git: d387a43ec8e2 - main - rockchip: fix stack overflow in rk8xx_rtc

The branch main has been updated by kevans:

URL: https://cgit.FreeBSD.org/src/commit/?id=d387a43ec8e2663b2d8bc0c8cb02d3a2ff14b6e6

commit d387a43ec8e2663b2d8bc0c8cb02d3a2ff14b6e6
Author:     Kyle Evans <kevans@FreeBSD.org>
AuthorDate: 2026-07-12 14:51:05 +0000
Commit:     Kyle Evans <kevans@FreeBSD.org>
CommitDate: 2026-07-12 14:51:05 +0000

    rockchip: fix stack overflow in rk8xx_rtc
    
    Presumably surfaced by -fstack-protector-strong, rk8xx_settime was
    triggering SSP when ntpd set the time on the RockPro64, at the very
    least.  A minor oops meant that the weeks mask was getting tossed into
    the wrong field, and the mask was never populated.  The mask is 0x7 for
    all three of these, thus overflowing the `data` array in settime by one
    byte.
    
    PR:             296719
    Reported by:    jsm, "Tenkawa" on Discord
    Reviewed by:    mmel
    Differential Revision:  https://reviews.freebsd.org/D58182
---
 sys/dev/iicbus/pmic/rockchip/rk805.c | 3 ++-
 sys/dev/iicbus/pmic/rockchip/rk808.c | 3 ++-
 sys/dev/iicbus/pmic/rockchip/rk817.c | 3 ++-
 3 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/sys/dev/iicbus/pmic/rockchip/rk805.c b/sys/dev/iicbus/pmic/rockchip/rk805.c
index 4b18aaba053d..5cdc27cd035f 100644
--- a/sys/dev/iicbus/pmic/rockchip/rk805.c
+++ b/sys/dev/iicbus/pmic/rockchip/rk805.c
@@ -167,7 +167,8 @@ rk805_attach(device_t dev)
 	sc->rtc_regs.months = RK805_RTC_MONTHS;
 	sc->rtc_regs.months_mask = RK805_RTC_MONTHS_MASK;
 	sc->rtc_regs.years = RK805_RTC_YEARS;
-	sc->rtc_regs.weeks = RK805_RTC_WEEKS_MASK;
+	sc->rtc_regs.weeks = RK805_RTC_WEEKS;
+	sc->rtc_regs.weeks_mask = RK805_RTC_WEEKS_MASK;
 	sc->rtc_regs.ctrl = RK805_RTC_CTRL;
 	sc->rtc_regs.ctrl_stop_mask = RK805_RTC_CTRL_STOP;
 	sc->rtc_regs.ctrl_ampm_mask = RK805_RTC_AMPM_MODE;
diff --git a/sys/dev/iicbus/pmic/rockchip/rk808.c b/sys/dev/iicbus/pmic/rockchip/rk808.c
index 1227fd47ee7b..f3974c5ec31b 100644
--- a/sys/dev/iicbus/pmic/rockchip/rk808.c
+++ b/sys/dev/iicbus/pmic/rockchip/rk808.c
@@ -242,7 +242,8 @@ rk808_attach(device_t dev)
 	sc->rtc_regs.months = RK808_RTC_MONTHS;
 	sc->rtc_regs.months_mask = RK808_RTC_MONTHS_MASK;
 	sc->rtc_regs.years = RK808_RTC_YEARS;
-	sc->rtc_regs.weeks = RK808_RTC_WEEKS_MASK;
+	sc->rtc_regs.weeks = RK808_RTC_WEEKS;
+	sc->rtc_regs.weeks_mask = RK808_RTC_WEEKS_MASK;
 	sc->rtc_regs.ctrl = RK808_RTC_CTRL;
 	sc->rtc_regs.ctrl_stop_mask = RK808_RTC_CTRL_STOP;
 	sc->rtc_regs.ctrl_ampm_mask = RK808_RTC_AMPM_MODE;
diff --git a/sys/dev/iicbus/pmic/rockchip/rk817.c b/sys/dev/iicbus/pmic/rockchip/rk817.c
index 6d14a26a87af..461a832d4d42 100644
--- a/sys/dev/iicbus/pmic/rockchip/rk817.c
+++ b/sys/dev/iicbus/pmic/rockchip/rk817.c
@@ -498,7 +498,8 @@ rk817_attach(device_t dev)
 	sc->rtc_regs.months = RK817_RTC_MONTHS;
 	sc->rtc_regs.months_mask = RK817_RTC_MONTHS_MASK;
 	sc->rtc_regs.years = RK817_RTC_YEARS;
-	sc->rtc_regs.weeks = RK817_RTC_WEEKS_MASK;
+	sc->rtc_regs.weeks = RK817_RTC_WEEKS;
+	sc->rtc_regs.weeks_mask = RK817_RTC_WEEKS_MASK;
 	sc->rtc_regs.ctrl = RK817_RTC_CTRL;
 	sc->rtc_regs.ctrl_stop_mask = RK817_RTC_CTRL_STOP;
 	sc->rtc_regs.ctrl_ampm_mask = RK817_RTC_AMPM_MODE;