Patch "watchdog: Fix potential kref imbalance when opening watchdog" has been added to the 4.15-stable tree

This is a note to let you know that I've just added the patch titled

watchdog: Fix potential kref imbalance when opening watchdog

to the 4.15-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
watchdog-fix-potential-kref-imbalance-when-opening-watchdog.patch
and it can be found in the queue-4.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Guenter Roeck <[email protected]>
Date: Mon, 25 Sep 2017 09:17:01 -0700
Subject: watchdog: Fix potential kref imbalance when opening watchdog

From: Guenter Roeck <[email protected]>

[ Upstream commit 4bcd615fad6adddc68b058d498b30a9e0e0db77a ]

If a watchdog driver's open function sets WDOG_HW_RUNNING with the expectation that the watchdog can not be stopped, but then stops the watchdog anyway in its stop function, kref_get() wil not be called in watchdog_open(). If the watchdog then stops on close, WDOG_HW_RUNNING will be cleared and kref_put() will be called, causing a kref imbalance. As result the character device data structure will be released, which in turn will cause the system to crash on the next call to watchdog_open().

---
 drivers/watchdog/watchdog_dev.c |    6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

@@ -769,6 +769,7 @@ static int watchdog_open(struct inode *i
 {
 	struct watchdog_core_data *wd_data;
 	struct watchdog_device *wdd;
+	bool hw_running;
 	int err;
 
 	/* Get the corresponding watchdog device */

@@ -788,7 +789,8 @@ static int watchdog_open(struct inode *i
 	 * If the /dev/watchdog device is open, we don't want the module
 	 * to be unloaded.
 	 */
-	if (!watchdog_hw_running(wdd) && !try_module_get(wdd->ops->owner)) {
+	hw_running = watchdog_hw_running(wdd);
+	if (!hw_running && !try_module_get(wdd->ops->owner)) {
 		err = -EBUSY;
 		goto out_clear;
 	}

@@ -799,7 +801,7 @@ static int watchdog_open(struct inode *i
 
 	file->private_data = wd_data;
 
-	if (!watchdog_hw_running(wdd))
+	if (!hw_running)
 		kref_get(&wd_data->kref);
 
 	/* dev/watchdog is a virtual (and thus non-seekable) filesystem */

Patches currently in stable-queue which might be from [email protected] are

queue-4.15/watchdog-fix-potential-kref-imbalance-when-opening-watchdog.patch queue-4.15/watchdog-fix-kref-imbalance-seen-if-handle_boot_enabled-0.patch