When uart_get_baud_rate() is called with a baud rate exceeding the port's maximum supported speed (port->uartclk / 16), it clips baud to [min, max - 1] and encodes it into termios via tty_termios_encode_baud_rate(). However, because the loop bound is for (try = 0; try < 2; try++), the loop terminates immediately after try == 1 without re-evaluating baud = tty_termios_baud_rate(termios) for the clipped rate, hitting WARN_ON(1) and returning 0, which then triggers a fatal divide-by-zero (Oops: divide error) in uart_get_divisor(): WARNING: drivers/tty/serial/serial_core.c:548 at uart_get_baud_rate+0x136/0x260 [ ... ] divide error: 0000 [#1] PREEMPT SMP KASAN Increase the retry count in uart_get_baud_rate() from 2 to 3 iterations so that clipped baud rates are re-evaluated in the third iteration. Tested in QEMU against Linux 7.3.0-rc3 by setting B4000000 on /dev/ttyS0 via tcsetattr(): on the unfixed kernel it triggers WARN_ON(1) and divide-by-zero Oops, whereas with this fix applied uart_get_baud_rate() smoothly falls back to 115200 without error. Fixes: 091ea8e5d34e ("serial: core: prevent division by zero by always returning non-zero baud rate") Cc: stable@vger.kernel.org Reviewed-by: Ilpo Järvinen Assisted-by: LLM Signed-off-by: Hui Peng --- drivers/tty/serial/serial_core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c index f91bcfa30113..6ed0195e6912 100644 --- a/drivers/tty/serial/serial_core.c +++ b/drivers/tty/serial/serial_core.c @@ -470,7 +470,7 @@ unsigned int uart_get_baud_rate(struct uart_port *port, struct ktermios *termi * Ask the low level driver to verify the baud rate if it can't * then it will have encode_baud_rate set the Closet else . */ - for (try = 0; try < 2; try++) { + for (try = 0; try < 3; try++) { baud = tty_termios_baud_rate(termios); /* -- 2.47.3