git: 01e37e47d240 - stable/14 - rockchip: fix stack overflow in rk8xx_rtc

The branch stable/14 has been updated by kevans:

URL: https://cgit.FreeBSD.org/src/commit/?id=01e37e47d240db81c7daf1388c7f949ff1c78db6

commit 01e37e47d240db81c7daf1388c7f949ff1c78db6
Author:     Kyle Evans <kevans@FreeBSD.org>
AuthorDate: 2026-07-12 14:51:05 +0000
Commit:     Kyle Evans <kevans@FreeBSD.org>
CommitDate: 2026-08-06 22:53:13 +0000

    rockchip: fix stack overflow in rk8xx_rtc
    
    Presumably surfaced by -fstack-protector-strong, rk8xx_settime was
    triggering SSP when ntpd set the time on the RockPro64, at the very
    least.  A minor oops meant that the weeks mask was getting tossed into
    the wrong field, and the mask was never populated.  The mask is 0x7 for
    all three of these, thus overflowing the `data` array in settime by one
    byte.
    
    PR:             296719
    Reported by:    jsm, "Tenkawa" on Discord
    Reviewed by:    mmelt
    
    (cherry picked from commit d387a43ec8e2663b2d8bc0c8cb02d3a2ff14b6e6)
---
 sys/dev/iicbus/pmic/rockchip/rk805.c | 3 ++-
 sys/dev/iicbus/pmic/rockchip/rk808.c | 3 ++-
 sys/dev/iicbus/pmic/rockchip/rk817.c | 3 ++-
 3 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/sys/dev/iicbus/pmic/rockchip/rk805.c b/sys/dev/iicbus/pmic/rockchip/rk805.c
index c41d2826c7f1..1b07b39b90a4 100644
--- a/sys/dev/iicbus/pmic/rockchip/rk805.c
+++ b/sys/dev/iicbus/pmic/rockchip/rk805.c
@@ -168,7 +168,8 @@ rk805_attach(device_t dev)
 	sc->rtc_regs.months = RK805_RTC_MONTHS;
 	sc->rtc_regs.months_mask = RK805_RTC_MONTHS_MASK;
 	sc->rtc_regs.years = RK805_RTC_YEARS;
-	sc->rtc_regs.weeks = RK805_RTC_WEEKS_MASK;
+	sc->rtc_regs.weeks = RK805_RTC_WEEKS;
+	sc->rtc_regs.weeks_mask = RK805_RTC_WEEKS_MASK;
 	sc->rtc_regs.ctrl = RK805_RTC_CTRL;
 	sc->rtc_regs.ctrl_stop_mask = RK805_RTC_CTRL_STOP;
 	sc->rtc_regs.ctrl_ampm_mask = RK805_RTC_AMPM_MODE;
diff --git a/sys/dev/iicbus/pmic/rockchip/rk808.c b/sys/dev/iicbus/pmic/rockchip/rk808.c
index 8ba4c3520793..103a9a910aae 100644
--- a/sys/dev/iicbus/pmic/rockchip/rk808.c
+++ b/sys/dev/iicbus/pmic/rockchip/rk808.c
@@ -243,7 +243,8 @@ rk808_attach(device_t dev)
 	sc->rtc_regs.months = RK808_RTC_MONTHS;
 	sc->rtc_regs.months_mask = RK808_RTC_MONTHS_MASK;
 	sc->rtc_regs.years = RK808_RTC_YEARS;
-	sc->rtc_regs.weeks = RK808_RTC_WEEKS_MASK;
+	sc->rtc_regs.weeks = RK808_RTC_WEEKS;
+	sc->rtc_regs.weeks_mask = RK808_RTC_WEEKS_MASK;
 	sc->rtc_regs.ctrl = RK808_RTC_CTRL;
 	sc->rtc_regs.ctrl_stop_mask = RK808_RTC_CTRL_STOP;
 	sc->rtc_regs.ctrl_ampm_mask = RK808_RTC_AMPM_MODE;
diff --git a/sys/dev/iicbus/pmic/rockchip/rk817.c b/sys/dev/iicbus/pmic/rockchip/rk817.c
index 33c24ec33c93..1ef502d22969 100644
--- a/sys/dev/iicbus/pmic/rockchip/rk817.c
+++ b/sys/dev/iicbus/pmic/rockchip/rk817.c
@@ -499,7 +499,8 @@ rk817_attach(device_t dev)
 	sc->rtc_regs.months = RK817_RTC_MONTHS;
 	sc->rtc_regs.months_mask = RK817_RTC_MONTHS_MASK;
 	sc->rtc_regs.years = RK817_RTC_YEARS;
-	sc->rtc_regs.weeks = RK817_RTC_WEEKS_MASK;
+	sc->rtc_regs.weeks = RK817_RTC_WEEKS;
+	sc->rtc_regs.weeks_mask = RK817_RTC_WEEKS_MASK;
 	sc->rtc_regs.ctrl = RK817_RTC_CTRL;
 	sc->rtc_regs.ctrl_stop_mask = RK817_RTC_CTRL_STOP;
 	sc->rtc_regs.ctrl_ampm_mask = RK817_RTC_AMPM_MODE;