| From 9eac9e5c6a4f59d1346b9c3645e2140001e3c728 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Thu, 27 Aug 2026 09:54:44 +0800 |
| Subject: rtc: dev: zero-initialize struct rtc_wkalrm to prevent information |
| leak |
| |
| From: Liu Dalin <liudalin@kylinsec.com.cn> |
| |
| [ Upstream commit 0ee5c5d804d592a8328a425b9274487d393d3a05 ] |
| |
| The struct rtc_wkalrm has padding holes after the 'pending' member. |
| When returned to userspace via the RTC_WKALRM_RD ioctl, uninitialized |
| kernel stack data residing in these holes may be leaked. |
| |
| Zero-initialize the struct at declaration to eliminate this information |
| leak risk. |
| |
| Fixes smatch warnings: |
| - drivers/rtc/dev.c:392 rtc_dev_ioctl() warn: check that 'alarm' doesn't |
| leak information (struct has a hole after 'pending') |
| |
| Fixes: 36e14f5fdfdf ("rtc: rename core files") |
| Assisted-by: smatch:2.0 [static analysis] |
| Signed-off-by: Liu Dalin <liudalin@kylinsec.com.cn> |
| Link: https://patch.msgid.link/B28B7DE18F3A9447+20260827015444.3314227-1-liudalin@kylinsec.com.cn |
| Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/rtc/dev.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| diff --git a/drivers/rtc/dev.c b/drivers/rtc/dev.c |
| index 4aad9bb998683..8ff910017b105 100644 |
| --- a/drivers/rtc/dev.c |
| +++ b/drivers/rtc/dev.c |
| @@ -207,7 +207,7 @@ static long rtc_dev_ioctl(struct file *file, |
| struct rtc_device *rtc = file->private_data; |
| const struct rtc_class_ops *ops = rtc->ops; |
| struct rtc_time tm; |
| - struct rtc_wkalrm alarm; |
| + struct rtc_wkalrm alarm = { 0 }; |
| struct rtc_param param; |
| void __user *uarg = (void __user *)arg; |
| |
| -- |
| 2.53.0 |
| |
