| From 5275439638319b5bf0382be24d66726460d0587f Mon Sep 17 00:00:00 2001 | |
| From: Sasha Levin <sashal@kernel.org> | |
| Date: Thu, 27 Aug 2026 09:54:44 +0800 | |
| Subject: rtc: dev: zero-initialize struct rtc_wkalrm to prevent information | |
| leak | |
| From: Liu Dalin <liudalin@kylinsec.com.cn> | |
| [ Upstream commit 0ee5c5d804d592a8328a425b9274487d393d3a05 ] | |
| The struct rtc_wkalrm has padding holes after the 'pending' member. | |
| When returned to userspace via the RTC_WKALRM_RD ioctl, uninitialized | |
| kernel stack data residing in these holes may be leaked. | |
| Zero-initialize the struct at declaration to eliminate this information | |
| leak risk. | |
| Fixes smatch warnings: | |
| - drivers/rtc/dev.c:392 rtc_dev_ioctl() warn: check that 'alarm' doesn't | |
| leak information (struct has a hole after 'pending') | |
| Fixes: 36e14f5fdfdf ("rtc: rename core files") | |
| Assisted-by: smatch:2.0 [static analysis] | |
| Signed-off-by: Liu Dalin <liudalin@kylinsec.com.cn> | |
| Link: https://patch.msgid.link/B28B7DE18F3A9447+20260827015444.3314227-1-liudalin@kylinsec.com.cn | |
| Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> | |
| Signed-off-by: Sasha Levin <sashal@kernel.org> | |
| --- | |
| drivers/rtc/dev.c | 2 +- | |
| 1 file changed, 1 insertion(+), 1 deletion(-) | |
| diff --git a/drivers/rtc/dev.c b/drivers/rtc/dev.c | |
| index c4a3ab53dcd4b..747408244424a 100644 | |
| --- a/drivers/rtc/dev.c | |
| +++ b/drivers/rtc/dev.c | |
| @@ -207,7 +207,7 @@ static long rtc_dev_ioctl(struct file *file, | |
| struct rtc_device *rtc = file->private_data; | |
| const struct rtc_class_ops *ops = rtc->ops; | |
| struct rtc_time tm; | |
| - struct rtc_wkalrm alarm; | |
| + struct rtc_wkalrm alarm = { 0 }; | |
| struct rtc_param param; | |
| void __user *uarg = (void __user *)arg; | |
| -- | |
| 2.53.0 | |