3.18-stable review patch.  If anyone has any objections, please let me know.


From: Vaibhav Jain <vaib...@linux.vnet.ibm.com>

[ Upstream commit da96aea0ed177105cb13ee83b328f6c61e061d3f ]

In function __rtc_read_alarm() its possible for an alarm time-stamp to
be invalid even after replacing missing components with current
time-stamp. The condition 'alarm->time.tm_year < 70' will trigger this
case and will cause the call to 'rtc_tm_to_time64(&alarm->time)'
return a negative value for variable t_alm.

While handling alarm rollover this negative t_alm (assumed to seconds
offset from '1970-01-01 00:00:00') is converted back to rtc_time via
rtc_time64_to_tm() which results in this error log with seemingly
garbage values:

"rtc rtc0: invalid alarm value: -2-1--1041528741

This error was generated when the rtc driver (rtc-opal in this case)
returned an alarm time-stamp of '00-00-00 00:00:00' to indicate that
the alarm is disabled. Though I have submitted a separate fix for the
rtc-opal driver, this issue may potentially impact other
existing/future rtc drivers.

To fix this issue the patch validates the alarm time-stamp just after
filling up the missing datetime components and if rtc_valid_tm() still
reports it to be invalid then bails out of the function without
handling the rollover.

Reported-by: Steve Best <sb...@redhat.com>
Signed-off-by: Vaibhav Jain <vaib...@linux.vnet.ibm.com>
Signed-off-by: Alexandre Belloni <alexandre.bell...@free-electrons.com>
Signed-off-by: Sasha Levin <alexander.le...@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>
 drivers/rtc/interface.c |    9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

--- a/drivers/rtc/interface.c
+++ b/drivers/rtc/interface.c
@@ -249,6 +249,13 @@ int __rtc_read_alarm(struct rtc_device *
                        missing = year;
+       /* Can't proceed if alarm is still invalid after replacing
+        * missing fields.
+        */
+       err = rtc_valid_tm(&alarm->time);
+       if (err)
+               goto done;
        /* with luck, no rollover is needed */
        rtc_tm_to_time(&now, &t_now);
        rtc_tm_to_time(&alarm->time, &t_alm);
@@ -300,9 +307,9 @@ int __rtc_read_alarm(struct rtc_device *
                dev_warn(&rtc->dev, "alarm rollover not handled\n");
        err = rtc_valid_tm(&alarm->time);
        if (err) {
                dev_warn(&rtc->dev, "invalid alarm value: %d-%d-%d %d:%d:%d\n",
                        alarm->time.tm_year + 1900, alarm->time.tm_mon + 1,

Reply via email to