linux-kernel - [PATCH] rtc: fix uninitialized read of rtc

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20231129073647.2624497-1-nicholas@linux.ibm.com>
Date:   Wed, 29 Nov 2023 07:36:47 +0000
From:   Nicholas Miehlbradt <nicholas@...ux.ibm.com>
To:     a.zummo@...ertech.it, alexandre.belloni@...tlin.com
Cc:     linux-rtc@...r.kernel.org, linux-kernel@...r.kernel.org,
        Nicholas Miehlbradt <nicholas@...ux.ibm.com>
Subject: [PATCH] rtc: fix uninitialized read of rtc_wkalrm.time

If either of the first two branches of the if statement in
rtc_read_alarm_internal are taken the fields of alarm->time are not
initialized but are subsequently read by the call to rtc_tm_to_time64.

Refactor so that the time field is only read if the final branch of the
if statment which initializes the field is taken.

Signed-off-by: Nicholas Miehlbradt <nicholas@...ux.ibm.com>
---
 drivers/rtc/interface.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/rtc/interface.c b/drivers/rtc/interface.c
index 1b63111cdda2..f40e76d2fe2b 100644
--- a/drivers/rtc/interface.c
+++ b/drivers/rtc/interface.c
@@ -179,6 +179,7 @@ static int rtc_read_alarm_internal(struct rtc_device *rtc,
 				   struct rtc_wkalrm *alarm)
 {
 	int err;
+	time64_t trace_time = -1;
 
 	err = mutex_lock_interruptible(&rtc->ops_lock);
 	if (err)
@@ -201,11 +202,12 @@ static int rtc_read_alarm_internal(struct rtc_device *rtc,
 		alarm->time.tm_yday = -1;
 		alarm->time.tm_isdst = -1;
 		err = rtc->ops->read_alarm(rtc->dev.parent, alarm);
+		trace_time = rtc_tm_to_time64(&alarm->time);
 	}
 
 	mutex_unlock(&rtc->ops_lock);
 
-	trace_rtc_read_alarm(rtc_tm_to_time64(&alarm->time), err);
+	trace_rtc_read_alarm(trace_time, err);
 	return err;
 }
 
-- 
2.37.2