Commit 6e85bab6 authored by Jan Beulich's avatar Jan Beulich Committed by Linus Torvalds
Browse files

drivers/rtc/rtc-efi.c: check for invalid data coming back from UEFI 



In particular seeing zero in eft->month is problematic, as it results in
-1 (converted to unsigned int, i.e.  yielding 0xffffffff) getting passed
to rtc_year_days(), where the value gets used as an array index
(normally resulting in a crash).  This was observed with the driver
enabled on x86 on some Fujitsu system (with possibly not up to date
firmware, but anyway).

Perhaps efi_read_alarm() should not fail if neither enabled nor pending
are set, but the returned time is invalid?

Signed-off-by: default avatarJan Beulich <jbeulich@suse.com>
Reported-by: default avatarRaymund Will <rw@suse.de>
Cc: Alessandro Zummo <a.zummo@towertech.it>
Cc: Jingoo Han <jg1.han@samsung.com>
Acked-by: default avatarLee, Chun-Yi <jlee@suse.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 3710f597

drivers/rtc/rtc-efi.c

+27 −5
Original line number Diff line number Diff line
@@ -17,6 +17,7 @@ 


#include <linux/kernel.h>

#include <linux/module.h>

#include <linux/stringify.h>

#include <linux/time.h>

#include <linux/platform_device.h>

#include <linux/rtc.h>
@@ -48,8 +49,8 @@ compute_wday(efi_time_t *eft) 
	int y;

	int ndays = 0;



	if (eft->year < 1998) {

		pr_err("EFI year < 1998, invalid date\n");

	if (eft->year < EFI_RTC_EPOCH) {

		pr_err("EFI year < " __stringify(EFI_RTC_EPOCH) ", invalid date\n");

		return -1;

	}
@@ -78,19 +79,36 @@ convert_to_efi_time(struct rtc_time *wtime, efi_time_t *eft) 
	eft->timezone	= EFI_UNSPECIFIED_TIMEZONE;

}



static void

static bool

convert_from_efi_time(efi_time_t *eft, struct rtc_time *wtime)

{

	memset(wtime, 0, sizeof(*wtime));



	if (eft->second >= 60)

		return false;

	wtime->tm_sec  = eft->second;



	if (eft->minute >= 60)

		return false;

	wtime->tm_min  = eft->minute;



	if (eft->hour >= 24)

		return false;

	wtime->tm_hour = eft->hour;



	if (!eft->day || eft->day > 31)

		return false;

	wtime->tm_mday = eft->day;



	if (!eft->month || eft->month > 12)

		return false;

	wtime->tm_mon  = eft->month - 1;

	wtime->tm_year = eft->year - 1900;



	/* day of the week [0-6], Sunday=0 */

	wtime->tm_wday = compute_wday(eft);

	if (wtime->tm_wday < 0)

		return false;



	/* day in the year [1-365]*/

	wtime->tm_yday = compute_yday(eft);
@@ -106,6 +124,8 @@ convert_from_efi_time(efi_time_t *eft, struct rtc_time *wtime) 
	default:

		wtime->tm_isdst = -1;

	}



	return true;

}



static int efi_read_alarm(struct device *dev, struct rtc_wkalrm *wkalrm)
@@ -122,7 +142,8 @@ static int efi_read_alarm(struct device *dev, struct rtc_wkalrm *wkalrm) 
	if (status != EFI_SUCCESS)

		return -EINVAL;



	convert_from_efi_time(&eft, &wkalrm->time);

	if (!convert_from_efi_time(&eft, &wkalrm->time))

		return -EIO;



	return rtc_valid_tm(&wkalrm->time);

}
@@ -163,7 +184,8 @@ static int efi_read_time(struct device *dev, struct rtc_time *tm) 
		return -EINVAL;

	}



	convert_from_efi_time(&eft, tm);

	if (!convert_from_efi_time(&eft, tm))

		return -EIO;



	return rtc_valid_tm(tm);

}

CRA Git | Maintained and supported by SUSTech CRA and CCSE