diff options
| author | Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr> | 2026-08-09 19:04:16 +0000 |
|---|---|---|
| committer | Thomas Gleixner <tglx@kernel.org> | 2026-08-11 15:43:12 +0200 |
| commit | 18c7d85864e554adc8fad1e8d2e9d2cb6c3911c8 (patch) | |
| tree | 50ee635d9703a242c78fe95a1da3e0342d77df99 /kernel/time | |
| parent | b17006b45283f012a6e166517f5ca3e1af2f806a (diff) | |
| download | linux-next-18c7d85864e554adc8fad1e8d2e9d2cb6c3911c8.tar.gz linux-next-18c7d85864e554adc8fad1e8d2e9d2cb6c3911c8.zip | |
timers/itimer: Zero-init old itimerval before copy to userspace
On native sparc64, struct __kernel_old_timeval contains a four-byte hole
after tv_usec because tv_sec is 64-bit while __kernel_suseconds_t is 32-bit.
put_itimerval() fills only the named fields in a stack-allocated
__kernel_old_itimerval and copies the entire object to userspace, so
getitimer() can expose the two padding holes.
Zero-initialize the aggregate before assigning the fields so implicit
padding is deterministic before it crosses the user/kernel boundary.
Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Assisted-by: Codex:gpt-5
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260809190428.1523014-1-Jeremy.Jean@oss.cyber.gouv.fr
Diffstat (limited to 'kernel/time')
| -rw-r--r-- | kernel/time/itimer.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/kernel/time/itimer.c b/kernel/time/itimer.c index 7c6110e964e7..03a32dffc56c 100644 --- a/kernel/time/itimer.c +++ b/kernel/time/itimer.c @@ -100,7 +100,7 @@ static int do_getitimer(int which, struct itimerspec64 *value) static int put_itimerval(struct __kernel_old_itimerval __user *o, const struct itimerspec64 *i) { - struct __kernel_old_itimerval v; + struct __kernel_old_itimerval v = {}; v.it_interval.tv_sec = i->it_interval.tv_sec; v.it_interval.tv_usec = i->it_interval.tv_nsec / NSEC_PER_USEC; |