linux-stable.git/drivers/rtc/class.c, branch linux-5.10.y

rtc: Fix offset calculation for .start_secs < 0

2025-06-27T10:04:06+00:00

[ Upstream commit fe9f5f96cfe8b82d0f24cbfa93718925560f4f8d ]

The comparison

        rtc->start_secs > rtc->range_max

has a signed left-hand side and an unsigned right-hand side.
So the comparison might become true for negative start_secs which is
interpreted as a (possibly very large) positive value.

As a negative value can never be bigger than an unsigned value
the correct representation of the (mathematical) comparison

        rtc->start_secs > rtc->range_max

in C is:

        rtc->start_secs >= 0 && rtc->start_secs > rtc->range_max

Use that to fix the offset calculation currently used in the
rtc-mt6397 driver.

Fixes: 989515647e783 ("rtc: Add one offset seconds to expand RTC range")
Signed-off-by: Alexandre Mergnat 
Reviewed-by: Uwe Kleine-König 
Link: https://lore.kernel.org/r/20250428-enable-rtc-v4-2-2b2f7e3f9349@baylibre.com
Signed-off-by: Alexandre Belloni 
Signed-off-by: Sasha Levin

rtc: fix use-after-free on device removal

2022-05-25T07:17:52+00:00

[ Upstream commit c8fa17d9f08a448184f03d352145099b5beb618e ]

If the irqwork is still scheduled or running while the RTC device is
removed, a use-after-free occurs in rtc_timer_do_work().  Cleanup the
timerqueue and ensure the work is stopped to fix this.

 BUG: KASAN: use-after-free in mutex_lock+0x94/0x110
 Write of size 8 at addr ffffff801d846338 by task kworker/3:1/41

 Workqueue: events rtc_timer_do_work
 Call trace:
  mutex_lock+0x94/0x110
  rtc_timer_do_work+0xec/0x630
  process_one_work+0x5fc/0x1344
  ...

 Allocated by task 551:
  kmem_cache_alloc_trace+0x384/0x6e0
  devm_rtc_allocate_device+0xf0/0x574
  devm_rtc_device_register+0x2c/0x12c
  ...

 Freed by task 572:
  kfree+0x114/0x4d0
  rtc_device_release+0x64/0x80
  device_release+0x8c/0x1f4
  kobject_put+0x1c4/0x4b0
  put_device+0x20/0x30
  devm_rtc_release_device+0x1c/0x30
  devm_action_release+0x54/0x90
  release_nodes+0x124/0x310
  devres_release_group+0x170/0x240
  i2c_device_remove+0xd8/0x314
  ...

 Last potentially related work creation:
  insert_work+0x5c/0x330
  queue_work_on+0xcc/0x154
  rtc_set_time+0x188/0x5bc
  rtc_dev_ioctl+0x2ac/0xbd0
  ...

Signed-off-by: Vincent Whitchurch 
Signed-off-by: Alexandre Belloni 
Link: https://lore.kernel.org/r/20211210160951.7718-1-vincent.whitchurch@axis.com
Signed-off-by: Sasha Levin

rtc: class: remove redundant assignment to variable err

2020-04-02T16:47:30+00:00

The variable err is being initialized with a value that is never read
and it is being updated later with a new value. The initialization
is redundant and can be removed.

Addresses-Coverity: ("Unused value")
Signed-off-by: Colin Ian King 
Link: https://lore.kernel.org/r/20200402110411.508534-1-colin.king@canonical.com
Signed-off-by: Alexandre Belloni

rtc: class: avoid unnecessary lookup in hctosys

2020-03-24T21:48:04+00:00

rtc_hctosys is only called when the relevant RTC is found, avoid looking it
up while we already have a pinter to the proper struct rtc_device.

Link: https://lore.kernel.org/r/20200323213039.297458-1-alexandre.belloni@bootlin.com
Signed-off-by: Alexandre Belloni

rtc: class: support hctosys from modular RTC drivers

2020-03-23T20:14:34+00:00

Due to distribution constraints it may not be possible to statically
compile the required RTC driver into the kernel.

Expand RTC_HCTOSYS support to cover all RTC devices (statically compiled
or not) by checking at the end of RTC device registration whether the
time should be synced.

Signed-off-by: Steve Muckle 
Link: https://lore.kernel.org/r/20191106194625.116692-1-smuckle@google.com
Signed-off-by: Alexandre Belloni

rtc: class: add debug message when registration fails

2019-08-20T19:44:45+00:00

Add a message when __rtc_register_device fails because rtc->ops is NULL.
This may only happen when developing a new driver so use dev_dbg to avoid
compiling it in by default.

Signed-off-by: Alexandre Belloni 
Link: https://lore.kernel.org/r/20190818220041.17833-1-alexandre.belloni@bootlin.com
Signed-off-by: Alexandre Belloni

rtc: core: correct trivial checkpatch warnings

2019-04-04T08:07:08+00:00

Correct trivial checkpatch warnings, mostly whitespace issues and
unbalanced braces.

Signed-off-by: Alexandre Belloni

rtc: convert core to SPDX identifier

2019-03-18T02:36:01+00:00

Use SPDX-License-Identifier instead of a verbose license text. Also fix the
block comment alignment.

Signed-off-by: Alexandre Belloni

rtc: class: reimplement devm_rtc_device_register

2018-12-18T21:53:32+00:00

Implement devm_rtc_device_register using devm_rtc_allocate_device and
__rtc_register_device so there is only one path left to register rtc
devices.

Also mark it as deprecated so new drivers will hopefully use
devm_rtc_allocate_device and rtc_register_device that are less race prone
and allow avoiding the 2038, 2070, 2100 and 2106 bugs properly.

Signed-off-by: Alexandre Belloni

rtc: enforce rtc_timer_init private_data type

2018-12-18T21:53:29+00:00

All the remaining users of rtc_timers are passing the rtc_device as private
data. Enforce that and rename private_data to rtc.

Suggested-by: Arnd Bergmann 
Signed-off-by: Alexandre Belloni