Date: Sun, 12 Jul 2026 14:51:14 +0000 From: Kyle Evans <kevans@FreeBSD.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org Subject: git: d387a43ec8e2 - main - rockchip: fix stack overflow in rk8xx_rtc Message-ID: <6a53a9e2.3b1eb.641ee5c0@gitrepo.freebsd.org>
index | next in thread | raw e-mail
The branch main has been updated by kevans: URL: https://cgit.FreeBSD.org/src/commit/?id=d387a43ec8e2663b2d8bc0c8cb02d3a2ff14b6e6 commit d387a43ec8e2663b2d8bc0c8cb02d3a2ff14b6e6 Author: Kyle Evans <kevans@FreeBSD.org> AuthorDate: 2026-07-12 14:51:05 +0000 Commit: Kyle Evans <kevans@FreeBSD.org> CommitDate: 2026-07-12 14:51:05 +0000 rockchip: fix stack overflow in rk8xx_rtc Presumably surfaced by -fstack-protector-strong, rk8xx_settime was triggering SSP when ntpd set the time on the RockPro64, at the very least. A minor oops meant that the weeks mask was getting tossed into the wrong field, and the mask was never populated. The mask is 0x7 for all three of these, thus overflowing the `data` array in settime by one byte. PR: 296719 Reported by: jsm, "Tenkawa" on Discord Reviewed by: mmel Differential Revision: https://reviews.freebsd.org/D58182 --- sys/dev/iicbus/pmic/rockchip/rk805.c | 3 ++- sys/dev/iicbus/pmic/rockchip/rk808.c | 3 ++- sys/dev/iicbus/pmic/rockchip/rk817.c | 3 ++- 3 files changed, 6 insertions(+), 3 deletions(-) diff --git a/sys/dev/iicbus/pmic/rockchip/rk805.c b/sys/dev/iicbus/pmic/rockchip/rk805.c index 4b18aaba053d..5cdc27cd035f 100644 --- a/sys/dev/iicbus/pmic/rockchip/rk805.c +++ b/sys/dev/iicbus/pmic/rockchip/rk805.c @@ -167,7 +167,8 @@ rk805_attach(device_t dev) sc->rtc_regs.months = RK805_RTC_MONTHS; sc->rtc_regs.months_mask = RK805_RTC_MONTHS_MASK; sc->rtc_regs.years = RK805_RTC_YEARS; - sc->rtc_regs.weeks = RK805_RTC_WEEKS_MASK; + sc->rtc_regs.weeks = RK805_RTC_WEEKS; + sc->rtc_regs.weeks_mask = RK805_RTC_WEEKS_MASK; sc->rtc_regs.ctrl = RK805_RTC_CTRL; sc->rtc_regs.ctrl_stop_mask = RK805_RTC_CTRL_STOP; sc->rtc_regs.ctrl_ampm_mask = RK805_RTC_AMPM_MODE; diff --git a/sys/dev/iicbus/pmic/rockchip/rk808.c b/sys/dev/iicbus/pmic/rockchip/rk808.c index 1227fd47ee7b..f3974c5ec31b 100644 --- a/sys/dev/iicbus/pmic/rockchip/rk808.c +++ b/sys/dev/iicbus/pmic/rockchip/rk808.c @@ -242,7 +242,8 @@ rk808_attach(device_t dev) sc->rtc_regs.months = RK808_RTC_MONTHS; sc->rtc_regs.months_mask = RK808_RTC_MONTHS_MASK; sc->rtc_regs.years = RK808_RTC_YEARS; - sc->rtc_regs.weeks = RK808_RTC_WEEKS_MASK; + sc->rtc_regs.weeks = RK808_RTC_WEEKS; + sc->rtc_regs.weeks_mask = RK808_RTC_WEEKS_MASK; sc->rtc_regs.ctrl = RK808_RTC_CTRL; sc->rtc_regs.ctrl_stop_mask = RK808_RTC_CTRL_STOP; sc->rtc_regs.ctrl_ampm_mask = RK808_RTC_AMPM_MODE; diff --git a/sys/dev/iicbus/pmic/rockchip/rk817.c b/sys/dev/iicbus/pmic/rockchip/rk817.c index 6d14a26a87af..461a832d4d42 100644 --- a/sys/dev/iicbus/pmic/rockchip/rk817.c +++ b/sys/dev/iicbus/pmic/rockchip/rk817.c @@ -498,7 +498,8 @@ rk817_attach(device_t dev) sc->rtc_regs.months = RK817_RTC_MONTHS; sc->rtc_regs.months_mask = RK817_RTC_MONTHS_MASK; sc->rtc_regs.years = RK817_RTC_YEARS; - sc->rtc_regs.weeks = RK817_RTC_WEEKS_MASK; + sc->rtc_regs.weeks = RK817_RTC_WEEKS; + sc->rtc_regs.weeks_mask = RK817_RTC_WEEKS_MASK; sc->rtc_regs.ctrl = RK817_RTC_CTRL; sc->rtc_regs.ctrl_stop_mask = RK817_RTC_CTRL_STOP; sc->rtc_regs.ctrl_ampm_mask = RK817_RTC_AMPM_MODE;home | help
Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?6a53a9e2.3b1eb.641ee5c0>