github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-22 12:44:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

phy: rockchip: samsung-hdptx: Guard against clk rate integer underflow

Browse Source 
The 'fout' subtraction in rk_hdptx_phy_clk_calc_rate_from_pll_cfg()
could result in an integer underflow, if the hardware registers are
misconfigured or contain uninitialized values, such that the computed
sigma-delta modulator offset sdm exceeds the base frequency fout.

This might lead to an absurdly high clock rate being returned to the
Common Clock Framework, with unpredictable effects on downstream clk
consumers.

Provide the necessary sanitization to avoid trusting the hardware state.

Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/all/20260611235702.0E9691F000E9@smtp.kernel.org/
Fixes: 3481fc04d9 ("phy: rockchip: samsung-hdptx: Compute clk rate from PLL config")
Signed-off-by: Cristian Ciocaltea <cristian.ciocaltea@collabora.com>
Link: https://patch.msgid.link/20260811-hdptx-clk-fixes-v6-3-75bca0ee5753@collabora.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
This commit is contained in:
Cristian Ciocaltea 2026-08-11 18:44:44 +03:00 committed by Vinod Koul
parent c4fe5a9f37
commit 229788526f
1 changed files with 12 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
drivers/phy/rockchip/phy-rockchip-samsung-hdptx.c
View File

@ -2285,10 +2285,20 @@ static u64 rk_hdptx_phy_clk_calc_rate_from_pll_cfg(struct rk_hdptx_phy *hdptx)
sdm = div_u64(PLL_REF_CLK * ropll_hw.sdc_deno *
ropll_hw.pms_mdiv * ropll_hw.sdm_num, val);
if (ropll_hw.sdm_num_sign)
if (ropll_hw.sdm_num_sign) {
if (sdm > fout) {
/*
* Similarly to the case above, it is expected
* the next .set_rate() will help with recovery.
*/
dev_dbg(hdptx->dev, "Invalid ROPLL hw state: sdm > fout\n");
return 0;
}
fout = fout - sdm;
else
} else {
fout = fout + sdm;
}
}
return DIV_ROUND_CLOSEST_ULL(fout * 2 * 8, ropll_hw.pms_sdiv * 10 * bpc);