From nobody Sun Feb 8 17:22:12 2026 Received: from smtp111.ord1d.emailsrvr.com (smtp111.ord1d.emailsrvr.com [184.106.54.111]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id ADCB32D7D2E for ; Wed, 28 Jan 2026 15:36:46 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=184.106.54.111 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1769614608; cv=none; b=LyGKg1fKxR2rPKqUJI2uP3Ovw1936TIOIhedyeZBGwlD1g6jzzlwxO/c5hkgCxXD15ZO0ZdE07epRA/Nw1g7v6+ZK8gKvyY6NHKzBlAynR6tqu0kgjVAgfXQlAmVOp1TsBIZ8ylqX31YXI0mnr/Bv+xXMDa83ipY00JiRUGVnb8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1769614608; c=relaxed/simple; bh=FNu9qt9RcJv8/efnOO0fintMAsmMWSblnG6gPk5YQoE=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=S1uWSaQvLZGYHx1a2syG0+DK/r3SKkDMZ+eUhWZNXGHbdbGTLtHS9tSlG+TFiAS0TWTvydoJJf28VK2a7M4CYg1k/e9d4RsLkp/vH/pTxnfzmW+7hxwCdsCtmYapJDOIEFeS23ZK7mvGbSbM+Qf5kYcFnJ+xdR0wxiwVpbq+18I= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=mev.co.uk; spf=pass smtp.mailfrom=mev.co.uk; dkim=pass (1024-bit key) header.d=mev.co.uk header.i=@mev.co.uk header.b=wAcvOkty; arc=none smtp.client-ip=184.106.54.111 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=mev.co.uk Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=mev.co.uk Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=mev.co.uk header.i=@mev.co.uk header.b="wAcvOkty" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=mev.co.uk; s=20221208-6x11dpa4; t=1769612424; bh=FNu9qt9RcJv8/efnOO0fintMAsmMWSblnG6gPk5YQoE=; h=From:To:Subject:Date:From; b=wAcvOktyogDbUaCA3h+P2qVCb4bIF1+rkP3flHg6kMZ9bGrvIa8ThaaZmEchzg/8d AtlQ6lYrj934jmgLX4xs1Uh+II2m0awA6gPXJbc8dpuBcbGc2yrCbO31QtBHq0V3t/ GUQKOmgUguicYXMtIQBBB3C4/+0FhZ3jgvXh4nyw= X-Auth-ID: abbotti@mev.co.uk Received: by smtp14.relay.ord1d.emailsrvr.com (Authenticated sender: abbotti-AT-mev.co.uk) with ESMTPSA id 2EF414026C; Wed, 28 Jan 2026 10:00:23 -0500 (EST) From: Ian Abbott To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , Ian Abbott , H Hartley Sweeten , stable@vger.kernel.org Subject: [PATCH] comedi: ni_atmio16d: Fix invalid clean-up after failed attach Date: Wed, 28 Jan 2026 15:00:10 +0000 Message-ID: <20260128150011.5006-1-abbotti@mev.co.uk> X-Mailer: git-send-email 2.51.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Classification-ID: e92fc87b-daa5-4a29-ac36-dbe57e86035b-1-1 Content-Type: text/plain; charset="utf-8" If the driver's COMEDI "attach" handler function (`atmio16d_attach()`) returns an error, the COMEDI core will call the driver's "detach" handler function (`atmio16d_detach()`) to clean up. This calls `reset_atmio16d()` unconditionally, but depending on where the error occurred in the attach handler, the device may not have been sufficiently initialized to call `reset_atmio16d()`. It uses `dev->iobase` as the I/O port base address and `dev->private` as the pointer to the COMEDI device's private data structure. `dev->iobase` may still be set to its initial value of 0, which would result in undesired writes to low I/O port addresses. `dev->private` may still be `NULL`, which would result in null pointer dereferences. Fix `atmio16d_detach()` by checking that `dev->private` is valid (non-null) before calling `reset_atmio16d()`. This implies that `dev->iobase` was set correctly since that is set up before `dev->private`. Fixes: 2323b276308a ("Staging: comedi: add ni_at_atmio16d driver") Cc: Signed-off-by: Ian Abbott --- drivers/comedi/drivers/ni_atmio16d.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/comedi/drivers/ni_atmio16d.c b/drivers/comedi/drivers/= ni_atmio16d.c index e5e7cc423c87..b057b3b3582e 100644 --- a/drivers/comedi/drivers/ni_atmio16d.c +++ b/drivers/comedi/drivers/ni_atmio16d.c @@ -698,7 +698,8 @@ static int atmio16d_attach(struct comedi_device *dev, =20 static void atmio16d_detach(struct comedi_device *dev) { - reset_atmio16d(dev); + if (dev->private) + reset_atmio16d(dev); comedi_legacy_detach(dev); } =20 --=20 2.51.0