linux-kernel - [PATCH v2] ntp: Make sure RTC is synchronized for any time jump

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20241027174335.60261-1-dev@benjarobin.fr>
Date: Sun, 27 Oct 2024 18:43:35 +0100
From: Benjamin ROBIN <dev@...jarobin.fr>
To: jstultz@...gle.com,
	tglx@...utronix.de
Cc: sboyd@...nel.org,
	linux-kernel@...r.kernel.org,
	Benjamin ROBIN <dev@...jarobin.fr>
Subject: [PATCH v2] ntp: Make sure RTC is synchronized for any time jump

Follow-up of commit 35b603f8a78b ("ntp: Make sure RTC is synchronized
when time goes backwards").

sync_hw_clock() is normally called every 11 minutes when time is
synchronized. This issue is that this periodic timer uses the REALTIME
clock, so when time moves backwards, the timer expires late.

If the timer expires late, which can be days later, the RTC will no longer
be updated, which is an issue if the device is abruptly powered OFF during
this period. When the device will restart (when powered ON), it will have
the date prior to the time jump.

This follow-up handles all kernel API (syscall) that can trigger a time
jump. Cancel periodic timer on any time jump, if and only if STA_UNSYNC
flag was previously set (net_clear() was called).

The timer will be relaunched at the end of ntp_notify_cmos_timer() if
NTP is synced again somehow: This is possible since stopping the timer is
done outside of a locked section. Otherwise the timer will be relaunched
later when NTP is synced. This way, when the time is synchronized again,
the RTC is updated after less than 2 seconds.

Signed-off-by: Benjamin ROBIN <dev@...jarobin.fr>
---
 kernel/time/ntp.c          | 10 +++++-----
 kernel/time/ntp_internal.h |  4 ++--
 kernel/time/timekeeping.c  | 11 ++++++++---
 3 files changed, 15 insertions(+), 10 deletions(-)

diff --git a/kernel/time/ntp.c b/kernel/time/ntp.c
index b550ebe0f03b..d91074633c83 100644
--- a/kernel/time/ntp.c
+++ b/kernel/time/ntp.c
@@ -657,14 +657,14 @@ static void sync_hw_clock(struct work_struct *work)
 	sched_sync_hw_clock(offset_nsec, res != 0);
 }
 
-void ntp_notify_cmos_timer(bool offset_set)
+void ntp_notify_cmos_timer(bool ntp_was_cleared)
 {
 	/*
-	 * If the time jumped (using ADJ_SETOFFSET) cancels sync timer,
-	 * which may have been running if the time was synchronized
-	 * prior to the ADJ_SETOFFSET call.
+	 * If time jumped (clock set), and if ntp_clear() was called,
+	 * cancels sync timer, which may have been running if time was
+	 * previously synchronized.
 	 */
-	if (offset_set)
+	if (ntp_was_cleared)
 		hrtimer_cancel(&sync_hrtimer);
 
 	/*
diff --git a/kernel/time/ntp_internal.h b/kernel/time/ntp_internal.h
index 5a633dce9057..0615ed904119 100644
--- a/kernel/time/ntp_internal.h
+++ b/kernel/time/ntp_internal.h
@@ -14,9 +14,9 @@ extern int __do_adjtimex(struct __kernel_timex *txc,
 extern void __hardpps(const struct timespec64 *phase_ts, const struct timespec64 *raw_ts);
 
 #if defined(CONFIG_GENERIC_CMOS_UPDATE) || defined(CONFIG_RTC_SYSTOHC)
-extern void ntp_notify_cmos_timer(bool offset_set);
+extern void ntp_notify_cmos_timer(bool ntp_was_cleared);
 #else
-static inline void ntp_notify_cmos_timer(bool offset_set) { }
+static inline void ntp_notify_cmos_timer(bool ntp_was_cleared) { }
 #endif
 
 #endif /* _LINUX_NTP_INTERNAL_H */
diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
index 17cae886ca82..e44e500b694c 100644
--- a/kernel/time/timekeeping.c
+++ b/kernel/time/timekeeping.c
@@ -1536,6 +1536,7 @@ int do_settimeofday64(const struct timespec64 *ts)
 
 	/* Signal hrtimers about time change */
 	clock_was_set(CLOCK_SET_WALL);
+	ntp_notify_cmos_timer(true);
 
 	audit_tk_injoffset(ts_delta);
 	add_device_randomness(ts, sizeof(*ts));
@@ -1575,6 +1576,7 @@ static int timekeeping_inject_offset(const struct timespec64 *ts)
 
 	/* Signal hrtimers about time change */
 	clock_was_set(CLOCK_SET_WALL);
+	ntp_notify_cmos_timer(true);
 	return 0;
 }
 
@@ -1936,6 +1938,7 @@ void timekeeping_inject_sleeptime64(const struct timespec64 *delta)
 
 	/* Signal hrtimers about time change */
 	clock_was_set(CLOCK_SET_WALL | CLOCK_SET_BOOT);
+	ntp_notify_cmos_timer(true);
 }
 #endif
 
@@ -2658,7 +2661,6 @@ EXPORT_SYMBOL_GPL(random_get_entropy_fallback);
 int do_adjtimex(struct __kernel_timex *txc)
 {
 	struct audit_ntp_data ad;
-	bool offset_set = false;
 	bool clock_set = false;
 	struct timespec64 ts;
 	int ret;
@@ -2680,7 +2682,6 @@ int do_adjtimex(struct __kernel_timex *txc)
 		if (ret)
 			return ret;
 
-		offset_set = delta.tv_sec != 0;
 		audit_tk_injoffset(delta);
 	}
 
@@ -2714,7 +2715,11 @@ int do_adjtimex(struct __kernel_timex *txc)
 	if (clock_set)
 		clock_was_set(CLOCK_SET_WALL);
 
-	ntp_notify_cmos_timer(offset_set);
+	/* Time jump (ADJ_SETOFFSET) is handled by timekeeping_inject_offset(),
+	 * which calls ntp_notify_cmos_timer() to cancel NTP sync hrtimer.
+	 * For the rest of do_adjtimex(), NTP sync flag is not cleared, so no
+	 * need to cancel NTP sync hrtimer here. */
+	ntp_notify_cmos_timer(false);
 
 	return ret;
 }
-- 
2.47.0