Linux Tegra architecture development
 help / color / mirror / Atom feed
From: Lee Jones <lee@kernel.org>
To: lee@kernel.org, "Thierry Reding" <thierry.reding@kernel.org>,
	"Uwe Kleine-König" <ukleinek@kernel.org>,
	"Jonathan Hunter" <jonathanh@nvidia.com>,
	"Mikko Perttunen" <mperttunen@nvidia.com>,
	"Sascha Hauer" <s.hauer@pengutronix.de>,
	"Sandipan Patra" <spatra@nvidia.com>,
	linux-pwm@vger.kernel.org, linux-tegra@vger.kernel.org,
	linux-kernel@vger.kernel.org
Cc: stable@vger.kernel.org
Subject: [PATCH 1/8] pwm: tegra: Prevent 32-bit period truncation and division by zero
Date: Thu,  5 Nov 2026 14:38:03 +0000	[thread overview]
Message-ID: <20261105143847.2559586-2-lee@kernel.org> (raw)
In-Reply-To: <20261105143847.2559586-1-lee@kernel.org>

tegra_pwm_apply() passes the 64-bit state->duty_cycle and state->period
values into tegra_pwm_config(), which accepts signed 32-bit int
parameters and performs DIV_ROUND_CLOSEST_ULL(c, period_ns) before
validating period_ns against pc->min_period_ns.  If a consumer requests
a period that is a non-zero multiple of 2^32 nanoseconds, period_ns
truncates to zero and triggers a divide-by-zero panic.

Widen duty_ns and period_ns to u64 and validate that period_ns lies
within [pc->min_period_ns, U32_MAX] prior to dividing by period_ns.

Fixes: 1d7796bdb63a ("pwm: tegra: Support dynamic clock frequency configuration")
Fixes: fd3ddd4355c0 ("pwm: tegra: Implement .apply() callback")
Closes: https://sashiko.dev/#/bug/linux-5c5b97d6-4da6-4d06-9dc7-957419dcd832
Cc: stable@vger.kernel.org
Signed-off-by: Lee Jones <lee@kernel.org>
---
 drivers/pwm/pwm-tegra.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/drivers/pwm/pwm-tegra.c b/drivers/pwm/pwm-tegra.c
index 5cdbe120ba2d..f99ae2b3a276 100644
--- a/drivers/pwm/pwm-tegra.c
+++ b/drivers/pwm/pwm-tegra.c
@@ -138,7 +138,7 @@ static inline void tegra_pwm_writel(struct pwm_device *pwm, unsigned int offset,
 }
 
 static int tegra_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
-			    int duty_ns, int period_ns)
+			    u64 duty_ns, u64 period_ns)
 {
 	struct tegra_pwm_chip *pc = to_tegra_pwm_chip(chip);
 	unsigned long long c = duty_ns;
@@ -146,6 +146,12 @@ static int tegra_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
 	u32 val = 0;
 	int err;
 
+	/*
+	 *  min period = max clock limit / TEGRA_PWM_DEPTH
+	 */
+	if (period_ns < pc->min_period_ns || period_ns > U32_MAX)
+		return -EINVAL;
+
 	/*
 	 * Convert from duty_ns / period_ns to a fixed number of duty ticks
 	 * per TEGRA_PWM_DEPTH cycles and make sure to round to the
@@ -156,12 +162,6 @@ static int tegra_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
 
 	val = (u32)c << TEGRA_PWM_DUTY_SHIFT;
 
-	/*
-	 *  min period = max clock limit / TEGRA_PWM_DEPTH
-	 */
-	if (period_ns < pc->min_period_ns)
-		return -EINVAL;
-
 	/*
 	 * Compute the prescaler value for which TEGRA_PWM_DEPTH
 	 * cycles at the PWM clock rate will take period_ns nanoseconds.
Cc: Sandipan Patra <spatra@nvidia.com>
Cc: "Uwe Kleine-König" <ukleinek@kernel.org>
-- 
2.56.0.398.g882cbad275-goog


  reply	other threads:[~2026-11-05 14:39 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-11-05 14:38 [PATCH 0/8] pwm: Fix various bugs reported by Sashiko Lee Jones
2026-11-05 14:38 ` Lee Jones [this message]
2026-11-05 15:46   ` [PATCH 1/8] pwm: tegra: Prevent 32-bit period truncation and division by zero Uwe Kleine-König

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20261105143847.2559586-2-lee@kernel.org \
    --to=lee@kernel.org \
    --cc=jonathanh@nvidia.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-pwm@vger.kernel.org \
    --cc=linux-tegra@vger.kernel.org \
    --cc=mperttunen@nvidia.com \
    --cc=s.hauer@pengutronix.de \
    --cc=spatra@nvidia.com \
    --cc=stable@vger.kernel.org \
    --cc=thierry.reding@kernel.org \
    --cc=ukleinek@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox