Re: [PATCH v2 3/3] rtc: rs5c372: support eco mode on R2223x

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] This problem wasn't introduced by this patch, but missing RTC range_min and range_max constraints allow user-space to inject dates prior to year 2000, causing an integer underflow in bin2bcd() and silent RTC corruption.
--

--- Patch [3]: [PATCH v2 3/3] rtc: rs5c372: support eco mode on R2223x ---
commit dde76823d322a057d0dc319ae14408d7646ff056
Author: Heiko Schocher <hs@nabladev.com>

rtc: rs5c372: support eco mode on R2223x

The R2223x can run in an eco mode that lowers its current consumption from the
backup supply. This patch adds support for configuring this mode via the
ricoh,eco-mode device tree property.

> diff --git a/drivers/rtc/rtc-rs5c372.c b/drivers/rtc/rtc-rs5c372.c
> index c65b76cc0dc66..9ab6f2c28f7b1 100644
> --- a/drivers/rtc/rtc-rs5c372.c
> +++ b/drivers/rtc/rtc-rs5c372.c

[ ... ]

> @@ -903,6 +922,15 @@ static int rs5c372_probe(struct i2c_client *client)
>  			rs5c372->time24 ? "24hr" : "am/pm"
>  			);
>  
> +	if (rs5c372->type == rtc_r2223x) {
> +		bool eco = device_property_read_bool(&client->dev,
> +						     "ricoh,eco-mode");
> +
> +		err = rs5c372_set_eco_mode(rs5c372, eco);
> +		if (err < 0)
> +			goto exit;
> +	}
> +
>  	/* REVISIT use client->irq to register alarm irq ... */
>  	rs5c372->rtc = devm_rtc_device_register(&client->dev,
>  					rs5c372_driver.driver.name,

[Severity: High]
This isn't a bug introduced by this patch, but should the RTC range_min and
range_max constraints be explicitly initialized here before registration?

The core RTC subsystem defaults range_min to 1970 if not set by the driver,
allowing user-space to set tm_year between 70 and 99. Inside
rs5c372_rtc_set_time(), the driver computes tm->tm_year - 100, which
underflows to a negative number when tm_year < 100:

drivers/rtc/rtc-rs5c372.c:rs5c372_rtc_set_time() {
    ...
    buf[6] = bin2bcd(tm->tm_year - 100);
    ...
}

This results in an incorrectly shifted BCD value being written to the I2C RTC
register, silently corrupting the RTC time with garbage future dates when a
valid standard date is requested.

>  					&rs5c372_rtc_ops, THIS_MODULE);
>  
>  	if (IS_ERR(rs5c372->rtc)) {

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260825071927.4090460-1-hs@nabladev.com?part=3