[PATCH] comedi: dt2815: return error when board not found during attach

[PATCH] comedi: dt2815: return error when board not found during attach

[Daniel Hodges]

dt2815_attach() silently succeeds even when the hardware initialization
loop fails to detect the board (status never becomes 4). This allows the
driver to attach to non-existent hardware at arbitrary I/O ports
provided via ioctl, which can cause a page fault when the driver
subsequently accesses those ports in QEMU/virtualized environments.

Fix this by returning -EIO when the initialization loop completes
without detecting the hardware, similar to what dt282x_initialize()
does. Change the success path from 'break' to 'return 0' so that the
function only returns success when hardware is actually detected.

Reported-by: syzbot+72f94b474d6e50b71ffc@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=72f94b474d6e50b71ffc
Fixes: d6a929b7608a ("Staging: comedi: add dt2815 driver")
Signed-off-by: Daniel Hodges <git@danielhodges.dev>
---
 drivers/comedi/drivers/dt2815.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/comedi/drivers/dt2815.c b/drivers/comedi/drivers/dt2815.c
index 03ba2fd18a21..d104ac0f015d 100644
--- a/drivers/comedi/drivers/dt2815.c
+++ b/drivers/comedi/drivers/dt2815.c
@@ -190,7 +190,7 @@ static int dt2815_attach(struct comedi_device *dev, struct comedi_devconfig *it)
 			outb(program, dev->iobase + DT2815_DATA);
 			dev_dbg(dev->class_dev, "program: 0x%x (@t=%d)\n",
 				program, i);
-			break;
+			return 0;
 		} else if (status != 0x00) {
 			dev_dbg(dev->class_dev,
 				"unexpected status 0x%x (@t=%d)\n",
@@ -200,7 +200,8 @@ static int dt2815_attach(struct comedi_device *dev, struct comedi_devconfig *it)
 		}
 	}
 
-	return 0;
+	dev_err(dev->class_dev, "board not found\n");
+	return -EIO;
 }
 
 static struct comedi_driver dt2815_driver = {
-- 
2.52.0