Commit 81bb549fdf14 ("serial: 8250_mtk: support big baud rate.") claimed
the maximum supported baud rate to be 4 Mbps; of the Mediatek datasheets
(I was able to get my hands on), only MT7987A datasheet did support this
claim and MT7981B/88A datasheets disagreed, claiming just 3 Mbps maximum.
However, this commit failed to enforce even the claimed maximum, passing
port->uartclk to uart_get_baud_rate() for the maximum baud rate -- while
the datasheets mention up to 52 MHz for the baud clock's frequency. This
means that an integer overflow would happen (when multiplying the baud
variable by 256) if a baud rate higher than 16777215 bps is passed via
termios->c_ospeed (division by 0 will also happen when exactly 16777216
bps is passed). Pass to uart_get_baud_rate() the documented maximum of
4 Mbps or port->uartclk (whichever happens to be lesser) -- this way,
we can avoid both overflows and regression with the maximum baud rate...

Found by Linux Verification Center (linuxtesting.org) with the Svace static
analysis tool.

Fixes: 81bb549fdf14 ("serial: 8250_mtk: support big baud rate.")
Signed-off-by: Sergey Shtylyov <s.shtylyov@omp.ru>

---
This patch is against the tty-linus branch of Greg KH's 'tty.git' repo.

Changes in version #3:
- updated the maximum baud rate to 4 Mbps;
- rewrote the description again, adding more info on the MT798x datasheets
  studied, on how the bug manifests iself, and on the solution.

Changes in version #2:
- changed the approach to the problem (and hence rewrote the description);
- removed "the" article from the subject for brevity.

 drivers/tty/serial/8250/8250_mtk.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Index: tty/drivers/tty/serial/8250/8250_mtk.c
===================================================================
--- tty.orig/drivers/tty/serial/8250/8250_mtk.c
+++ tty/drivers/tty/serial/8250/8250_mtk.c
@@ -358,7 +358,7 @@ mtk8250_set_termios(struct uart_port *po
 	 */
 	baud = uart_get_baud_rate(port, termios, old,
 				  port->uartclk / 16 / UART_DIV_MAX,
-				  port->uartclk);
+				  min(4000000U, port->uartclk));
 
 	if (baud < 115200) {
 		serial_port_out(port, MTK_UART_HIGHS, 0x0);

On Sat, 18. Oct 23:44, Sergey Shtylyov wrote:
> Commit 81bb549fdf14 ("serial: 8250_mtk: support big baud rate.") claimed
> the maximum supported baud rate to be 4 Mbps; of the Mediatek datasheets
> (I was able to get my hands on), only MT7987A datasheet did support this
> claim and MT7981B/88A datasheets disagreed, claiming just 3 Mbps maximum.
> However, this commit failed to enforce even the claimed maximum, passing
> port->uartclk to uart_get_baud_rate() for the maximum baud rate -- while
> the datasheets mention up to 52 MHz for the baud clock's frequency. This
> means that an integer overflow would happen (when multiplying the baud
> variable by 256) if a baud rate higher than 16777215 bps is passed via
> termios->c_ospeed (division by 0 will also happen when exactly 16777216
> bps is passed). Pass to uart_get_baud_rate() the documented maximum of
> 4 Mbps or port->uartclk (whichever happens to be lesser) -- this way,
> we can avoid both overflows and regression with the maximum baud rate...
> 
> Found by Linux Verification Center (linuxtesting.org) with the Svace static
> analysis tool.
> 
> Fixes: 81bb549fdf14 ("serial: 8250_mtk: support big baud rate.")
> Signed-off-by: Sergey Shtylyov <s.shtylyov@omp.ru>

Tested-by: Fedor Pchelkin <pchelkin@ispras.ru>

on Banana Pi BPI-R4 with MediaTek MT7988A chipset.

Thanks!

> 
> ---
> This patch is against the tty-linus branch of Greg KH's 'tty.git' repo.
> 
> Changes in version #3:
> - updated the maximum baud rate to 4 Mbps;
> - rewrote the description again, adding more info on the MT798x datasheets
>   studied, on how the bug manifests iself, and on the solution.
> 
> Changes in version #2:
> - changed the approach to the problem (and hence rewrote the description);
> - removed "the" article from the subject for brevity.
> 
>  drivers/tty/serial/8250/8250_mtk.c |    2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> Index: tty/drivers/tty/serial/8250/8250_mtk.c
> ===================================================================
> --- tty.orig/drivers/tty/serial/8250/8250_mtk.c
> +++ tty/drivers/tty/serial/8250/8250_mtk.c
> @@ -358,7 +358,7 @@ mtk8250_set_termios(struct uart_port *po
>  	 */
>  	baud = uart_get_baud_rate(port, termios, old,
>  				  port->uartclk / 16 / UART_DIV_MAX,
> -				  port->uartclk);
> +				  min(4000000U, port->uartclk));
>  
>  	if (baud < 115200) {
>  		serial_port_out(port, MTK_UART_HIGHS, 0x0);