On Mon, 21 Sep 2026, Hui Peng wrote:

> In uart_get_baud_rate(), when the requested baud rate is out of range
> (try == 0) and old is non-NULL, the function copies the old termios baud
> rate into termios, sets old = NULL, and continues to try == 1. If the
> old baud rate is also out of range (for instance, after uport->uartclk
> was lowered via TIOCSSERIAL so max = uport->uartclk / 16 is smaller than
> both the old and new baud rates), try == 1 clips baud to [min + 1,
> max - 1] and encodes it into termios via tty_termios_encode_baud_rate().
> 
> However, because the loop bound is for (try = 0; try < 2; try++), the
> loop terminates immediately after try == 1 without re-evaluating
> baud = tty_termios_baud_rate(termios) for the clipped rate, hitting
> WARN_ON(1) and returning 0, which then triggers a fatal divide-by-zero
> (Oops: divide error) in uart_get_divisor():
> 
>   WARNING: drivers/tty/serial/serial_core.c:548 at uart_get_baud_rate+0x136/0x260, CPU#1: init/1
>   ...
>   Oops: divide error: 0000 [#1] SMP KASAN PTI
>   CPU: 1 UID: 0 PID: 1 Comm: init Tainted: G        W        N  7.3.0-rc3-g5dd1818b15d9 #1 PREEMPT(lazy)
>   RIP: 0010:uart_get_divisor+0x5b/0x100
>   Call Trace:
>    <TASK>
>    serial8250_get_divisor+0x123/0x1a0
>    serial8250_do_set_termios+0x21e/0x1610
>    serial8250_set_termios+0x77/0x90
>    uart_change_line_settings+0xf6/0x720
>    uart_set_termios+0x1c1/0x5b0
>    tty_set_termios+0x5f7/0x920
>    set_termios+0x533/0x7d0
>    tty_mode_ioctl+0x8e4/0xd10
>    n_tty_ioctl_helper+0x3c/0x270
>    n_tty_ioctl+0x4e/0x2c0
>    tty_ioctl+0x1028/0x1480
>    __x64_sys_ioctl+0x184/0x1d0
>    do_syscall_64+0xda/0x4b0
> 
> Increase the loop limit to try < 3 so that the clipped baud rate encoded
> on try == 1 is evaluated and returned on try == 2.
> 
> Tested in QEMU against Linux 7.3.0-rc3 by setting /dev/ttyS1 to B115200,
> lowering baud_base to 9600 (max = 9600) via TIOCSSERIAL, and calling
> tcsetattr() with B57600 (old = B115200), reproducing the WARNING and
> Oops: divide error in uart_get_divisor() on the unfixed kernel and
> verifying clean execution with 0 warnings/faults with the fix applied.
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Fixes: 091ea8e5d34e ("serial: core: prevent division by zero by always returning non-zero baud rate")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Hui Peng <benquike@gmail.com>
> ---
> Changes in v2:
> - Split out from the 8250_core.c and uart_set_info() changes into patch
>   2/3, add Cc: stable@vger.kernel.org, and include the QEMU reproducer test
>   details and kernel stack trace, as requested by Greg Kroah-Hartman.
> 
>  drivers/tty/serial/serial_core.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
> index 95774b0f1484..128fc056f5c9 100644
> --- a/drivers/tty/serial/serial_core.c
> +++ b/drivers/tty/serial/serial_core.c
> @@ -501,7 +501,7 @@ uart_get_baud_rate(struct uart_port *port, struct ktermios *termios,
>  		break;
>  	}
>  
> -	for (try = 0; try < 2; try++) {
> +	for (try = 0; try < 3; try++) {
>  		baud = tty_termios_baud_rate(termios);
>  
>  		/*
> 

Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>

-- 
 i.