From: Madhuparna Bhowmik <madhuparnabhowmi...@gmail.com>

In rdc321x_wdt_probe(), rdc321x_wdt_device.queue is initialized
after misc_register(), hence if ioctl is called before its
initialization which can call rdc321x_wdt_start() function,
it will see an uninitialized value of rdc321x_wdt_device.queue,
hence initialize it before misc_register().
Also, rdc321x_wdt_device.default_ticks is accessed in reset()
function called from write callback, thus initialize it before
misc_register().

Found by Linux Driver Verification project (linuxtesting.org).

Signed-off-by: Madhuparna Bhowmik <madhuparnabhowmi...@gmail.com>
---
 drivers/watchdog/rdc321x_wdt.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/drivers/watchdog/rdc321x_wdt.c b/drivers/watchdog/rdc321x_wdt.c
index 57187efeb86f..f0c94ea51c3e 100644
--- a/drivers/watchdog/rdc321x_wdt.c
+++ b/drivers/watchdog/rdc321x_wdt.c
@@ -231,6 +231,8 @@ static int rdc321x_wdt_probe(struct platform_device *pdev)
 
        rdc321x_wdt_device.sb_pdev = pdata->sb_pdev;
        rdc321x_wdt_device.base_reg = r->start;
+       rdc321x_wdt_device.queue = 0;
+       rdc321x_wdt_device.default_ticks = ticks;
 
        err = misc_register(&rdc321x_wdt_misc);
        if (err < 0) {
@@ -245,14 +247,11 @@ static int rdc321x_wdt_probe(struct platform_device *pdev)
                                rdc321x_wdt_device.base_reg, RDC_WDT_RST);
 
        init_completion(&rdc321x_wdt_device.stop);
-       rdc321x_wdt_device.queue = 0;
 
        clear_bit(0, &rdc321x_wdt_device.inuse);
 
        timer_setup(&rdc321x_wdt_device.timer, rdc321x_wdt_trigger, 0);
 
-       rdc321x_wdt_device.default_ticks = ticks;
-
        dev_info(&pdev->dev, "watchdog init success\n");
 
        return 0;
-- 
2.17.1

Reply via email to