watchdog: unregister PM notifier on watchdog unregister

watchdog_register_device() registers wdd->pm_nb when
WDOG_NO_PING_ON_SUSPEND is set, but watchdog_unregister_device() does not
remove it. This leaves an embedded notifier block on the PM notifier chain
after the watchdog device has been unregistered.

A later suspend/resume notification can then call watchdog_pm_notifier()
with a stale watchdog_device pointer, or at minimum after wdd->wd_data has
been cleared by watchdog_dev_unregister().

Unregister the PM notifier before tearing down the watchdog device.

Fixes: 60bcd91aafd2 ("watchdog: introduce watchdog_dev_suspend/resume")
Signed-off-by: Yuho Choi <dbgh9129@gmail.com>
Link: https://lore.kernel.org/r/20260601192005.1970805-1-dbgh9129@gmail.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>

diff --git a/drivers/watchdog/watchdog_core.c b/drivers/watchdog/watchdog_core.c
index 866874b268191836ae6d0e695b50fd15d9b99ad3..f4097aefaf4914e2777ae4c7cf1debc994baff0f 100644 (file)
--- a/drivers/watchdog/watchdog_core.c
+++ b/drivers/watchdog/watchdog_core.c
@@ -391,6 +391,9 @@ static void __watchdog_unregister_device(struct watchdog_device *wdd)
        if (test_bit(WDOG_STOP_ON_REBOOT, &wdd->status))
                unregister_reboot_notifier(&wdd->reboot_nb);
 
+       if (test_bit(WDOG_NO_PING_ON_SUSPEND, &wdd->status))
+               unregister_pm_notifier(&wdd->pm_nb);
+
        watchdog_dev_unregister(wdd);
        ida_free(&watchdog_ida, wdd->id);
 }