rtc: check if __rtc_read_time was successful in rtc_timer_do_work()

If the __rtc_read_time call fails,, the struct rtc_time tm; may contain
uninitialized data, or an illegal date/time read from the RTC hardware.

When calling rtc_tm_to_ktime later, the result may be a very large value
(possibly KTIME_MAX). If there are periodic timers in rtc->timerqueue,
they will continually expire, may causing kernel softlockup.

Fixes: 6610e0893b8b ("RTC: Rework RTC code to use timerqueue for events")
Signed-off-by: Yongliang Gao <leonylgao@tencent.com>
Acked-by: Jingqun Li <jingqunli@tencent.com>
Link: https://lore.kernel.org/r/20241011043153.3788112-1-leonylgao@gmail.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>

diff --git a/drivers/rtc/interface.c b/drivers/rtc/interface.c
index cca650b2e0b94dfe77b13d4fd92447c8d695f9e2..aaf76406cd7d7d2cfd5479fc1fc892fcb5efbb6b 100644 (file)
--- a/drivers/rtc/interface.c
+++ b/drivers/rtc/interface.c
@@ -904,13 +904,18 @@ void rtc_timer_do_work(struct work_struct *work)
        struct timerqueue_node *next;
        ktime_t now;
        struct rtc_time tm;
+       int err;
 
        struct rtc_device *rtc =
                container_of(work, struct rtc_device, irqwork);
 
        mutex_lock(&rtc->ops_lock);
 again:
-       __rtc_read_time(rtc, &tm);
+       err = __rtc_read_time(rtc, &tm);
+       if (err) {
+               mutex_unlock(&rtc->ops_lock);
+               return;
+       }
        now = rtc_tm_to_ktime(tm);
        while ((next = timerqueue_getnext(&rtc->timerqueue))) {
                if (next->expires > now)