git: 7d0243317f3a - stable/15 - compat: linux: use appropriate variables for copying out old timers

The branch stable/15 has been updated by dim:

URL: https://cgit.FreeBSD.org/src/commit/?id=7d0243317f3a6ccddc9b71fd3ea96e877a043ec8

commit 7d0243317f3a6ccddc9b71fd3ea96e877a043ec8
Author:     Kyle Evans <kevans@FreeBSD.org>
AuthorDate: 2025-12-28 22:02:04 +0000
Commit:     Dimitry Andric <dim@FreeBSD.org>
CommitDate: 2026-01-02 20:40:53 +0000

    compat: linux: use appropriate variables for copying out old timers
    
    We copyout &l_oval but do the conversions into &l_val, leaving us with
    stack garbage.  A build with an LLVM21 cross-toolchain seems to catch
    this.
    
    Reported by:    Florian Limberger <flo purplekraken com>
    Reviewed by:    markj
    Fixes:          a1fd2911ddb06 ("linux(4): Implement timer_settime64 syscall.")
    MFC after:      3 days
    Differential Revision: https://reviews.freebsd.org/D52985
    
    (cherry picked from commit 541a98d7e28a8e4697ac2fa78dd4c4203c2c3a9c)
---
 sys/compat/linux/linux_timer.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/sys/compat/linux/linux_timer.c b/sys/compat/linux/linux_timer.c
index ed9133359302..230be9572b85 100644
--- a/sys/compat/linux/linux_timer.c
+++ b/sys/compat/linux/linux_timer.c
@@ -131,7 +131,7 @@ linux_timer_settime(struct thread *td, struct linux_timer_settime_args *uap)
 		return (error);
 	error = kern_ktimer_settime(td, uap->timerid, flags, &val, ovalp);
 	if (error == 0 && uap->old != NULL) {
-		error = native_to_linux_itimerspec(&l_val, &val);
+		error = native_to_linux_itimerspec(&l_oval, &oval);
 		if (error == 0)
 			error = copyout(&l_oval, uap->old, sizeof(l_oval));
 	}
@@ -158,7 +158,7 @@ linux_timer_settime64(struct thread *td, struct linux_timer_settime64_args *uap)
 		return (error);
 	error = kern_ktimer_settime(td, uap->timerid, flags, &val, ovalp);
 	if (error == 0 && uap->old != NULL) {
-		error = native_to_linux_itimerspec64(&l_val, &val);
+		error = native_to_linux_itimerspec64(&l_oval, &oval);
 		if (error == 0)
 			error = copyout(&l_oval, uap->old, sizeof(l_oval));
 	}