linux-kernel - [PATCH] comedi: dt2815: return error when board not found during attach

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20260208001600.3447-1-git@danielhodges.dev>
Date: Sat,  7 Feb 2026 19:16:00 -0500
From: Daniel Hodges <git@...ielhodges.dev>
To: Ian Abbott <abbotti@....co.uk>,
	H Hartley Sweeten <hsweeten@...ionengravers.com>
Cc: Greg Kroah-Hartman <gregkh@...e.de>,
	linux-kernel@...r.kernel.org,
	Daniel Hodges <git@...ielhodges.dev>,
	syzbot+72f94b474d6e50b71ffc@...kaller.appspotmail.com
Subject: [PATCH] comedi: dt2815: return error when board not found during attach

dt2815_attach() silently succeeds even when the hardware initialization
loop fails to detect the board (status never becomes 4). This allows the
driver to attach to non-existent hardware at arbitrary I/O ports
provided via ioctl, which can cause a page fault when the driver
subsequently accesses those ports in QEMU/virtualized environments.

Fix this by returning -EIO when the initialization loop completes
without detecting the hardware, similar to what dt282x_initialize()
does. Change the success path from 'break' to 'return 0' so that the
function only returns success when hardware is actually detected.

Reported-by: syzbot+72f94b474d6e50b71ffc@...kaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=72f94b474d6e50b71ffc
Fixes: d6a929b7608a ("Staging: comedi: add dt2815 driver")
Signed-off-by: Daniel Hodges <git@...ielhodges.dev>
---
 drivers/comedi/drivers/dt2815.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/comedi/drivers/dt2815.c b/drivers/comedi/drivers/dt2815.c
index 03ba2fd18a21..d104ac0f015d 100644
--- a/drivers/comedi/drivers/dt2815.c
+++ b/drivers/comedi/drivers/dt2815.c
@@ -190,7 +190,7 @@ static int dt2815_attach(struct comedi_device *dev, struct comedi_devconfig *it)
 			outb(program, dev->iobase + DT2815_DATA);
 			dev_dbg(dev->class_dev, "program: 0x%x (@t=%d)\n",
 				program, i);
-			break;
+			return 0;
 		} else if (status != 0x00) {
 			dev_dbg(dev->class_dev,
 				"unexpected status 0x%x (@t=%d)\n",
@@ -200,7 +200,8 @@ static int dt2815_attach(struct comedi_device *dev, struct comedi_devconfig *it)
 		}
 	}
 
-	return 0;
+	dev_err(dev->class_dev, "board not found\n");
+	return -EIO;
 }
 
 static struct comedi_driver dt2815_driver = {
-- 
2.52.0