Commit 5bf2b41d authored by Yongliang Gao's avatar Yongliang Gao Committed by Zeng Heng
Browse files

rtc: check if __rtc_read_time was successful in rtc_timer_do_work() 

stable inclusion
from stable-v6.6.64
commit dd4b1cbcc916fad5d10c2662b62def9f05e453d4
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEGFG
CVE: CVE-2024-56739

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=dd4b1cbcc916fad5d10c2662b62def9f05e453d4



--------------------------------

[ Upstream commit e8ba8a2bc4f60a1065f23d6a0e7cbea945a0f40d ]

If the __rtc_read_time call fails,, the struct rtc_time tm; may contain
uninitialized data, or an illegal date/time read from the RTC hardware.

When calling rtc_tm_to_ktime later, the result may be a very large value
(possibly KTIME_MAX). If there are periodic timers in rtc->timerqueue,
they will continually expire, may causing kernel softlockup.

Fixes: 6610e089 ("RTC: Rework RTC code to use timerqueue for events")
Signed-off-by: default avatarYongliang Gao <leonylgao@tencent.com>
Acked-by: default avatarJingqun Li <jingqunli@tencent.com>
Link: https://lore.kernel.org/r/20241011043153.3788112-1-leonylgao@gmail.com


Signed-off-by: default avatarAlexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarZeng Heng <zengheng4@huawei.com>
parent 9be6ae39

drivers/rtc/interface.c

+6 −1
Original line number Diff line number Diff line
@@ -908,13 +908,18 @@ void rtc_timer_do_work(struct work_struct *work) 
	struct timerqueue_node *next;

	ktime_t now;

	struct rtc_time tm;

	int err;



	struct rtc_device *rtc =

		container_of(work, struct rtc_device, irqwork);



	mutex_lock(&rtc->ops_lock);

again:

	__rtc_read_time(rtc, &tm);

	err = __rtc_read_time(rtc, &tm);

	if (err) {

		mutex_unlock(&rtc->ops_lock);

		return;

	}

	now = rtc_tm_to_ktime(tm);

	while ((next = timerqueue_getnext(&rtc->timerqueue))) {

		if (next->expires > now)