From: Sureshkumar S can_calc_bittiming() rates each candidate against the requested bitrate with: bitrate_error = abs(bt->bitrate - bitrate); Both operands are unsigned int, so the subtraction wraps instead of becoming negative, and abs() resolves an unsigned int argument to its int branch. A wrapped difference is therefore reinterpreted as a small positive value instead of the large error it actually represents. A requested bitrate far above anything the controller can reach then passes the CAN_CALC_MAX_ERROR gate. On a dummy_can device with a 160 MHz clock, requesting 4294967294 bps reports an error of 0.01%, configures 415584 bps and returns success to userspace, where -EINVAL is expected. Use abs_diff(), which subtracts the smaller operand from the larger one and keeps the whole comparison unsigned. Fixes: 7da29f97d6c8 ("can: dev: can-calc-bit-timing(): better sample point calculation") Signed-off-by: Sureshkumar S Link: https://patch.msgid.link/20260803091426.29050-3-ssureshmsd7@gmail.com Cc: stable@kernel.org Signed-off-by: Marc Kleine-Budde --- drivers/net/can/dev/calc_bittiming.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/can/dev/calc_bittiming.c b/drivers/net/can/dev/calc_bittiming.c index 4809f5e0c96e..2789b99ab6a8 100644 --- a/drivers/net/can/dev/calc_bittiming.c +++ b/drivers/net/can/dev/calc_bittiming.c @@ -132,7 +132,7 @@ int can_calc_bittiming(const struct net_device *dev, struct can_bittiming *bt, continue; bitrate = priv->clock.freq / (brp * tsegall); - bitrate_error = abs(bt->bitrate - bitrate); + bitrate_error = abs_diff(bt->bitrate, bitrate); /* tseg brp biterror */ if (bitrate_error > best_bitrate_error) -- 2.53.0