Forwarded: [PATCH] comedi: dt2815: add hardware detection to prevent crash on invalid I/O ports

[syzbot <syzbot+72f94b474d6e50b71ffc@syzkaller.appspotmail.com>]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.

***

Subject: [PATCH] comedi: dt2815: add hardware detection to prevent crash on invalid I/O ports
Author: kartikey406@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master

The dt2815 driver crashes when attached to I/O ports without actual
hardware present. This occurs because syzkaller or users can attach the
driver to arbitrary I/O addresses via COMEDI_DEVCONFIG ioctl.

When no hardware exists at the specified port, inb() operations return
0xff (floating bus). The driver misinterprets this as a valid status and
attempts error recovery via outb(), which triggers undefined behavior on
the second iteration, ultimately causing a page fault:

  BUG: unable to handle page fault for address: 000000007fffff90
  #PF: supervisor write access in kernel mode
  #PF: error_code(0x0002) - not-present page
  RIP: 0010:dt2815_attach+0x6a8/0x9e0

Add an early hardware detection check: if the first status read returns
0xff, assume no hardware is present and fail the attach with -ENODEV.
This prevents the crash and provides a clear error message to users.

Reported-by: syzbot+72f94b474d6e50b71ffc@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=72f94b474d6e50b71ffc
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
 drivers/comedi/drivers/dt2815.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/drivers/comedi/drivers/dt2815.c b/drivers/comedi/drivers/dt2815.c
index 03ba2fd18a21..1578cebae8e7 100644
--- a/drivers/comedi/drivers/dt2815.c
+++ b/drivers/comedi/drivers/dt2815.c
@@ -183,6 +183,15 @@ static int dt2815_attach(struct comedi_device *dev, struct comedi_devconfig *it)
 
 		usleep_range(1000, 3000);
 		status = inb(dev->iobase + DT2815_STATUS);
+
+		   /* 0xff usually indicates no hardware present on the bus */
+		if (i == 0 && status == 0xff) {
+			dev_err(dev->class_dev,
+				"No hardware detected at I/O base 0x%lx\n",
+				dev->iobase);
+			return -ENODEV;
+		}
+
 		if (status == 4) {
 			unsigned int program;
 
-- 
2.43.0