linux-kernel - Forwarded: [PATCH] comedi: dt2815: add comprehensive debug logging to diagnose crashes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <697706ff.050a0220.226181.0013.GAE@google.com>
Date: Sun, 25 Jan 2026 22:17:35 -0800
From: syzbot <syzbot+72f94b474d6e50b71ffc@...kaller.appspotmail.com>
To: linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com
Subject: Forwarded: [PATCH] comedi: dt2815: add comprehensive debug logging to
 diagnose crashes

For archival purposes, forwarding an incoming command email to
linux-kernel@...r.kernel.org, syzkaller-bugs@...glegroups.com.

***

Subject: [PATCH] comedi: dt2815: add comprehensive debug logging to diagnose crashes
Author: kartikey406@...il.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

Add detailed debug logging throughout dt2815_attach() to diagnose
multiple crash scenarios reported by syzbot. The crashes occur at
different offsets within the function when attaching to I/O ports
without actual hardware present.

This debug patch adds:
- PID tracking to identify concurrent execution
- Logging before/after each outb() operation
- Status register values at each iteration
- Device pointer and iobase values at critical points
- Entry/exit tracking for the attach function

Additionally, implements an early hardware detection check: if the
first status read returns 0xff (floating bus indicating no hardware),
the driver returns -ENODEV immediately instead of attempting further
I/O operations.

This is a debug patch to gather information about the crash patterns
before implementing a final fix.

Reported-by: syzbot+72f94b474d6e50b71ffc@...kaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=72f94b474d6e50b71ffc
Signed-off-by: Deepanshu Kartikey <kartikey406@...il.com>
---
 drivers/comedi/drivers/dt2815.c | 37 +++++++++++++++++++++++++++++++--
 1 file changed, 35 insertions(+), 2 deletions(-)

diff --git a/drivers/comedi/drivers/dt2815.c b/drivers/comedi/drivers/dt2815.c
index 03ba2fd18a21..285bf13fc74d 100644
--- a/drivers/comedi/drivers/dt2815.c
+++ b/drivers/comedi/drivers/dt2815.c
@@ -144,10 +144,16 @@ static int dt2815_attach(struct comedi_device *dev, struct comedi_devconfig *it)
 	const struct comedi_lrange *current_range_type, *voltage_range_type;
 	int ret;
 
+	printk(KERN_INFO "dt2815: [PID %d] ENTER dt2815_attach, it->options[0] = 0x%lx\n", 
+               current->pid, it->options[0]);
+
 	ret = comedi_request_region(dev, it->options[0], 0x2);
 	if (ret)
 		return ret;
 
+	printk(KERN_INFO "dt2815: [PID %d] after comedi_request_region, dev->iobase = 0x%lx\n", 
+	       current->pid, dev->iobase);
+
 	ret = comedi_alloc_subdevices(dev, 1);
 	if (ret)
 		return ret;
@@ -175,31 +181,58 @@ static int dt2815_attach(struct comedi_device *dev, struct comedi_devconfig *it)
 		    ? current_range_type : voltage_range_type;
 	}
 
+	printk(KERN_INFO "dt2815: [PID %d] About to do FIRST outb, dev = %px, dev->iobase = 0x%lx\n",
+               current->pid, dev, dev->iobase);
 	/* Init the 2815 */
 	outb(0x00, dev->iobase + DT2815_STATUS);
+
+	printk(KERN_INFO "dt2815: [PID %d] FIRST outb completed successfully\n", current->pid);
+
 	for (i = 0; i < 100; i++) {
 		/* This is incredibly slow (approx 20 ms) */
 		unsigned int status;
 
+		printk(KERN_INFO "dt2815: [PID %d] Loop iteration %d, dev->iobase = 0x%lx\n",
+			 current->pid, i, dev->iobase);
 		usleep_range(1000, 3000);
 		status = inb(dev->iobase + DT2815_STATUS);
+		printk(KERN_INFO "dt2815: [PID %d] iteration %d: status = 0x%x\n",
+				  current->pid, i, status);
+		   /* 0xff usually indicates no hardware present on the bus */
+                if (i == 0 && status == 0xff) {
+                        dev_err(dev->class_dev,
+                                "No hardware detected at I/O base 0x%lx\n",
+                                dev->iobase);
+			printk(KERN_INFO "dt2815: [PID %d] Returning -ENODEV (no hardware)\n",
+				 current->pid);
+                        return -ENODEV;
+                }
+
 		if (status == 4) {
 			unsigned int program;
 
 			program = (it->options[4] & 0x3) << 3 | 0x7;
 			outb(program, dev->iobase + DT2815_DATA);
+			printk(KERN_INFO "dt2815: [PID %d] Hardware ready, programmed successfully\n",
+                               current->pid);
 			dev_dbg(dev->class_dev, "program: 0x%x (@t=%d)\n",
 				program, i);
+			printk(KERN_INFO "dt2815: [PID %d] Unexpected status 0x%x at iteration %d\n",
+			       current->pid, status, i);
 			break;
 		} else if (status != 0x00) {
 			dev_dbg(dev->class_dev,
 				"unexpected status 0x%x (@t=%d)\n",
 				status, i);
-			if (status & 0x60)
+			if (status & 0x60) {
+				printk(KERN_INFO "dt2815: [PID %d] About to do recovery outb, dev = %px, dev->iobase = 0x%lx\n",
+				       current->pid, dev, dev->iobase);
 				outb(0x00, dev->iobase + DT2815_STATUS);
+				printk(KERN_INFO "dt2815: [PID %d] Recovery outb completed\n", current->pid);
+			}
 		}
 	}
-
+	printk(KERN_INFO "dt2815: [PID %d] EXIT dt2815_attach successfully\n", current->pid);
 	return 0;
 }
 
-- 
2.43.0