linux-kernel - Re: [PATCH v3] serial: 8250_mtk: correct max baud rate in set

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20251019162744-e3ac865925bae161b0193e70-pchelkin@ispras>
Date: Sun, 19 Oct 2025 16:32:46 +0300
From: Fedor Pchelkin <pchelkin@...ras.ru>
To: Sergey Shtylyov <s.shtylyov@....ru>, 
	Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Cc: Jiri Slaby <jirislaby@...nel.org>, 
	Matthias Brugger <matthias.bgg@...il.com>, 
	AngeloGioacchino Del Regno <angelogioacchino.delregno@...labora.com>, linux-serial@...r.kernel.org, linux-kernel@...r.kernel.org, 
	linux-arm-kernel@...ts.infradead.org, linux-mediatek@...ts.infradead.org, lvc-project@...uxtesting.org, 
	Eddie Huang <eddie.huang@...iatek.com>
Subject: Re: [PATCH v3] serial: 8250_mtk: correct max baud rate in
 set_termios() method

On Sat, 18. Oct 23:44, Sergey Shtylyov wrote:
> Commit 81bb549fdf14 ("serial: 8250_mtk: support big baud rate.") claimed
> the maximum supported baud rate to be 4 Mbps; of the Mediatek datasheets
> (I was able to get my hands on), only MT7987A datasheet did support this
> claim and MT7981B/88A datasheets disagreed, claiming just 3 Mbps maximum.
> However, this commit failed to enforce even the claimed maximum, passing
> port->uartclk to uart_get_baud_rate() for the maximum baud rate -- while
> the datasheets mention up to 52 MHz for the baud clock's frequency. This
> means that an integer overflow would happen (when multiplying the baud
> variable by 256) if a baud rate higher than 16777215 bps is passed via
> termios->c_ospeed (division by 0 will also happen when exactly 16777216
> bps is passed). Pass to uart_get_baud_rate() the documented maximum of
> 4 Mbps or port->uartclk (whichever happens to be lesser) -- this way,
> we can avoid both overflows and regression with the maximum baud rate...
> 
> Found by Linux Verification Center (linuxtesting.org) with the Svace static
> analysis tool.
> 
> Fixes: 81bb549fdf14 ("serial: 8250_mtk: support big baud rate.")
> Signed-off-by: Sergey Shtylyov <s.shtylyov@....ru>

Tested-by: Fedor Pchelkin <pchelkin@...ras.ru>

on Banana Pi BPI-R4 with MediaTek MT7988A chipset.

Thanks!

> 
> ---
> This patch is against the tty-linus branch of Greg KH's 'tty.git' repo.
> 
> Changes in version #3:
> - updated the maximum baud rate to 4 Mbps;
> - rewrote the description again, adding more info on the MT798x datasheets
>   studied, on how the bug manifests iself, and on the solution.
> 
> Changes in version #2:
> - changed the approach to the problem (and hence rewrote the description);
> - removed "the" article from the subject for brevity.
> 
>  drivers/tty/serial/8250/8250_mtk.c |    2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> Index: tty/drivers/tty/serial/8250/8250_mtk.c
> ===================================================================
> --- tty.orig/drivers/tty/serial/8250/8250_mtk.c
> +++ tty/drivers/tty/serial/8250/8250_mtk.c
> @@ -358,7 +358,7 @@ mtk8250_set_termios(struct uart_port *po
>  	 */
>  	baud = uart_get_baud_rate(port, termios, old,
>  				  port->uartclk / 16 / UART_DIV_MAX,
> -				  port->uartclk);
> +				  min(4000000U, port->uartclk));
>  
>  	if (baud < 115200) {
>  		serial_port_out(port, MTK_UART_HIGHS, 0x0);