[PATCH] RTC leaks.

From: Russell King, Tom Rini, Dave Jones

As plugged in 2.4 recently.

Fix some leakage of uninitialised memory to userspace via rtc reads.

diff --git a/arch/cris/arch-v10/drivers/ds1302.c b/arch/cris/arch-v10/drivers/ds1302.c
index 1750621337241b9f80a029cb76a0ee38ed8a4688..b244f40cd6cb1e941ed1949662c93d04a61f5e93 100644 (file)
--- a/arch/cris/arch-v10/drivers/ds1302.c
+++ b/arch/cris/arch-v10/drivers/ds1302.c
@@ -342,6 +342,7 @@ rtc_ioctl(struct inode *inode, struct file *file, unsigned int cmd,
                {
                        struct rtc_time rtc_tm;
                                                
+                       memset(&rtc_tm, 0, sizeof (struct rtc_time));
                        get_rtc_time(&rtc_tm);                                          
                        if (copy_to_user((struct rtc_time*)arg, &rtc_tm, sizeof(struct rtc_time)))
                                return -EFAULT; 

diff --git a/arch/cris/arch-v10/drivers/pcf8563.c b/arch/cris/arch-v10/drivers/pcf8563.c
index 7738454898dde9f23b4ce7022d856ac1a84b4536..66e87cc7a4fdba0020bb094e55a5c7901516784f 100644 (file)
--- a/arch/cris/arch-v10/drivers/pcf8563.c
+++ b/arch/cris/arch-v10/drivers/pcf8563.c
@@ -219,6 +219,7 @@ pcf8563_ioctl(struct inode *inode, struct file *filp, unsigned int cmd, unsigned
                                unsigned long flags;
                                struct rtc_time tm;
 
+                               memset(&tm, 0, sizeof (struct rtc_time));
                                if (!capable(CAP_SYS_TIME))
                                        return -EPERM;
 

diff --git a/arch/m68k/bvme6000/rtc.c b/arch/m68k/bvme6000/rtc.c
index 50a5420d9e16eaeea0d2f16af335f5322ca5edf0..201b66e0086373cd41100e8fa22f3d9d85d5f08e 100644 (file)
--- a/arch/m68k/bvme6000/rtc.c
+++ b/arch/m68k/bvme6000/rtc.c
@@ -53,6 +53,7 @@ static int rtc_ioctl(struct inode *inode, struct file *file, unsigned int cmd,
                /* Ensure clock and real-time-mode-register are accessible */
                msr = rtc->msr & 0xc0;
                rtc->msr = 0x40;
+               memset(&wtime, 0, sizeof(struct rtc_time));
                do {
                        wtime.tm_sec =  BCD2BIN(rtc->bcd_sec);
                        wtime.tm_min =  BCD2BIN(rtc->bcd_min);

diff --git a/arch/m68k/mvme16x/rtc.c b/arch/m68k/mvme16x/rtc.c
index 2869be097e69a51383e8127cc301b79d1a0d805a..1196442f80dcf05b2ba4e8cabfe2e3c3784a3e46 100644 (file)
--- a/arch/m68k/mvme16x/rtc.c
+++ b/arch/m68k/mvme16x/rtc.c
@@ -51,6 +51,7 @@ static int rtc_ioctl(struct inode *inode, struct file *file, unsigned int cmd,
                local_irq_save(flags);
                /* Ensure clock and real-time-mode-register are accessible */
                rtc->ctrl = RTC_READ;
+               memset(&wtime, 0, sizeof(struct rtc_time));
                wtime.tm_sec =  BCD2BIN(rtc->bcd_sec);
                wtime.tm_min =  BCD2BIN(rtc->bcd_min);
                wtime.tm_hour = BCD2BIN(rtc->bcd_hr);

diff --git a/arch/ppc64/kernel/rtc.c b/arch/ppc64/kernel/rtc.c
index 938c78f27a0b367c147f53ce330139647e374acc..eff800053c342ecffa23cfa8cb6e28a65291244a 100644 (file)
--- a/arch/ppc64/kernel/rtc.c
+++ b/arch/ppc64/kernel/rtc.c
@@ -99,6 +99,7 @@ static int rtc_ioctl(struct inode *inode, struct file *file, unsigned int cmd,
        switch (cmd) {
        case RTC_RD_TIME:       /* Read the time/date from RTC  */
        {
+               memset(&wtime, 0, sizeof(struct rtc_time));
                ppc_md.get_rtc_time(&wtime);
                break;
        }

diff --git a/drivers/acorn/char/i2c.c b/drivers/acorn/char/i2c.c
index b8d9ac66a2f93ba228e2dfdad5c572a5dca56f8e..997cf28f4b7527a3491a610b40b0e5df0358b160 100644 (file)
--- a/drivers/acorn/char/i2c.c
+++ b/drivers/acorn/char/i2c.c
@@ -167,6 +167,7 @@ static int rtc_ioctl(struct inode *inode, struct file *file,
                break;
 
        case RTC_RD_TIME:
+               memset(&rtctm, 0, sizeof(struct rtc_time));
                get_rtc_time(&rtc_raw, &year);
                rtctm.tm_sec  = rtc_raw.secs;
                rtctm.tm_min  = rtc_raw.mins;

diff --git a/drivers/char/efirtc.c b/drivers/char/efirtc.c
index 569f12605e0df439454165f5d6c8983ec365e257..893716b679bc1c3cfe4c4128c7c30a34f735c814 100644 (file)
--- a/drivers/char/efirtc.c
+++ b/drivers/char/efirtc.c
@@ -118,6 +118,7 @@ convert_to_efi_time(struct rtc_time *wtime, efi_time_t *eft)
 static void
 convert_from_efi_time(efi_time_t *eft, struct rtc_time *wtime)
 {
+       memset(wtime, 0, sizeof(*wtime));
        wtime->tm_sec  = eft->second;
        wtime->tm_min  = eft->minute;
        wtime->tm_hour = eft->hour;

diff --git a/drivers/char/rtc.c b/drivers/char/rtc.c
index fcdc4eb0b9acd6a38950dd20f45e868985ccca32..dfe289eaef61cc54f9860c31d717745e2483cfd0 100644 (file)
--- a/drivers/char/rtc.c
+++ b/drivers/char/rtc.c
@@ -431,7 +431,7 @@ static int rtc_do_ioctl(unsigned int cmd, unsigned long arg, int kernel)
                 * means "don't care" or "match all". Only the tm_hour,
                 * tm_min, and tm_sec values are filled in.
                 */
-
+               memset(&wtime, 0, sizeof(struct rtc_time));
                get_rtc_alm_time(&wtime);
                break; 
        }
@@ -481,6 +481,7 @@ static int rtc_do_ioctl(unsigned int cmd, unsigned long arg, int kernel)
        }
        case RTC_RD_TIME:       /* Read the time/date from RTC  */
        {
+               memset(&wtime, 0, sizeof(struct rtc_time));
                rtc_get_rtc_time(&wtime);
                break;
        }

diff --git a/drivers/sbus/char/rtc.c b/drivers/sbus/char/rtc.c
index 9def3233a56f016f2fcafc878e4ddd9c4f0fcba7..2d6f684774eca7a14c7e741f22ae10aa4d6dede2 100644 (file)
--- a/drivers/sbus/char/rtc.c
+++ b/drivers/sbus/char/rtc.c
@@ -89,6 +89,7 @@ static int rtc_ioctl(struct inode *inode, struct file *file, unsigned int cmd,
        switch (cmd)
        {
        case RTCGET:
+               memset(&rtc_tm, 0, sizeof(struct rtc_time));
                get_rtc_time(&rtc_tm);
 
                if (copy_to_user((struct rtc_time*)arg, &rtc_tm, sizeof(struct rtc_time)))