linux-kernel - Forwarded: [PATCH] comedi: dt2815: add hardware detection to prevent crash on invalid I/O ports

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <6977003b.a00a0220.33ccc7.0032.GAE@google.com>
Date: Sun, 25 Jan 2026 21:48:43 -0800
From: syzbot <syzbot+72f94b474d6e50b71ffc@...kaller.appspotmail.com>
To: linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com
Subject: Forwarded: [PATCH] comedi: dt2815: add hardware detection to prevent
 crash on invalid I/O ports

For archival purposes, forwarding an incoming command email to
linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com.

***

Subject: [PATCH] comedi: dt2815: add hardware detection to prevent crash on invalid I/O ports
Author: kartikey406@...il.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

The dt2815 driver crashes when attached to I/O ports without actual
hardware present. This occurs because syzkaller or users can attach the
driver to arbitrary I/O addresses via COMEDI_DEVCONFIG ioctl.

When no hardware exists at the specified port, inb() operations return
0xff (floating bus). The driver misinterprets this as a valid status and
attempts error recovery via outb(), which triggers undefined behavior on
the second iteration, ultimately causing a page fault:

  BUG: unable to handle page fault for address: 000000007fffff90
  #PF: supervisor write access in kernel mode
  #PF: error_code(0x0002) - not-present page
  RIP: 0010:dt2815_attach+0x6a8/0x9e0

Add an early hardware detection check: if the first status read returns
0xff, assume no hardware is present and fail the attach with -ENODEV.
This prevents the crash and provides a clear error message to users.

Reported-by: syzbot+72f94b474d6e50b71ffc@...kaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=72f94b474d6e50b71ffc
Signed-off-by: Deepanshu Kartikey <kartikey406@...il.com>
---
 drivers/comedi/drivers/dt2815.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/comedi/drivers/dt2815.c b/drivers/comedi/drivers/dt2815.c
index 03ba2fd18a21..1578cebae8e7 100644
--- a/drivers/comedi/drivers/dt2815.c
+++ b/drivers/comedi/drivers/dt2815.c
@@ -183,6 +183,15 @@ static int dt2815_attach(struct comedi_device *dev, struct comedi_devconfig *it)

 		usleep_range(1000, 3000);
 		status = inb(dev->iobase + DT2815_STATUS);
+
+		   /* 0xff usually indicates no hardware present on the bus */
+		if (i == 0 && status == 0xff) {
+			dev_err(dev->class_dev,
+				"No hardware detected at I/O base 0x%lx\n",
+				dev->iobase);
+			return -ENODEV;
+		}
+
 		if (status == 4) {
 			unsigned int program;

-- 
2.43.0