From nobody Wed Feb 11 03:42:02 2026 Received: from devnull.danielhodges.dev (vps-2f6e086e.vps.ovh.us [135.148.138.8]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9F39B2AD2C for ; Sun, 8 Feb 2026 00:16:02 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=135.148.138.8 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770509763; cv=none; b=O1ykps1W8nwH9KPz8OfN3sRFQ4gFYZod4tJBVnzZ1haVhuqMbzPgCcjvCNGyo0t3PFnKbR7i8r4J540Yc+bk/KxbLkOdahBb7FGnK59C6hUUuRAy+KiRjeahwbj+3dx6lMRoq1XjW1DUTjpgfLzAzHQFtdhw4gNnMGZja5iTWDs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1770509763; c=relaxed/simple; bh=eHFuXqly2A21tucsoKN0/VAxWuI//rvHXc3YjcZMoFk=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=rdqFgU4D51lvkXKLhOYLz/9Uz0zD0gsWYywfD1bPgZwfbnPsEqx3U08eXxBDDn8RMKK6yYdYEmEIaGTjmydF+yLAGkAMP/IUozQ884toGrdLBMuhKWRQTAlQvDD0zJncdOYX1WNVX7f/ZpO26DhTJQKt3phDdReXn97kUDcUvYc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=danielhodges.dev; spf=pass smtp.mailfrom=danielhodges.dev; dkim=pass (2048-bit key) header.d=danielhodges.dev header.i=@danielhodges.dev header.b=mRTpWZxN; dkim=permerror (0-bit key) header.d=danielhodges.dev header.i=@danielhodges.dev header.b=+4gIOxYd; arc=none smtp.client-ip=135.148.138.8 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=danielhodges.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=danielhodges.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=danielhodges.dev header.i=@danielhodges.dev header.b="mRTpWZxN"; dkim=permerror (0-bit key) header.d=danielhodges.dev header.i=@danielhodges.dev header.b="+4gIOxYd" DKIM-Signature: v=1; a=rsa-sha256; s=202510r; d=danielhodges.dev; c=relaxed/relaxed; h=Message-ID:Date:Subject:To:From; t=1770509761; bh=1HX+tlEXSP0PtCNZZKwPPgM oyZhiv38KMnzkTj3+Vd0=; b=mRTpWZxNJsc4f+v7/PlBvBfRmq/aimImJvY11sgObjgdyuMTqv DvSiCy1VFX0cQNQwq7TbqzPYLPFnvHerfnm78ObDljC0hpoXE0BBLrEz8Jki6RgWkJ1RNB/Aozm xvyHKNDD9P6SJycsbX4gdB0c66523FrbSwCbgMr2P8C5Ac8tLGn07Y/c7nhQo9CpQpXpom9Gcd3 5yj3ZftORyz9/Y86oHPPOgXxbacnWHeritUNm6aFuN3kLERcHSjEPolLTaqAfvkB3W/NEUZS52p kgsYtkPGjhyIUvBTvxPQ9gVfGaZzSdgcrb+bs7B9tWXjgxTJ/i5hJ3MP0r3fFDA8p3A==; DKIM-Signature: v=1; a=ed25519-sha256; s=202510e; d=danielhodges.dev; c=relaxed/relaxed; h=Message-ID:Date:Subject:To:From; t=1770509761; bh=1HX+tlEXSP0PtCNZZKwPPgM oyZhiv38KMnzkTj3+Vd0=; b=+4gIOxYd1qAhfdp7E+7X9GfTt92yCnjzOQRSF3mUC2j2hU0On1 eabvQ9lM9NpXbP2zsHKQXNiHELcGJI7ICGDw==; From: Daniel Hodges To: Ian Abbott , H Hartley Sweeten Cc: Greg Kroah-Hartman , linux-kernel@vger.kernel.org, Daniel Hodges , syzbot+72f94b474d6e50b71ffc@syzkaller.appspotmail.com Subject: [PATCH] comedi: dt2815: return error when board not found during attach Date: Sat, 7 Feb 2026 19:16:00 -0500 Message-ID: <20260208001600.3447-1-git@danielhodges.dev> X-Mailer: git-send-email 2.52.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" dt2815_attach() silently succeeds even when the hardware initialization loop fails to detect the board (status never becomes 4). This allows the driver to attach to non-existent hardware at arbitrary I/O ports provided via ioctl, which can cause a page fault when the driver subsequently accesses those ports in QEMU/virtualized environments. Fix this by returning -EIO when the initialization loop completes without detecting the hardware, similar to what dt282x_initialize() does. Change the success path from 'break' to 'return 0' so that the function only returns success when hardware is actually detected. Reported-by: syzbot+72f94b474d6e50b71ffc@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=3D72f94b474d6e50b71ffc Fixes: d6a929b7608a ("Staging: comedi: add dt2815 driver") Signed-off-by: Daniel Hodges --- drivers/comedi/drivers/dt2815.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/comedi/drivers/dt2815.c b/drivers/comedi/drivers/dt281= 5.c index 03ba2fd18a21..d104ac0f015d 100644 --- a/drivers/comedi/drivers/dt2815.c +++ b/drivers/comedi/drivers/dt2815.c @@ -190,7 +190,7 @@ static int dt2815_attach(struct comedi_device *dev, str= uct comedi_devconfig *it) outb(program, dev->iobase + DT2815_DATA); dev_dbg(dev->class_dev, "program: 0x%x (@t=3D%d)\n", program, i); - break; + return 0; } else if (status !=3D 0x00) { dev_dbg(dev->class_dev, "unexpected status 0x%x (@t=3D%d)\n", @@ -200,7 +200,8 @@ static int dt2815_attach(struct comedi_device *dev, str= uct comedi_devconfig *it) } } =20 - return 0; + dev_err(dev->class_dev, "board not found\n"); + return -EIO; } =20 static struct comedi_driver dt2815_driver =3D { --=20 2.52.0