From: Lee Jones <lee@kernel.org>
To: lee@kernel.org, "Thierry Reding" <thierry.reding@kernel.org>,
"Uwe Kleine-König" <ukleinek@kernel.org>,
"Jonathan Hunter" <jonathanh@nvidia.com>,
"Mikko Perttunen" <mperttunen@nvidia.com>,
"Sascha Hauer" <s.hauer@pengutronix.de>,
"Sandipan Patra" <spatra@nvidia.com>,
linux-pwm@vger.kernel.org, linux-tegra@vger.kernel.org,
linux-kernel@vger.kernel.org
Cc: stable@vger.kernel.org
Subject: [PATCH 1/8] pwm: tegra: Prevent 32-bit period truncation and division by zero
Date: Thu, 5 Nov 2026 14:38:03 +0000 [thread overview]
Message-ID: <20261105143847.2559586-2-lee@kernel.org> (raw)
In-Reply-To: <20261105143847.2559586-1-lee@kernel.org>
tegra_pwm_apply() passes the 64-bit state->duty_cycle and state->period
values into tegra_pwm_config(), which accepts signed 32-bit int
parameters and performs DIV_ROUND_CLOSEST_ULL(c, period_ns) before
validating period_ns against pc->min_period_ns. If a consumer requests
a period that is a non-zero multiple of 2^32 nanoseconds, period_ns
truncates to zero and triggers a divide-by-zero panic.
Widen duty_ns and period_ns to u64 and validate that period_ns lies
within [pc->min_period_ns, U32_MAX] prior to dividing by period_ns.
Fixes: 1d7796bdb63a ("pwm: tegra: Support dynamic clock frequency configuration")
Fixes: fd3ddd4355c0 ("pwm: tegra: Implement .apply() callback")
Closes: https://sashiko.dev/#/bug/linux-5c5b97d6-4da6-4d06-9dc7-957419dcd832
Cc: stable@vger.kernel.org
Signed-off-by: Lee Jones <lee@kernel.org>
---
drivers/pwm/pwm-tegra.c | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
diff --git a/drivers/pwm/pwm-tegra.c b/drivers/pwm/pwm-tegra.c
index 5cdbe120ba2d..f99ae2b3a276 100644
--- a/drivers/pwm/pwm-tegra.c
+++ b/drivers/pwm/pwm-tegra.c
@@ -138,7 +138,7 @@ static inline void tegra_pwm_writel(struct pwm_device *pwm, unsigned int offset,
}
static int tegra_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
- int duty_ns, int period_ns)
+ u64 duty_ns, u64 period_ns)
{
struct tegra_pwm_chip *pc = to_tegra_pwm_chip(chip);
unsigned long long c = duty_ns;
@@ -146,6 +146,12 @@ static int tegra_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
u32 val = 0;
int err;
+ /*
+ * min period = max clock limit / TEGRA_PWM_DEPTH
+ */
+ if (period_ns < pc->min_period_ns || period_ns > U32_MAX)
+ return -EINVAL;
+
/*
* Convert from duty_ns / period_ns to a fixed number of duty ticks
* per TEGRA_PWM_DEPTH cycles and make sure to round to the
@@ -156,12 +162,6 @@ static int tegra_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
val = (u32)c << TEGRA_PWM_DUTY_SHIFT;
- /*
- * min period = max clock limit / TEGRA_PWM_DEPTH
- */
- if (period_ns < pc->min_period_ns)
- return -EINVAL;
-
/*
* Compute the prescaler value for which TEGRA_PWM_DEPTH
* cycles at the PWM clock rate will take period_ns nanoseconds.
Cc: Sandipan Patra <spatra@nvidia.com>
Cc: "Uwe Kleine-König" <ukleinek@kernel.org>
--
2.56.0.398.g882cbad275-goog
next prev parent reply other threads:[~2026-11-05 14:39 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-11-05 14:38 [PATCH 0/8] pwm: Fix various bugs reported by Sashiko Lee Jones
2026-11-05 14:38 ` Lee Jones [this message]
2026-11-05 15:46 ` [PATCH 1/8] pwm: tegra: Prevent 32-bit period truncation and division by zero Uwe Kleine-König
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261105143847.2559586-2-lee@kernel.org \
--to=lee@kernel.org \
--cc=jonathanh@nvidia.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-pwm@vger.kernel.org \
--cc=linux-tegra@vger.kernel.org \
--cc=mperttunen@nvidia.com \
--cc=s.hauer@pengutronix.de \
--cc=spatra@nvidia.com \
--cc=stable@vger.kernel.org \
--cc=thierry.reding@kernel.org \
--cc=ukleinek@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox