Re: [PATCH] char: hpet: prevent hard-IRQ divide-by-zero in hpet_interrupt() via HPET_IRQFREQ

[Greg Kroah-Hartman]

On Sat, Sep 19, 2026 at 08:35:15PM +0000, Hui Peng wrote:
> In hpet_ioctl_common(), HPET_IRQFREQ sets:
> 
>         devp->hd_ireqfreq = hpet_time_div(hpetp, arg);
> 
> where hpet_time_div() computes (hpetp->hp_tick_freq + (arg >> 1)) / arg.
> Whenever arg > 2 * hpetp->hp_tick_freq, integer division yields 0 and
> sets devp->hd_ireqfreq = 0. In addition, HPET_IRQFREQ allows updating
> devp->hd_ireqfreq while timer interrupts (HPET_IE) are already enabled.
> 
> When the armed HPET timer interrupt fires, hpet_interrupt() executes:
> 
>         base = mc % devp->hd_ireqfreq;
> 
> in hard-IRQ context with devp->hd_ireqfreq == 0, triggering an immediate
> divide error (#DE) kernel Oops.
> 
> Reject HPET_IRQFREQ with -EBUSY when HPET_IE is already enabled, and
> reject arg values where hpet_time_div(hpetp, arg) == 0 with -EINVAL.
> 
> Fixes: ba3f213f8a31 ("[PATCH] HPET: make frequency calculations 32 bit safe")
> Assisted-by: LLM
> Signed-off-by: Hui Peng <benquike@xxxxxxxxx>
> ---


How was this tested?

Why no cc: stable?

Please slow down.

greg k-h