In apci3xxx_auto_attach(), the number of subdevices is computed with

    n_subdevices = (board->ai_n_chan ? 0 : 1) + board->has_ao + ...

The ternary is inverted: when the board has analog input channels
(ai_n_chan != 0), it counts 0 instead of 1, so the AI subdevice that is
actually created is not accounted for. As a result
comedi_alloc_subdevices() allocates one entry too few, and the later
subdevice initialization (notably the TTL Digital I/O subdevice, which
is populated last) writes past the end of the allocated array, causing a
slab out-of-bounds write.

Flip the ternary to count 1 when ai_n_chan is non-zero and 0 otherwise,
matching the subdevice creation order in the function.

Signed-off-by: Yang Zi <2959243019@qq.com>
---
diff --git a/drivers/comedi/drivers/addi_apci_3xxx.c b/drivers/comedi/drivers/addi_apci_3xxx.c
index 695cce103177..1dcda82d9503 100644
--- a/drivers/comedi/drivers/addi_apci_3xxx.c
+++ b/drivers/comedi/drivers/addi_apci_3xxx.c
@@ -787,7 +787,7 @@ static int apci3xxx_auto_attach(struct comedi_device *dev,
             dev->irq = pcidev->irq;
     }
 
-    n_subdevices = (board->ai_n_chan ? 0 : 1) + board->has_ao +
+    n_subdevices = (board->ai_n_chan ? 1 : 0) + board->has_ao +
                board->has_dig_in + board->has_dig_out +
                board->has_ttl_io;
     ret = comedi_alloc_subdevices(dev, n_subdevices);

On 2026-08-25 10:07, Yang Zi wrote:
> In apci3xxx_auto_attach(), the number of subdevices is computed with
> 
>      n_subdevices = (board->ai_n_chan ? 0 : 1) + board->has_ao + ...
> 
> The ternary is inverted: when the board has analog input channels
> (ai_n_chan != 0), it counts 0 instead of 1, so the AI subdevice that is
> actually created is not accounted for. As a result
> comedi_alloc_subdevices() allocates one entry too few, and the later
> subdevice initialization (notably the TTL Digital I/O subdevice, which
> is populated last) writes past the end of the allocated array, causing a
> slab out-of-bounds write.
> 
> Flip the ternary to count 1 when ai_n_chan is non-zero and 0 otherwise,
> matching the subdevice creation order in the function.
> 
> Signed-off-by: Yang Zi <2959243019@qq.com>
> ---
> diff --git a/drivers/comedi/drivers/addi_apci_3xxx.c b/drivers/comedi/drivers/addi_apci_3xxx.c
> index 695cce103177..1dcda82d9503 100644
> --- a/drivers/comedi/drivers/addi_apci_3xxx.c
> +++ b/drivers/comedi/drivers/addi_apci_3xxx.c
> @@ -787,7 +787,7 @@ static int apci3xxx_auto_attach(struct comedi_device *dev,
>               dev->irq = pcidev->irq;
>       }
>   
> -    n_subdevices = (board->ai_n_chan ? 0 : 1) + board->has_ao +
> +    n_subdevices = (board->ai_n_chan ? 1 : 0) + board->has_ao +
>                  board->has_dig_in + board->has_dig_out +
>                  board->has_ttl_io;
>       ret = comedi_alloc_subdevices(dev, n_subdevices);

Thanks for catching this bug.  Looks good!

Reviewed-by: Ian Abbott <abbotti@mev.co.uk>

-- 
-=( Ian Abbott <abbotti@mev.co.uk> || MEV Ltd. is a company  )=-
-=( registered in England & Wales.  Regd. number: 02862268.  )=-
-=( Regd. addr.: S11 & 12 Building 67, Europa Business Park, )=-
-=( Bird Hall Lane, STOCKPORT, SK3 0XA, UK. || www.mev.co.uk )=-