On 8/23/26 20:04, Yuri Zaporozhets wrote: > wdt_start() registers a cyclic_info that lives inside the watchdog > device's uclass private data, and nothing ever takes it off > gd->cyclic_list again. device_remove() frees that private data > (per_device_auto), so from the moment a watchdog device is removed the > cyclic list holds a node in freed memory. The next schedule() walks it > and calls through cyclic->func, which by then contains whatever the > allocator has since put there. > > efi_exit_boot_services() makes that reliable rather than rare: it calls > dm_remove_devices_active(), and U-Boot keeps running for a good while > afterwards, so on a board with a watchdog every EFI payload hand-off > leaves a dangling cyclic behind. Whether it is fatal depends only on > whether something reuses the chunk, which is what lets it hide on a > board that is otherwise perfectly healthy. > > On a SpacemiT K3 it stayed invisible until an unrelated controller was > switched on in the firmware's setup. That changed the heap enough for > the ExitBootServices teardown to reuse the freed wdt_priv and zero > cyclic->func, and the next schedule() jumped to address 0: > > Unhandled exception: Instruction access fault > EPC: 0000000000000000 RA: 00000004fdf4c242 TVAL: 0000000000000000 > EPC: fffffffc040d3000 RA: 000000010201f242 reloc adjusted > > with the return address inside cyclic_run(). Switching that unrelated > controller back off made the boot work again, which is most of why it > looked like anything but a use-after-free. > > Add a wdt uclass .pre_remove that unregisters the cyclic before the > memory goes, mirroring what the mmc uclass already does through > mmc_remove() -> mmc_deinit(). The hardware watchdog is deliberately left > running: whether an OS should inherit an armed watchdog is a separate > policy question, not part of fixing a dangling pointer. > > Signed-off-by: Yuri Zaporozhets <[email protected]>
Applied to u-boot-watchdog/next, with a fixup while applying: [sr: use the vodafonemail.de address in the SoB, as requested by Yuri] Thanks, Stefan
