watchdog: Unregister cyclic on device removal

When a watchdog device is destroyed, the cyclic_info embedded in the
device's private data is freed but remains in the global cyclic list.
The subsequent cyclic_unregister_all() call then accesses freed memory,
causing a crash.

Add a pre_remove hook to the watchdog uclass to unregister the cyclic
function before the device is destroyed.

Co-developed-by: Claude <noreply@anthropic.com>
Signed-off-by: Simon Glass <simon.glass@canonical.com>

drivers/watchdog/wdt-uclass.c

@@ -256,10 +256,21 @@ static int wdt_pre_probe(struct udevice *dev)
 	return 0;
 }
 
+static int wdt_pre_remove(struct udevice *dev)
+{
+	struct wdt_priv *priv = dev_get_uclass_priv(dev);
+
+	if (IS_ENABLED(CONFIG_WATCHDOG) && priv->running)
+		cyclic_unregister(&priv->cyclic);
+
+	return 0;
+}
+
 UCLASS_DRIVER(wdt) = {
 	.id			= UCLASS_WDT,
 	.name			= "watchdog",
 	.flags			= DM_UC_FLAG_SEQ_ALIAS,
 	.pre_probe		= wdt_pre_probe,
+	.pre_remove		= wdt_pre_remove,
 	.per_device_auto	= sizeof(struct wdt_priv),
 };