From nobody Fri Dec 19 13:57:50 2025 Received: from mx01.omp.ru (mx01.omp.ru [90.154.21.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 60C422EFD95; Sun, 12 Oct 2025 18:12:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=90.154.21.10 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760292750; cv=none; b=axEHPFx2nyzqwx0COyWrtJv45lxx4pkYYz6gi6850Q2CLbW+rI3JLWsDy2MflZx27Tu+TplTzcapfngT3mwR6t4CjueXVS49b7L1/feCpO4d+/1DyJn4Z/wmZxhhQweKuMNpHqHaToBVQmJWn0WVCgs4DIWFLoUcEAdJMMJmlAU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1760292750; c=relaxed/simple; bh=uPMJA6y1kb6LmPS8fuc3+PnIZOvHfdZfmIsgWf92J2o=; h=Message-ID:Date:MIME-Version:From:Subject:To:CC:Content-Type; b=uoUI1ujjzDXjGZu+Wjjd+wofbE9bevfsdk1SknXYInh4uUrZKOuKVryINHhZky84Am0tH+OhAri4iLCLVz+rkDn0LlgDSkwLUwh8OZHKNKs//uDebvkTBIqTf+uNVY/64TXJUAS4hzoBQ7H30kJaEMASdzygAVlE4SfrLuJ9VZA= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=omp.ru; spf=pass smtp.mailfrom=omp.ru; arc=none smtp.client-ip=90.154.21.10 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=omp.ru Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=omp.ru Received: from [192.168.2.104] (213.87.133.64) by msexch01.omp.ru (10.188.4.12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.2.1258.12; Sun, 12 Oct 2025 20:56:59 +0300 Message-ID: <3eb40848-3bec-42ca-845b-c66d4b53cedc@omp.ru> Date: Sun, 12 Oct 2025 20:56:58 +0300 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird From: Sergey Shtylyov Subject: [PATCH v2] serial: 8250_mtk: correct max baud rate in set_termios() method To: Greg Kroah-Hartman , Jiri Slaby , Matthias Brugger , AngeloGioacchino Del Regno , , CC: , , , Fedor Pchelkin Content-Language: en-US Organization: Open Mobile Platform Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: msexch01.omp.ru (10.188.4.12) To msexch01.omp.ru (10.188.4.12) X-KSE-ServerInfo: msexch01.omp.ru, 9 X-KSE-AntiSpam-Interceptor-Info: scan successful X-KSE-AntiSpam-Version: 6.1.1, Database issued on: 10/12/2025 17:43:35 X-KSE-AntiSpam-Status: KAS_STATUS_NOT_DETECTED X-KSE-AntiSpam-Method: none X-KSE-AntiSpam-Rate: 19 X-KSE-AntiSpam-Info: Lua profiles 197008 [Oct 12 2025] X-KSE-AntiSpam-Info: Version: 6.1.1.11 X-KSE-AntiSpam-Info: Envelope from: s.shtylyov@omp.ru X-KSE-AntiSpam-Info: LuaCore: 71 0.3.71 ee78c3da48e828d2b9b16d6d0b31328b8b240a3c X-KSE-AntiSpam-Info: {rep_avail} X-KSE-AntiSpam-Info: {Tracking_uf_ne_domains} X-KSE-AntiSpam-Info: {Tracking_from_domain_doesnt_match_to} X-KSE-AntiSpam-Info: {SMTP from is not routable} X-KSE-AntiSpam-Info: {Found in DNSBL: 213.87.133.64 in (user) b.barracudacentral.org} X-KSE-AntiSpam-Info: omp.ru:7.1.1;127.0.0.199:7.1.2;d41d8cd98f00b204e9800998ecf8427e.com:7.1.1 X-KSE-AntiSpam-Info: {Tracking_ip_hunter} X-KSE-AntiSpam-Info: FromAlignment: s X-KSE-AntiSpam-Info: ApMailHostAddress: 213.87.133.64 X-KSE-AntiSpam-Info: {DNS response errors} X-KSE-AntiSpam-Info: Rate: 19 X-KSE-AntiSpam-Info: Status: not_detected X-KSE-AntiSpam-Info: Method: none X-KSE-AntiSpam-Info: Auth:dmarc=temperror header.from=omp.ru;spf=temperror smtp.mailfrom=omp.ru;dkim=none X-KSE-Antiphishing-Info: Clean X-KSE-Antiphishing-ScanningType: Heuristic X-KSE-Antiphishing-Method: None X-KSE-Antiphishing-Bases: 10/12/2025 17:46:00 X-KSE-Antivirus-Interceptor-Info: scan successful X-KSE-Antivirus-Info: Clean, bases: 10/12/2025 3:34:00 PM X-KSE-Attachment-Filter-Triggered-Rules: Clean X-KSE-Attachment-Filter-Triggered-Filters: Clean X-KSE-BulkMessagesFiltering-Scan-Result: InTheLimit Content-Type: text/plain; charset="utf-8" Mediatek MT798x datasheets (that I was able to get my hands on) claim the maximum supported baud rate to be 3 Mbps, while commit 81bb549fdf14 ("serial: 8250_mtk: support big baud rate.") claimed it to be 4 Mbps -- however, it then passed undivided port->uartclk to uart_get_baud_rate() for the maximum baud rate, while the datasheets do mention up to 52 MHz as the baud clock's frequency. This means that an integer overflow will happen (when multiplying the baud variable by 256) if a baud rate higher than 16777215 bps is passed via termios->c_ospeed. Pass the correct max baud rate of 3 Mbps or port->uartclk, whichever happens to be less... Found by Linux Verification Center (linuxtesting.org) with the Svace static analysis tool. Fixes: 81bb549fdf14 ("serial: 8250_mtk: support big baud rate.") Signed-off-by: Sergey Shtylyov --- The patch is against the master branch of Linus Torvalds' linux.git repo (I'm unable to use the other repos on git.kernel.org and I have to update Linus' repo from GitHub). Changes in version 2: - changed the approach to the problem (and hence rewrote the description); - removed "the" article from the subject for brevity. drivers/tty/serial/8250/8250_mtk.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) Index: linux/drivers/tty/serial/8250/8250_mtk.c =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D --- linux.orig/drivers/tty/serial/8250/8250_mtk.c +++ linux/drivers/tty/serial/8250/8250_mtk.c @@ -358,7 +358,7 @@ mtk8250_set_termios(struct uart_port *po */ baud =3D uart_get_baud_rate(port, termios, old, port->uartclk / 16 / UART_DIV_MAX, - port->uartclk); + min(3000000U, port->uartclk)); =20 if (baud < 115200) { serial_port_out(port, MTK_UART_HIGHS, 0x0);