.kernel.org X-Gm-Message-State: AOJu0YwaLrHFWe612sHGqhvaagLku2eZrL8l40MtO4lAq6MoqDDvfVhM S2JMikpVGg/Lf+tkWZ37k0o7pSD/CYqhXgBd0zPJIZRLIQeloCXnARdy X-Gm-Gg: AfdE7cmvv89mNqMaOiZ6T/3foq06FWcRyLzGzpSadVfUIebHMyhQQM6ym3CfUyfo7sa 3TGTg6hN+eGWOQ3ypNFPQv8HcU7oUXv0C1c0lIMwbKVAt/X7qaCLkcYPqSWueVehG6w4gccnQRX EuxE7hmIvLK8+z8JkDHWeCyOy/yJ98+Owk6/DMKwkyum0NOhGDAWccKla2lz8+HL2VKp0tGV3lm G4x2dUaBbCjHCAReSlqw1uwdAj/ceckEzaFyDPZgqIP0PPgRRJjWVhhZmFa1EjGBOAqrJwtV273 bBKAFWEP/VTOEpDZP+xqNlVVDDW4UaSVMFmeRmIJHIvu7dSNRoBEQCvgzEZaDGlLpgE0FeEk/mc dvIEsGhxxlfqpqfuXUd+Y/kOgVO9xp/jSf6Hx2bevqJH/iIfnCWznv/FVJHU7ich2JYBVPPq0pi QY2+Wb4UfjGN/dRxy8Vd70nVgP3A== X-Received: by 2002:a05:6a00:928f:b0:847:949e:ea6f with SMTP id d2e1a72fcca58-84842fdf027mr2957927b3a.4.1783519600511; Wed, 08 Jul 2026 07:06:40 -0700 (PDT) Received: from server.roeck-us.net ([2600:1700:e321:62f0:da43:aeff:fecc:bfd5]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-8483d117a1dsm1528804b3a.37.2026.07.08.07.06.39 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 08 Jul 2026 07:06:40 -0700 (PDT) Sender: Guenter Roeck Date: Wed, 8 Jul 2026 07:06:39 -0700 From: Guenter Roeck To: Tzung-Bi Shih Cc: Wim Van Sebroeck , linux-watchdog@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH] watchdog: pretimeout: Fix UAF in watchdog_unregister_governor() Message-ID: <736d014a-5ac8-4ebb-b621-b6ed92693c1a@roeck-us.net> References: <20260707101803.3598173-1-tzungbi@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20260707101803.3598173-1-tzungbi@kernel.org> On Tue, Jul 07, 2026 at 10:18:03AM +0000, Tzung-Bi Shih wrote: > When a watchdog governor is unregistered, it updates existing watchdog > devices that were using this governor by falling back to `default_gov`. > > If the governor being unregistered is currently set as `default_gov`, > the `default_gov` is never cleared. This leads to 2 use-after-free > issues: > 1. New watchdog devices registered after this point will inherit the > dangling `default_gov`. > 2. Existing watchdog devices using the unregistered governor will have > their `wdd->gov` reassigned to the dangling `default_gov`. > > Fix the UAF by clearing `default_gov` if it matches the governor being > unregistered. > > Fixes: da0d12ff2b82 ("watchdog: pretimeout: add panic pretimeout governor") > Signed-off-by: Tzung-Bi Shih Applied. Thanks, Guenter > --- > drivers/watchdog/watchdog_pretimeout.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/drivers/watchdog/watchdog_pretimeout.c b/drivers/watchdog/watchdog_pretimeout.c > index 19eb2ed2c7cb..02e09b9e396d 100644 > --- a/drivers/watchdog/watchdog_pretimeout.c > +++ b/drivers/watchdog/watchdog_pretimeout.c > @@ -167,6 +167,8 @@ void watchdog_unregister_governor(struct watchdog_governor *gov) > } > > spin_lock_irq(&pretimeout_lock); > + if (default_gov == gov) > + default_gov = NULL; > list_for_each_entry(p, &pretimeout_list, entry) > if (p->wdd->gov == gov) > p->wdd->gov = default_gov;