linux-kernel - [bug] Kernel page fault in COMEDI 8255 driver

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <485c192.33262.19ad40786c1.Coremail.xudongjie25@mails.ucas.ac.cn>
Date: Sun, 30 Nov 2025 17:10:54 +0800 (GMT+08:00)
From: 许东洁 <xudongjie25@...ls.ucas.ac.cn>
To: Abbott <abbotti@....co.uk>, Sweeten <hsweeten@...ionengravers.com>
Cc: linux-kernel@...r.kernel.org
Subject: [bug] Kernel page fault in COMEDI 8255 driver

Hello,

A kernel page fault vulnerability was discovered in the COMEDI 8255 subsystem 
using the syzkaller fuzzing tool.

The issue occurs when initializing multiple 8255 subdevices with mixed valid 
and conflicting I/O port addresses. The driver fails to properly handle the 
cleanup of subdevices with port conflicts, leading to invalid memory access.

Specific mechanism:
- In dev_8255_attach() in drivers/comedi/drivers/8255.c, when 
  __comedi_request_region() fails due to I/O port conflicts, the subdevice 
  is marked as COMEDI_SUBD_UNUSED
- However, subsequent successful subdevice initializations set global state 
  that affects all subdevices
- When user space later attempts I/O operations on the conflicting subdevices, 
  subdev_8255_io() in drivers/comedi/drivers/comedi_8255.c uses invalid 
  address calculations
- This results in a kernel page fault when executing outb instruction with 
  invalid I/O address

Crash signature:
BUG: unable to handle kernel paging request in subdev_8255_io
#PF: supervisor write access in kernel mode
#PF: error_code(0x0003) - permissions violation

Call trace:
subdev_8255_io() -&gt; outb() with invalid address

Config file: https://github.com/j1akai/KConfigFuzz_bug/blob/main/x86/mainline-config
Additional fuzzing context(report file, reproduce file, etc.):https://github.com/PLASSICAxu/OS-bug/tree/main/subdev_8255

Acknowledgments,
Xu Dongjie
University of Chinese Academy of Sciences