Re: [PATCH v4 5/9] rtc: abx80x: add irq to struct abx80x_priv

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Short reads from I2C block transfers leave stack buffers partially uninitialized, leading to a kernel information leak.
--

--- Patch [5]: [PATCH v4 5/9] rtc: abx80x: add irq to struct abx80x_priv ---
commit efc6d887b1cb64fa6fee7b2ea258d8477f65792a
Author: Antoni Pokusinski <[email protected]>

rtc: abx80x: add irq to struct abx80x_priv
    
This way the irq number is not tied to the i2c_client and can be
easily accessed also in the case of ABX81X SPI clocks.

> diff --git a/drivers/rtc/rtc-abx80x.c b/drivers/rtc/rtc-abx80x.c
> index 485d1ea08030d..12a4dbfec6396 100644
> --- a/drivers/rtc/rtc-abx80x.c
> +++ b/drivers/rtc/rtc-abx80x.c
[ ... ]
> @@ -305,11 +306,12 @@ static irqreturn_t abx80x_handle_irq(int irq, void *dev_id)
>  static int abx80x_read_alarm(struct device *dev, struct rtc_wkalrm *t)
>  {
>  	struct i2c_client *client = to_i2c_client(dev);
> +	struct abx80x_priv *priv = i2c_get_clientdata(client);
>  	unsigned char buf[7];
>  
>  	int irq_mask, err;
>  
> -	if (client->irq <= 0)
> +	if (priv->irq <= 0)
>  		return -EINVAL;
>  
>  	err = i2c_smbus_read_i2c_block_data(client, ABX8XX_REG_ASC,

[Severity: High]
Does the error check following this read adequately handle short reads?

Because i2c_smbus_read_i2c_block_data() returns the number of bytes read on
success, a short read will return a positive value less than sizeof(buf).
With the error check changed to if (err < 0) in this patch series, it fails
to catch short reads.

This bypasses the check and leaves the stack-allocated buf partially
uninitialized. When this uninitialized memory is parsed and eventually exposed
to userspace via RTC ioctls, it introduces a kernel information leak.

This is a pre-existing issue in other functions as well, but I wanted to
point it out since it affects this code path now:

drivers/rtc/rtc-abx80x.c:abx80x_rtc_read_time() {
    ...
	err = i2c_smbus_read_i2c_block_data(client, ABX8XX_REG_HTH,
					    sizeof(buf), buf);
	if (err < 0) {
		dev_err(&client->dev, "Unable to read date\n");
		return -EIO;
	}
    ...
}

and:

drivers/rtc/rtc-abx80x.c:abx80x_probe() {
    ...
	err = i2c_smbus_read_i2c_block_data(client, ABX8XX_REG_ID0,
					    sizeof(buf), buf);
	if (err < 0) {
		dev_err(&client->dev, "Unable to read partnumber\n");
		return -EIO;
	}
    ...
}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=5