On Tue, 22 Sep 2026, Hui Peng wrote:

> In uart_set_info(), new_info->baud_base is multiplied by 16 and stored in
> uport->uartclk (an unsigned int):
> 
>   uport->uartclk = new_info->baud_base * 16;
> 
> While uart_set_info() checks if (uartclk == 0) and
> if (new_info->baud_base < 9600), when new_info->baud_base exceeds
> UINT_MAX / 16 with low bits set (for example, 0x10000001), multiplying
> by 16 wraps around in 32-bit unsigned arithmetic to a small non-zero value
> (16), bypassing both uartclk == 0 and new_info->baud_base < 9600 and
> setting uport->uartclk = 16 (baud_base = 1, well below the required
> minimum of 9600 * 16).
> 
> Reject new_info->baud_base > UINT_MAX / 16 alongside the uartclk == 0
> check in uart_set_info().
> 
> Tested in QEMU against Linux 7.3.0-rc3 by calling ioctl(fd, TIOCSSERIAL,
> &ss) with ss.baud_base = 0x10000001 on /dev/ttyS1: on the unfixed kernel
> TIOCSSERIAL succeeds (ret = 0) and wraps uport->uartclk to 16
> (TIOCGSERIAL reports baud_base = 1), whereas with the fix applied
> TIOCSSERIAL returns -EINVAL and preserves the existing uport->uartclk.
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Fixes: 6eabce6608d6 ("serial: core: check uartclk for zero to avoid divide by zero")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Hui Peng <benquike@gmail.com>
> ---
> Changes in v3:
> - Add missing #include <linux/limits.h> for UINT_MAX and move the
>   new_info->baud_base > UINT_MAX / 16 check to the uartclk == 0 check, as
>   suggested by Ilpo Järvinen.
> 
> Changes in v2:
> - Split out into patch 3/3 of the series, add Cc: stable@vger.kernel.org,
>   and document the QEMU test method, as requested by Greg Kroah-Hartman.
> 
>  drivers/tty/serial/serial_core.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
> index 3845fb582f45..362dd6648ba4 100644
> --- a/drivers/tty/serial/serial_core.c
> +++ b/drivers/tty/serial/serial_core.c
> @@ -16,6 +16,7 @@
>  #include <linux/console.h>
>  #include <linux/gpio/consumer.h>
>  #include <linux/kernel.h>
> +#include <linux/limits.h>
>  #include <linux/of.h>
>  #include <linux/pm_runtime.h>
>  #include <linux/proc_fs.h>
> @@ -933,7 +934,7 @@ static int uart_set_info(struct tty_struct *tty, struct tty_port *port,
>  	if (!(uport->flags & UPF_FIXED_PORT)) {
>  		unsigned int uartclk = new_info->baud_base * 16;
>  		/* check needs to be done here before other settings made */
> -		if (uartclk == 0)
> +		if (uartclk == 0 || new_info->baud_base > UINT_MAX / 16)

Logically it would make more sense to check the overflow before 
multiplying even if this order too produces the "correct" result.

>  			return -EINVAL;
>  	}
>  	if (!capable(CAP_SYS_ADMIN)) {
> 

-- 
 i.