All of lore.kernel.org
 help / color / mirror / Atom feed
From: Lee Jones <lee@kernel.org>
To: lee@kernel.org, "Thierry Reding" <thierry.reding@kernel.org>,
	"Uwe Kleine-König" <ukleinek@kernel.org>,
	"Jonathan Hunter" <jonathanh@nvidia.com>,
	"Mikko Perttunen" <mperttunen@nvidia.com>,
	"Sascha Hauer" <s.hauer@pengutronix.de>,
	"Sandipan Patra" <spatra@nvidia.com>,
	linux-pwm@vger.kernel.org, linux-tegra@vger.kernel.org,
	linux-kernel@vger.kernel.org
Cc: stable@vger.kernel.org
Subject: [PATCH 1/8] pwm: tegra: Prevent 32-bit period truncation and division by zero
Date: Thu,  5 Nov 2026 14:38:03 +0000	[thread overview]
Message-ID: <20261105143847.2559586-2-lee@kernel.org> (raw)
In-Reply-To: <20261105143847.2559586-1-lee@kernel.org>

tegra_pwm_apply() passes the 64-bit state->duty_cycle and state->period
values into tegra_pwm_config(), which accepts signed 32-bit int
parameters and performs DIV_ROUND_CLOSEST_ULL(c, period_ns) before
validating period_ns against pc->min_period_ns.  If a consumer requests
a period that is a non-zero multiple of 2^32 nanoseconds, period_ns
truncates to zero and triggers a divide-by-zero panic.

Widen duty_ns and period_ns to u64 and validate that period_ns lies
within [pc->min_period_ns, U32_MAX] prior to dividing by period_ns.

Fixes: 1d7796bdb63a ("pwm: tegra: Support dynamic clock frequency configuration")
Fixes: fd3ddd4355c0 ("pwm: tegra: Implement .apply() callback")
Closes: https://sashiko.dev/#/bug/linux-5c5b97d6-4da6-4d06-9dc7-957419dcd832
Cc: stable@vger.kernel.org
Signed-off-by: Lee Jones <lee@kernel.org>
---
 drivers/pwm/pwm-tegra.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/drivers/pwm/pwm-tegra.c b/drivers/pwm/pwm-tegra.c
index 5cdbe120ba2d..f99ae2b3a276 100644
--- a/drivers/pwm/pwm-tegra.c
+++ b/drivers/pwm/pwm-tegra.c
@@ -138,7 +138,7 @@ static inline void tegra_pwm_writel(struct pwm_device *pwm, unsigned int offset,
 }
 
 static int tegra_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
-			    int duty_ns, int period_ns)
+			    u64 duty_ns, u64 period_ns)
 {
 	struct tegra_pwm_chip *pc = to_tegra_pwm_chip(chip);
 	unsigned long long c = duty_ns;
@@ -146,6 +146,12 @@ static int tegra_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
 	u32 val = 0;
 	int err;
 
+	/*
+	 *  min period = max clock limit / TEGRA_PWM_DEPTH
+	 */
+	if (period_ns < pc->min_period_ns || period_ns > U32_MAX)
+		return -EINVAL;
+
 	/*
 	 * Convert from duty_ns / period_ns to a fixed number of duty ticks
 	 * per TEGRA_PWM_DEPTH cycles and make sure to round to the
@@ -156,12 +162,6 @@ static int tegra_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
 
 	val = (u32)c << TEGRA_PWM_DUTY_SHIFT;
 
-	/*
-	 *  min period = max clock limit / TEGRA_PWM_DEPTH
-	 */
-	if (period_ns < pc->min_period_ns)
-		return -EINVAL;
-
 	/*
 	 * Compute the prescaler value for which TEGRA_PWM_DEPTH
 	 * cycles at the PWM clock rate will take period_ns nanoseconds.
Cc: Sandipan Patra <spatra@nvidia.com>
Cc: "Uwe Kleine-König" <ukleinek@kernel.org>
-- 
2.56.0.398.g882cbad275-goog


  reply	other threads:[~2026-11-05 14:39 UTC|newest]

Thread overview: 15+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-11-05 14:38 [PATCH 0/8] pwm: Fix various bugs reported by Sashiko Lee Jones
2026-11-05 14:38 ` Lee Jones [this message]
2026-11-05 15:46   ` [PATCH 1/8] pwm: tegra: Prevent 32-bit period truncation and division by zero Uwe Kleine-König
2026-11-05 14:38 ` [PATCH 2/8] pwm: mxs: Return early when disabling and fix error-path clock leak Lee Jones
2026-11-05 16:50   ` Frank Li
2026-11-05 14:38 ` [PATCH 3/8] pwm: loongson: Fix 32-bit control register truncation in pwm_loongson_set_polarity() Lee Jones
2026-11-05 14:38 ` [PATCH 4/8] pwm: axi-pwmgen: Enable clocks before accessing hardware registers in probe() Lee Jones
2026-11-05 15:48   ` Uwe Kleine-König
2026-11-05 18:26     ` Lee Jones
2026-11-05 18:26       ` Lee Jones
2026-11-06 13:01   ` Nuno Sá
2026-11-05 14:38 ` [PATCH 5/8] pwm: fsl-ftm: Enable ipg_clk around regcache_sync() during resume Lee Jones
2026-11-05 14:38 ` [PATCH 6/8] pwm: omap-dmtimer: Handle negative error codes from get_pwm_status() Lee Jones
2026-11-05 14:38 ` [PATCH 7/8] pwm: tiehrpwm: Enable runtime PM before registering PWM chip Lee Jones
2026-11-05 14:38 ` [PATCH 8/8] pwm: img: Unregister PWM chip before disabling runtime PM and clocks Lee Jones

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20261105143847.2559586-2-lee@kernel.org \
    --to=lee@kernel.org \
    --cc=jonathanh@nvidia.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-pwm@vger.kernel.org \
    --cc=linux-tegra@vger.kernel.org \
    --cc=mperttunen@nvidia.com \
    --cc=s.hauer@pengutronix.de \
    --cc=spatra@nvidia.com \
    --cc=stable@vger.kernel.org \
    --cc=thierry.reding@kernel.org \
    --cc=ukleinek@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.