From nobody Fri Aug 7 01:48:15 2026 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4hGRr06rn2z6nf98 for ; Fri, 07 Aug 2026 01:48:16 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4hGRr051VBz3pVt for ; Fri, 07 Aug 2026 01:48:16 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1786067296; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=IZa5ZVpUO9xjDkX1qUml9Rcb9YtFdO6QtzLjTm7iK2w=; b=p87KslhmmzcgNGxgdfRIeLJZB9hYcP/vOC7b3xHyikxpUmu9T02Aieb0bKEbdZHj6bHV7v X9dkpFFa6PrQNK+1MxgHnRZYFyE8FTQqcMi1gcyDPGQOCHCRxR/VAMo4Sd5/3d/Vj+m3+3 LqBXgGT7+0GEnH0bqEI2FDUaJF41e9uQXPqCpSkP8F7HJtKDxBDd/Rg4j871Kbe2l810Rx EnpUgNeIeiUlVfnxJguX/iNzzBU+3bZ/SyjPLzpq3FOVyxtoeMkzHIYIeciPFGBZSFgScg 40oHSvD8IRT4gkHconezmEP3aDJnMsxMMVsF0PykjWYJtUxTYLkiiWNVdEiU1Q== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1786067296; a=rsa-sha256; cv=none; b=EXKVPmydE4zGJIXBFcnj0RF+yT35iPzXktv8AmKsajddohppoZZL2BCDWHQnbdTdUm3PA0 GlqWPrnv2yb8nRkg6AcNVToR65lwMyt2JPLnGwW+WkPUP5tcHIU3eoJbduSg6PEQc/PEVS ExZEUP8fdm7rx/usVZ4Zd1NrgeZSDNmxGvRsRcCalcIO5hI3TCzRukffCNQSjW+AulZ8ZE KuNSN7n6zf6bQoAihG7/+7o1IwzUxB1xXf11N4tcYORBzvOfx+D5N2SO7ZxHhfDXO7f832 TzN1el1ez6EiLcCc4i+9zRmXcComiL4GLuSD7yIV4CNb1fieb/T0HdithpDAUg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1786067296; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=IZa5ZVpUO9xjDkX1qUml9Rcb9YtFdO6QtzLjTm7iK2w=; b=DsfBTisgOtY5hjTYCKLGyxrAF8eOCJv+sEVgTfgZ/2ie3NSiLLtP980ls1QWtzPwJYnYby QRQAaiVjXX018ZBqLLCH5dInAYh360gYDKQvF+2Sat7Gkvz0y6OwbyS1QY+lry9Ocobc2i jhHwwSF2dChsjz4Mvpqdy3+Qn9a/sRVPJsDsD27CDluXvQRx/OLRPz8HaVLG1W3Py6K9e9 X1OSZKAEsT6Z6/NYD58IqOfUW0qSzb91+ITLZrZEJ4C5EfbbSaPOPe3qp6tmPOzLHnRM9S dwhSl4+RnS+R9B6xclU4gy4xSI9R1/bklww/q9j1tCZEuQW8Z71URCw0E0oZAA== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4hGRr02yFbzmZ6 for ; Fri, 07 Aug 2026 01:48:16 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 3bb9f by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Fri, 07 Aug 2026 01:48:15 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Kyle Evans Subject: git: 1ce0ad4b3aa5 - stable/15 - rockchip: fix stack overflow in rk8xx_rtc List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: kevans X-Git-Repository: src X-Git-Refname: refs/heads/stable/15 X-Git-Reftype: branch X-Git-Commit: 1ce0ad4b3aa51f5f030444c0466ec5c0a47b6c91 Auto-Submitted: auto-generated Date: Fri, 07 Aug 2026 01:48:15 +0000 Message-Id: <6a75395f.3bb9f.d388530@gitrepo.freebsd.org> The branch stable/15 has been updated by kevans: URL: https://cgit.FreeBSD.org/src/commit/?id=1ce0ad4b3aa51f5f030444c0466ec5c0a47b6c91 commit 1ce0ad4b3aa51f5f030444c0466ec5c0a47b6c91 Author: Kyle Evans AuthorDate: 2026-07-12 14:51:05 +0000 Commit: Kyle Evans CommitDate: 2026-08-06 23:36:18 +0000 rockchip: fix stack overflow in rk8xx_rtc Presumably surfaced by -fstack-protector-strong, rk8xx_settime was triggering SSP when ntpd set the time on the RockPro64, at the very least. A minor oops meant that the weeks mask was getting tossed into the wrong field, and the mask was never populated. The mask is 0x7 for all three of these, thus overflowing the `data` array in settime by one byte. PR: 296719 Reported by: jsm, "Tenkawa" on Discord Reviewed by: mmel (cherry picked from commit d387a43ec8e2663b2d8bc0c8cb02d3a2ff14b6e6) --- sys/dev/iicbus/pmic/rockchip/rk805.c | 3 ++- sys/dev/iicbus/pmic/rockchip/rk808.c | 3 ++- sys/dev/iicbus/pmic/rockchip/rk817.c | 3 ++- 3 files changed, 6 insertions(+), 3 deletions(-) diff --git a/sys/dev/iicbus/pmic/rockchip/rk805.c b/sys/dev/iicbus/pmic/rockchip/rk805.c index 4b18aaba053d..5cdc27cd035f 100644 --- a/sys/dev/iicbus/pmic/rockchip/rk805.c +++ b/sys/dev/iicbus/pmic/rockchip/rk805.c @@ -167,7 +167,8 @@ rk805_attach(device_t dev) sc->rtc_regs.months = RK805_RTC_MONTHS; sc->rtc_regs.months_mask = RK805_RTC_MONTHS_MASK; sc->rtc_regs.years = RK805_RTC_YEARS; - sc->rtc_regs.weeks = RK805_RTC_WEEKS_MASK; + sc->rtc_regs.weeks = RK805_RTC_WEEKS; + sc->rtc_regs.weeks_mask = RK805_RTC_WEEKS_MASK; sc->rtc_regs.ctrl = RK805_RTC_CTRL; sc->rtc_regs.ctrl_stop_mask = RK805_RTC_CTRL_STOP; sc->rtc_regs.ctrl_ampm_mask = RK805_RTC_AMPM_MODE; diff --git a/sys/dev/iicbus/pmic/rockchip/rk808.c b/sys/dev/iicbus/pmic/rockchip/rk808.c index 1227fd47ee7b..f3974c5ec31b 100644 --- a/sys/dev/iicbus/pmic/rockchip/rk808.c +++ b/sys/dev/iicbus/pmic/rockchip/rk808.c @@ -242,7 +242,8 @@ rk808_attach(device_t dev) sc->rtc_regs.months = RK808_RTC_MONTHS; sc->rtc_regs.months_mask = RK808_RTC_MONTHS_MASK; sc->rtc_regs.years = RK808_RTC_YEARS; - sc->rtc_regs.weeks = RK808_RTC_WEEKS_MASK; + sc->rtc_regs.weeks = RK808_RTC_WEEKS; + sc->rtc_regs.weeks_mask = RK808_RTC_WEEKS_MASK; sc->rtc_regs.ctrl = RK808_RTC_CTRL; sc->rtc_regs.ctrl_stop_mask = RK808_RTC_CTRL_STOP; sc->rtc_regs.ctrl_ampm_mask = RK808_RTC_AMPM_MODE; diff --git a/sys/dev/iicbus/pmic/rockchip/rk817.c b/sys/dev/iicbus/pmic/rockchip/rk817.c index 6d14a26a87af..461a832d4d42 100644 --- a/sys/dev/iicbus/pmic/rockchip/rk817.c +++ b/sys/dev/iicbus/pmic/rockchip/rk817.c @@ -498,7 +498,8 @@ rk817_attach(device_t dev) sc->rtc_regs.months = RK817_RTC_MONTHS; sc->rtc_regs.months_mask = RK817_RTC_MONTHS_MASK; sc->rtc_regs.years = RK817_RTC_YEARS; - sc->rtc_regs.weeks = RK817_RTC_WEEKS_MASK; + sc->rtc_regs.weeks = RK817_RTC_WEEKS; + sc->rtc_regs.weeks_mask = RK817_RTC_WEEKS_MASK; sc->rtc_regs.ctrl = RK817_RTC_CTRL; sc->rtc_regs.ctrl_stop_mask = RK817_RTC_CTRL_STOP; sc->rtc_regs.ctrl_ampm_mask = RK817_RTC_AMPM_MODE;