linux-kernel - [PATCH 1/1] rtc: add century field data boundary

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Wed,  5 Oct 2016 11:48:16 -0700
From:   Andrew Kim <andrew.kim@...el.com>
To:     linux-kernel@...r.kernel.org
Subject: [PATCH 1/1] rtc: add century field data boundary

According to ACPI specification, the century field data
should be ranged 0-63. so if it's over this range, it could
cause system RTC settings error including alarmwakeup settings.
So it's required to have this boundary for safe RTC init settings.

Signed-off-by: Andrew Kim <andrew.kim@...el.com>
---
 arch/x86/kernel/rtc.c          | 5 ++++-
 drivers/rtc/rtc-mc146818-lib.c | 5 ++++-
 include/linux/mc146818rtc.h    | 2 ++
 3 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/arch/x86/kernel/rtc.c b/arch/x86/kernel/rtc.c
index 79c6311c..795a9ab 100644
--- a/arch/x86/kernel/rtc.c
+++ b/arch/x86/kernel/rtc.c
@@ -84,8 +84,11 @@ void mach_get_cmos_time(struct timespec *now)
 
 #ifdef CONFIG_ACPI
 	if (acpi_gbl_FADT.header.revision >= FADT2_REVISION_ID &&
-	    acpi_gbl_FADT.century)
+	    acpi_gbl_FADT.century) {
 		century = CMOS_READ(acpi_gbl_FADT.century);
+		if (century > RTC_CENTURY_LIMIT)
+			century = 0;
+	}
 #endif
 
 	status = CMOS_READ(RTC_CONTROL);
diff --git a/drivers/rtc/rtc-mc146818-lib.c b/drivers/rtc/rtc-mc146818-lib.c
index 2f1772a..81eb2a2 100644
--- a/drivers/rtc/rtc-mc146818-lib.c
+++ b/drivers/rtc/rtc-mc146818-lib.c
@@ -61,8 +61,11 @@ unsigned int mc146818_get_time(struct rtc_time *time)
 #endif
 #ifdef CONFIG_ACPI
 	if (acpi_gbl_FADT.header.revision >= FADT2_REVISION_ID &&
-	    acpi_gbl_FADT.century)
+	    acpi_gbl_FADT.century) {
 		century = CMOS_READ(acpi_gbl_FADT.century);
+		if (century > RTC_CENTURY_LIMIT)
+			century = 0;
+	}
 #endif
 	ctrl = CMOS_READ(RTC_CONTROL);
 	spin_unlock_irqrestore(&rtc_lock, flags);
diff --git a/include/linux/mc146818rtc.h b/include/linux/mc146818rtc.h
index a585b4b..199065a 100644
--- a/include/linux/mc146818rtc.h
+++ b/include/linux/mc146818rtc.h
@@ -122,6 +122,8 @@ struct cmos_rtc_board_info {
 #define RTC_IO_EXTENT_USED      RTC_IO_EXTENT
 #endif /* ARCH_RTC_LOCATION */
 
+#define RTC_CENTURY_LIMIT 0x3F
+
 unsigned int mc146818_get_time(struct rtc_time *time);
 int mc146818_set_time(struct rtc_time *time);
 
-- 
1.9.1