For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] comedi: dt2815: add hardware detection to prevent crash on invalid I/O ports
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
The dt2815 driver crashes when attached to I/O ports without actual
hardware present. This occurs because syzkaller or users can attach the
driver to arbitrary I/O addresses via COMEDI_DEVCONFIG ioctl.
When no hardware exists at the specified port, inb() operations return
0xff (floating bus). The driver misinterprets this as a valid status and
attempts error recovery via outb(), which triggers undefined behavior on
the second iteration, ultimately causing a page fault:
BUG: unable to handle page fault for address: 000000007fffff90
#PF: supervisor write access in kernel mode
#PF: error_code(0x0002) - not-present page
RIP: 0010:dt2815_attach+0x6a8/0x9e0
Add an early hardware detection check: if the first status read returns
0xff, assume no hardware is present and fail the attach with -ENODEV.
This prevents the crash and provides a clear error message to users.
Reported-by: syzbot+72f94b474d6e50b71ffc@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=72f94b474d6e50b71ffc
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
drivers/comedi/drivers/dt2815.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/drivers/comedi/drivers/dt2815.c b/drivers/comedi/drivers/dt2815.c
index 03ba2fd18a21..1578cebae8e7 100644
--- a/drivers/comedi/drivers/dt2815.c
+++ b/drivers/comedi/drivers/dt2815.c
@@ -183,6 +183,15 @@ static int dt2815_attach(struct comedi_device *dev, struct comedi_devconfig *it)
usleep_range(1000, 3000);
status = inb(dev->iobase + DT2815_STATUS);
+
+ /* 0xff usually indicates no hardware present on the bus */
+ if (i == 0 && status == 0xff) {
+ dev_err(dev->class_dev,
+ "No hardware detected at I/O base 0x%lx\n",
+ dev->iobase);
+ return -ENODEV;
+ }
+
if (status == 4) {
unsigned int program;
--
2.43.0