Re: [PATCH v4 2/3] serial: core: allow third iteration in uart_get_baud_rate() fallback

[Andy Shevchenko <andriy.shevchenko@linux.intel.com>]

On Thu, Sep 24, 2026 at 06:04:45AM +0000, Hui Peng wrote:
> In uart_get_baud_rate(), when the requested baud rate is out of range
> (try == 0) and old is non-NULL, the function copies the old termios baud
> rate into termios, sets old = NULL, and continues to try == 1. If the
> old baud rate is also out of range (for instance, after uport->uartclk
> was lowered via TIOCSSERIAL so max = uport->uartclk / 16 is smaller than
> both the old and new baud rates), try == 1 clips baud to [min + 1,
> max - 1] and encodes it into termios via tty_termios_encode_baud_rate().
> 
> However, because the loop bound is for (try = 0; try < 2; try++), the
> loop terminates immediately after try == 1 without re-evaluating
> baud = tty_termios_baud_rate(termios) for the clipped rate, hitting
> WARN_ON(1) and returning 0, which then triggers a fatal divide-by-zero
> (Oops: divide error) in uart_get_divisor():

>   WARNING: drivers/tty/serial/serial_core.c:548 at uart_get_baud_rate+0x136/0x260, CPU#1: init/1
>   ...
>   Oops: divide error: 0000 [#1] SMP KASAN PTI
>   CPU: 1 UID: 0 PID: 1 Comm: init Tainted: G        W        N  7.3.0-rc3-g5dd1818b15d9 #1 PREEMPT(lazy)
>   RIP: 0010:uart_get_divisor+0x5b/0x100
>   Call Trace:
>    <TASK>
>    serial8250_get_divisor+0x123/0x1a0
>    serial8250_do_set_termios+0x21e/0x1610
>    serial8250_set_termios+0x77/0x90
>    uart_change_line_settings+0xf6/0x720
>    uart_set_termios+0x1c1/0x5b0
>    tty_set_termios+0x5f7/0x920
>    set_termios+0x533/0x7d0
>    tty_mode_ioctl+0x8e4/0xd10
>    n_tty_ioctl_helper+0x3c/0x270
>    n_tty_ioctl+0x4e/0x2c0
>    tty_ioctl+0x1028/0x1480
>    __x64_sys_ioctl+0x184/0x1d0
>    do_syscall_64+0xda/0x4b0

Submitting Patches suggests to leave only ~3-5 *significant (or important)
lines of traceback. At very brief look the last 7 do not add any valuable
information.

> Increase the loop limit to try < 3 so that the clipped baud rate encoded
> on try == 1 is evaluated and returned on try == 2.
> 
> Tested in QEMU against Linux 7.3.0-rc3 by setting /dev/ttyS1 to B115200,
> lowering baud_base to 9600 (max = 9600) via TIOCSSERIAL, and calling
> tcsetattr() with B57600 (old = B115200), reproducing the WARNING and
> Oops: divide error in uart_get_divisor() on the unfixed kernel and
> verifying clean execution with 0 warnings/faults with the fix applied.

-- 
With Best Regards,
Andy Shevchenko