From: Russell King, Tom Rini, Dave Jones
As plugged in 2.4 recently.
Fix some leakage of uninitialised memory to userspace via rtc reads.
25-akpm/arch/cris/arch-v10/drivers/ds1302.c | 1 +
25-akpm/arch/cris/arch-v10/drivers/pcf8563.c | 1 +
25-akpm/arch/m68k/bvme6000/rtc.c | 1 +
25-akpm/arch/m68k/mvme16x/rtc.c | 1 +
25-akpm/arch/ppc64/kernel/rtc.c | 1 +
25-akpm/drivers/acorn/char/i2c.c | 1 +
25-akpm/drivers/char/efirtc.c | 1 +
25-akpm/drivers/char/rtc.c | 3 ++-
25-akpm/drivers/sbus/char/rtc.c | 1 +
9 files changed, 10 insertions(+), 1 deletion(-)
diff -puN arch/cris/arch-v10/drivers/ds1302.c~rtc-leak-fixes arch/cris/arch-v10/drivers/ds1302.c
--- 25/arch/cris/arch-v10/drivers/ds1302.c~rtc-leak-fixes Tue Jan 6 12:26:34 2004
+++ 25-akpm/arch/cris/arch-v10/drivers/ds1302.c Tue Jan 6 12:26:34 2004
@@ -342,6 +342,7 @@ rtc_ioctl(struct inode *inode, struct fi
{
struct rtc_time rtc_tm;
+ memset(&rtc_tm, 0, sizeof (struct rtc_time));
get_rtc_time(&rtc_tm);
if (copy_to_user((struct rtc_time*)arg, &rtc_tm, sizeof(struct rtc_time)))
return -EFAULT;
diff -puN arch/cris/arch-v10/drivers/pcf8563.c~rtc-leak-fixes arch/cris/arch-v10/drivers/pcf8563.c
--- 25/arch/cris/arch-v10/drivers/pcf8563.c~rtc-leak-fixes Tue Jan 6 12:26:34 2004
+++ 25-akpm/arch/cris/arch-v10/drivers/pcf8563.c Tue Jan 6 12:26:34 2004
@@ -219,6 +219,7 @@ pcf8563_ioctl(struct inode *inode, struc
unsigned long flags;
struct rtc_time tm;
+ memset(&tm, 0, sizeof (struct rtc_time));
if (!capable(CAP_SYS_TIME))
return -EPERM;
diff -puN arch/m68k/bvme6000/rtc.c~rtc-leak-fixes arch/m68k/bvme6000/rtc.c
--- 25/arch/m68k/bvme6000/rtc.c~rtc-leak-fixes Tue Jan 6 12:26:34 2004
+++ 25-akpm/arch/m68k/bvme6000/rtc.c Tue Jan 6 12:26:34 2004
@@ -53,6 +53,7 @@ static int rtc_ioctl(struct inode *inode
/* Ensure clock and real-time-mode-register are accessible */
msr = rtc->msr & 0xc0;
rtc->msr = 0x40;
+ memset(&wtime, 0, sizeof(struct rtc_time));
do {
wtime.tm_sec = BCD2BIN(rtc->bcd_sec);
wtime.tm_min = BCD2BIN(rtc->bcd_min);
diff -puN arch/m68k/mvme16x/rtc.c~rtc-leak-fixes arch/m68k/mvme16x/rtc.c
--- 25/arch/m68k/mvme16x/rtc.c~rtc-leak-fixes Tue Jan 6 12:26:34 2004
+++ 25-akpm/arch/m68k/mvme16x/rtc.c Tue Jan 6 12:26:34 2004
@@ -51,6 +51,7 @@ static int rtc_ioctl(struct inode *inode
local_irq_save(flags);
/* Ensure clock and real-time-mode-register are accessible */
rtc->ctrl = RTC_READ;
+ memset(&wtime, 0, sizeof(struct rtc_time));
wtime.tm_sec = BCD2BIN(rtc->bcd_sec);
wtime.tm_min = BCD2BIN(rtc->bcd_min);
wtime.tm_hour = BCD2BIN(rtc->bcd_hr);
diff -puN arch/ppc64/kernel/rtc.c~rtc-leak-fixes arch/ppc64/kernel/rtc.c
--- 25/arch/ppc64/kernel/rtc.c~rtc-leak-fixes Tue Jan 6 12:26:34 2004
+++ 25-akpm/arch/ppc64/kernel/rtc.c Tue Jan 6 12:26:34 2004
@@ -99,6 +99,7 @@ static int rtc_ioctl(struct inode *inode
switch (cmd) {
case RTC_RD_TIME: /* Read the time/date from RTC */
{
+ memset(&wtime, 0, sizeof(struct rtc_time));
ppc_md.get_rtc_time(&wtime);
break;
}
diff -puN drivers/acorn/char/i2c.c~rtc-leak-fixes drivers/acorn/char/i2c.c
--- 25/drivers/acorn/char/i2c.c~rtc-leak-fixes Tue Jan 6 12:26:34 2004
+++ 25-akpm/drivers/acorn/char/i2c.c Tue Jan 6 12:26:34 2004
@@ -167,6 +167,7 @@ static int rtc_ioctl(struct inode *inode
break;
case RTC_RD_TIME:
+ memset(&rtctm, 0, sizeof(struct rtc_time));
get_rtc_time(&rtc_raw, &year);
rtctm.tm_sec = rtc_raw.secs;
rtctm.tm_min = rtc_raw.mins;
diff -puN drivers/char/efirtc.c~rtc-leak-fixes drivers/char/efirtc.c
--- 25/drivers/char/efirtc.c~rtc-leak-fixes Tue Jan 6 12:26:34 2004
+++ 25-akpm/drivers/char/efirtc.c Tue Jan 6 12:26:34 2004
@@ -118,6 +118,7 @@ convert_to_efi_time(struct rtc_time *wti
static void
convert_from_efi_time(efi_time_t *eft, struct rtc_time *wtime)
{
+ memset(wtime, 0, sizeof(*wtime));
wtime->tm_sec = eft->second;
wtime->tm_min = eft->minute;
wtime->tm_hour = eft->hour;
diff -puN drivers/char/rtc.c~rtc-leak-fixes drivers/char/rtc.c
--- 25/drivers/char/rtc.c~rtc-leak-fixes Tue Jan 6 12:26:34 2004
+++ 25-akpm/drivers/char/rtc.c Tue Jan 6 12:26:34 2004
@@ -431,7 +431,7 @@ static int rtc_do_ioctl(unsigned int cmd
* means "don't care" or "match all". Only the tm_hour,
* tm_min, and tm_sec values are filled in.
*/
-
+ memset(&wtime, 0, sizeof(struct rtc_time));
get_rtc_alm_time(&wtime);
break;
}
@@ -481,6 +481,7 @@ static int rtc_do_ioctl(unsigned int cmd
}
case RTC_RD_TIME: /* Read the time/date from RTC */
{
+ memset(&wtime, 0, sizeof(struct rtc_time));
rtc_get_rtc_time(&wtime);
break;
}
diff -puN drivers/sbus/char/rtc.c~rtc-leak-fixes drivers/sbus/char/rtc.c
--- 25/drivers/sbus/char/rtc.c~rtc-leak-fixes Tue Jan 6 12:26:34 2004
+++ 25-akpm/drivers/sbus/char/rtc.c Tue Jan 6 12:26:34 2004
@@ -89,6 +89,7 @@ static int rtc_ioctl(struct inode *inode
switch (cmd)
{
case RTCGET:
+ memset(&rtc_tm, 0, sizeof(struct rtc_time));
get_rtc_time(&rtc_tm);
if (copy_to_user((struct rtc_time*)arg, &rtc_tm, sizeof(struct rtc_time)))
_