* Forwarded: [PATCH] comedi: dt2815: Add debug logging to diagnose iobase issue
2026-01-24 6:45 [syzbot] [comedi?] BUG: unable to handle kernel paging request in dt2815_attach syzbot
@ 2026-01-26 5:19 ` syzbot
2026-01-26 5:48 ` Forwarded: [PATCH] comedi: dt2815: add hardware detection to prevent crash on invalid I/O ports syzbot
` (2 subsequent siblings)
3 siblings, 0 replies; 5+ messages in thread
From: syzbot @ 2026-01-26 5:19 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] comedi: dt2815: Add debug logging to diagnose iobase issue
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
Add comprehensive debug logging to dt2815_attach() to diagnose the
page fault crash reported by syzbot. The crash occurs at line 199
when attempting outb() operation, with a fault at address 0xfffffffffffffff0.
This debug patch will help determine:
- Whether it->options[0] is correctly passed
- If dev->iobase is properly set by comedi_request_region()
- If dev->iobase value changes during execution
- The exact status value that triggers the crash path
Once we identify the root cause from the logs, a proper fix will be
implemented.
Reported-by: syzbot+72f94b474d6e50b71ffc@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=72f94b474d6e50b71ffc
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
drivers/comedi/drivers/dt2815.c | 15 ++++++++++++++-
1 file changed, 14 insertions(+), 1 deletion(-)
diff --git a/drivers/comedi/drivers/dt2815.c b/drivers/comedi/drivers/dt2815.c
index 03ba2fd18a21..8e77c9851110 100644
--- a/drivers/comedi/drivers/dt2815.c
+++ b/drivers/comedi/drivers/dt2815.c
@@ -144,10 +144,15 @@ static int dt2815_attach(struct comedi_device *dev, struct comedi_devconfig *it)
const struct comedi_lrange *current_range_type, *voltage_range_type;
int ret;
+ printk(KERN_INFO "dt2815: it->options[0] = 0x%lx\n", it->options[0]);
+
ret = comedi_request_region(dev, it->options[0], 0x2);
if (ret)
return ret;
+ printk(KERN_INFO "dt2815: after comedi_request_region, dev->iobase = 0x%lx\n", dev->iobase);
+
+
ret = comedi_alloc_subdevices(dev, 1);
if (ret)
return ret;
@@ -176,13 +181,18 @@ static int dt2815_attach(struct comedi_device *dev, struct comedi_devconfig *it)
}
/* Init the 2815 */
+ printk(KERN_INFO "dt2815: Before first outb, dev->iobase = 0x%lx\n", dev->iobase);
outb(0x00, dev->iobase + DT2815_STATUS);
+ printk(KERN_INFO "dt2815: After first outb\n");
+
for (i = 0; i < 100; i++) {
/* This is incredibly slow (approx 20 ms) */
unsigned int status;
usleep_range(1000, 3000);
+ printk(KERN_INFO "dt2815: Loop iteration %d, dev->iobase = 0x%lx\n", i, dev->iobase);
status = inb(dev->iobase + DT2815_STATUS);
+ printk(KERN_INFO "dt2815: status = 0x%x\n", status);
if (status == 4) {
unsigned int program;
@@ -195,8 +205,11 @@ static int dt2815_attach(struct comedi_device *dev, struct comedi_devconfig *it)
dev_dbg(dev->class_dev,
"unexpected status 0x%x (@t=%d)\n",
status, i);
- if (status & 0x60)
+ if (status & 0x60) {
+ printk(KERN_INFO "dt2815: About to do second outb, dev = %px, dev->iobase = 0x%lx\n", dev, dev->iobase);
outb(0x00, dev->iobase + DT2815_STATUS);
+ printk(KERN_INFO "dt2815: After second outb\n");
+ }
}
}
--
2.43.0
^ permalink raw reply related [flat|nested] 5+ messages in thread* Forwarded: [PATCH] comedi: dt2815: add hardware detection to prevent crash on invalid I/O ports
2026-01-24 6:45 [syzbot] [comedi?] BUG: unable to handle kernel paging request in dt2815_attach syzbot
2026-01-26 5:19 ` Forwarded: [PATCH] comedi: dt2815: Add debug logging to diagnose iobase issue syzbot
@ 2026-01-26 5:48 ` syzbot
2026-01-26 6:17 ` Forwarded: [PATCH] comedi: dt2815: add comprehensive debug logging to diagnose crashes syzbot
2026-01-26 6:42 ` Forwarded: [PATCH] comedi: dt2815: add hardware detection to prevent crash syzbot
3 siblings, 0 replies; 5+ messages in thread
From: syzbot @ 2026-01-26 5:48 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] comedi: dt2815: add hardware detection to prevent crash on invalid I/O ports
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
The dt2815 driver crashes when attached to I/O ports without actual
hardware present. This occurs because syzkaller or users can attach the
driver to arbitrary I/O addresses via COMEDI_DEVCONFIG ioctl.
When no hardware exists at the specified port, inb() operations return
0xff (floating bus). The driver misinterprets this as a valid status and
attempts error recovery via outb(), which triggers undefined behavior on
the second iteration, ultimately causing a page fault:
BUG: unable to handle page fault for address: 000000007fffff90
#PF: supervisor write access in kernel mode
#PF: error_code(0x0002) - not-present page
RIP: 0010:dt2815_attach+0x6a8/0x9e0
Add an early hardware detection check: if the first status read returns
0xff, assume no hardware is present and fail the attach with -ENODEV.
This prevents the crash and provides a clear error message to users.
Reported-by: syzbot+72f94b474d6e50b71ffc@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=72f94b474d6e50b71ffc
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
drivers/comedi/drivers/dt2815.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/drivers/comedi/drivers/dt2815.c b/drivers/comedi/drivers/dt2815.c
index 03ba2fd18a21..1578cebae8e7 100644
--- a/drivers/comedi/drivers/dt2815.c
+++ b/drivers/comedi/drivers/dt2815.c
@@ -183,6 +183,15 @@ static int dt2815_attach(struct comedi_device *dev, struct comedi_devconfig *it)
usleep_range(1000, 3000);
status = inb(dev->iobase + DT2815_STATUS);
+
+ /* 0xff usually indicates no hardware present on the bus */
+ if (i == 0 && status == 0xff) {
+ dev_err(dev->class_dev,
+ "No hardware detected at I/O base 0x%lx\n",
+ dev->iobase);
+ return -ENODEV;
+ }
+
if (status == 4) {
unsigned int program;
--
2.43.0
^ permalink raw reply related [flat|nested] 5+ messages in thread* Forwarded: [PATCH] comedi: dt2815: add comprehensive debug logging to diagnose crashes
2026-01-24 6:45 [syzbot] [comedi?] BUG: unable to handle kernel paging request in dt2815_attach syzbot
2026-01-26 5:19 ` Forwarded: [PATCH] comedi: dt2815: Add debug logging to diagnose iobase issue syzbot
2026-01-26 5:48 ` Forwarded: [PATCH] comedi: dt2815: add hardware detection to prevent crash on invalid I/O ports syzbot
@ 2026-01-26 6:17 ` syzbot
2026-01-26 6:42 ` Forwarded: [PATCH] comedi: dt2815: add hardware detection to prevent crash syzbot
3 siblings, 0 replies; 5+ messages in thread
From: syzbot @ 2026-01-26 6:17 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] comedi: dt2815: add comprehensive debug logging to diagnose crashes
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
Add detailed debug logging throughout dt2815_attach() to diagnose
multiple crash scenarios reported by syzbot. The crashes occur at
different offsets within the function when attaching to I/O ports
without actual hardware present.
This debug patch adds:
- PID tracking to identify concurrent execution
- Logging before/after each outb() operation
- Status register values at each iteration
- Device pointer and iobase values at critical points
- Entry/exit tracking for the attach function
Additionally, implements an early hardware detection check: if the
first status read returns 0xff (floating bus indicating no hardware),
the driver returns -ENODEV immediately instead of attempting further
I/O operations.
This is a debug patch to gather information about the crash patterns
before implementing a final fix.
Reported-by: syzbot+72f94b474d6e50b71ffc@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=72f94b474d6e50b71ffc
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
drivers/comedi/drivers/dt2815.c | 37 +++++++++++++++++++++++++++++++--
1 file changed, 35 insertions(+), 2 deletions(-)
diff --git a/drivers/comedi/drivers/dt2815.c b/drivers/comedi/drivers/dt2815.c
index 03ba2fd18a21..285bf13fc74d 100644
--- a/drivers/comedi/drivers/dt2815.c
+++ b/drivers/comedi/drivers/dt2815.c
@@ -144,10 +144,16 @@ static int dt2815_attach(struct comedi_device *dev, struct comedi_devconfig *it)
const struct comedi_lrange *current_range_type, *voltage_range_type;
int ret;
+ printk(KERN_INFO "dt2815: [PID %d] ENTER dt2815_attach, it->options[0] = 0x%lx\n",
+ current->pid, it->options[0]);
+
ret = comedi_request_region(dev, it->options[0], 0x2);
if (ret)
return ret;
+ printk(KERN_INFO "dt2815: [PID %d] after comedi_request_region, dev->iobase = 0x%lx\n",
+ current->pid, dev->iobase);
+
ret = comedi_alloc_subdevices(dev, 1);
if (ret)
return ret;
@@ -175,31 +181,58 @@ static int dt2815_attach(struct comedi_device *dev, struct comedi_devconfig *it)
? current_range_type : voltage_range_type;
}
+ printk(KERN_INFO "dt2815: [PID %d] About to do FIRST outb, dev = %px, dev->iobase = 0x%lx\n",
+ current->pid, dev, dev->iobase);
/* Init the 2815 */
outb(0x00, dev->iobase + DT2815_STATUS);
+
+ printk(KERN_INFO "dt2815: [PID %d] FIRST outb completed successfully\n", current->pid);
+
for (i = 0; i < 100; i++) {
/* This is incredibly slow (approx 20 ms) */
unsigned int status;
+ printk(KERN_INFO "dt2815: [PID %d] Loop iteration %d, dev->iobase = 0x%lx\n",
+ current->pid, i, dev->iobase);
usleep_range(1000, 3000);
status = inb(dev->iobase + DT2815_STATUS);
+ printk(KERN_INFO "dt2815: [PID %d] iteration %d: status = 0x%x\n",
+ current->pid, i, status);
+ /* 0xff usually indicates no hardware present on the bus */
+ if (i == 0 && status == 0xff) {
+ dev_err(dev->class_dev,
+ "No hardware detected at I/O base 0x%lx\n",
+ dev->iobase);
+ printk(KERN_INFO "dt2815: [PID %d] Returning -ENODEV (no hardware)\n",
+ current->pid);
+ return -ENODEV;
+ }
+
if (status == 4) {
unsigned int program;
program = (it->options[4] & 0x3) << 3 | 0x7;
outb(program, dev->iobase + DT2815_DATA);
+ printk(KERN_INFO "dt2815: [PID %d] Hardware ready, programmed successfully\n",
+ current->pid);
dev_dbg(dev->class_dev, "program: 0x%x (@t=%d)\n",
program, i);
+ printk(KERN_INFO "dt2815: [PID %d] Unexpected status 0x%x at iteration %d\n",
+ current->pid, status, i);
break;
} else if (status != 0x00) {
dev_dbg(dev->class_dev,
"unexpected status 0x%x (@t=%d)\n",
status, i);
- if (status & 0x60)
+ if (status & 0x60) {
+ printk(KERN_INFO "dt2815: [PID %d] About to do recovery outb, dev = %px, dev->iobase = 0x%lx\n",
+ current->pid, dev, dev->iobase);
outb(0x00, dev->iobase + DT2815_STATUS);
+ printk(KERN_INFO "dt2815: [PID %d] Recovery outb completed\n", current->pid);
+ }
}
}
-
+ printk(KERN_INFO "dt2815: [PID %d] EXIT dt2815_attach successfully\n", current->pid);
return 0;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 5+ messages in thread* Forwarded: [PATCH] comedi: dt2815: add hardware detection to prevent crash
2026-01-24 6:45 [syzbot] [comedi?] BUG: unable to handle kernel paging request in dt2815_attach syzbot
` (2 preceding siblings ...)
2026-01-26 6:17 ` Forwarded: [PATCH] comedi: dt2815: add comprehensive debug logging to diagnose crashes syzbot
@ 2026-01-26 6:42 ` syzbot
3 siblings, 0 replies; 5+ messages in thread
From: syzbot @ 2026-01-26 6:42 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] comedi: dt2815: add hardware detection to prevent crash
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
The dt2815 driver crashes when attached to I/O ports without actual
hardware present. This occurs because syzkaller or users can attach
the driver to arbitrary I/O addresses via COMEDI_DEVCONFIG ioctl.
When no hardware exists at the specified port, inb() operations return
0xff (floating bus), but outb() operations can trigger page faults due
to undefined behavior, especially under race conditions:
BUG: unable to handle page fault for address: 000000007fffff90
#PF: supervisor write access in kernel mode
#PF: error_code(0x0002) - not-present page
RIP: 0010:dt2815_attach+0x6e0/0x1110
Add hardware detection by reading the status register before attempting
any write operations. If the read returns 0xff, assume no hardware is
present and fail the attach with -ENODEV. This prevents crashes from
outb() operations on non-existent hardware.
Reported-by: syzbot+72f94b474d6e50b71ffc@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=72f94b474d6e50b71ffc
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
---
drivers/comedi/drivers/dt2815.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/drivers/comedi/drivers/dt2815.c b/drivers/comedi/drivers/dt2815.c
index 03ba2fd18a21..7c642860f127 100644
--- a/drivers/comedi/drivers/dt2815.c
+++ b/drivers/comedi/drivers/dt2815.c
@@ -175,6 +175,18 @@ static int dt2815_attach(struct comedi_device *dev, struct comedi_devconfig *it)
? current_range_type : voltage_range_type;
}
+ /*
+ * Check if hardware is present before attempting any I/O operations.
+ * Reading 0xff from status register typically indicates no hardware
+ * on the bus (floating bus reads as all 1s).
+ */
+ if (inb(dev->iobase + DT2815_STATUS) == 0xff) {
+ dev_err(dev->class_dev,
+ "No hardware detected at I/O base 0x%lx\n",
+ dev->iobase);
+ return -ENODEV;
+ }
+
/* Init the 2815 */
outb(0x00, dev->iobase + DT2815_STATUS);
for (i = 0; i < 100; i++) {
--
2.43.0
^ permalink raw reply related [flat|nested] 5+ messages in thread