dt2815_attach() silently succeeds even when the hardware initialization
loop fails to detect the board (status never becomes 4). This allows the
driver to attach to non-existent hardware at arbitrary I/O ports
provided via ioctl, which can cause a page fault when the driver
subsequently accesses those ports in QEMU/virtualized environments.
Fix this by returning -EIO when the initialization loop completes
without detecting the hardware, similar to what dt282x_initialize()
does. Change the success path from 'break' to 'return 0' so that the
function only returns success when hardware is actually detected.
Reported-by: syzbot+72f94b474d6e50b71ffc@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=72f94b474d6e50b71ffc
Fixes: d6a929b7608a ("Staging: comedi: add dt2815 driver")
Signed-off-by: Daniel Hodges <git@danielhodges.dev>
---
drivers/comedi/drivers/dt2815.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/comedi/drivers/dt2815.c b/drivers/comedi/drivers/dt2815.c
index 03ba2fd18a21..d104ac0f015d 100644
--- a/drivers/comedi/drivers/dt2815.c
+++ b/drivers/comedi/drivers/dt2815.c
@@ -190,7 +190,7 @@ static int dt2815_attach(struct comedi_device *dev, struct comedi_devconfig *it)
outb(program, dev->iobase + DT2815_DATA);
dev_dbg(dev->class_dev, "program: 0x%x (@t=%d)\n",
program, i);
- break;
+ return 0;
} else if (status != 0x00) {
dev_dbg(dev->class_dev,
"unexpected status 0x%x (@t=%d)\n",
@@ -200,7 +200,8 @@ static int dt2815_attach(struct comedi_device *dev, struct comedi_devconfig *it)
}
}
- return 0;
+ dev_err(dev->class_dev, "board not found\n");
+ return -EIO;
}
static struct comedi_driver dt2815_driver = {
--
2.52.0