From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BF513B67E; Wed, 8 Apr 2026 18:17:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775672247; cv=none; b=QE6xwuGPq0zuJliCPl0AeV3N8mEGnqeJfHw4p3m2Tjp2co+8Y9aTEE8QoDyRSm99QLhK0DJom3Qongo6MFlgI2VUlsTWeW4ivxOsUcH5kbuzEssgz5zdKySj+/aWR+cGvCl+uBTywL84hHjfzZrrCIhkPRS2FnrYObjf/c29eek= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1775672247; c=relaxed/simple; bh=hGVMhOLOyC3luEmfQkVc6EB+WD8Jh3XlRls3tYTZzJc=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=md0Sv8fZC3tjTae53TUMAHcQ+77BG1tX77AUuocZG/gddNoggXMkZip7CnCyzFU5VoEnxLgJcotTe9DCJQjfKll6RsNlVAti4koNyAuXGW8nJmg3NdFkjuUXCq0ZHZtpV7o6ygBDUnwQlotYtcd/wgeWE7Jnuk4xeL0557YWyeQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=ZC036NhD; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="ZC036NhD" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 56096C19421; Wed, 8 Apr 2026 18:17:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1775672247; bh=hGVMhOLOyC3luEmfQkVc6EB+WD8Jh3XlRls3tYTZzJc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ZC036NhDZP0k5xmwQbmzo1YqgncRT5AWsE4GOfPUd0dG84ArtuWg4WZriDTDEsyAe xp4pzu9k/vVxT5dGPxLlgeNCdMlz4PgQ+7Vn3RCbtCNizzqtnvJWH8+SJz/C9K2rzZ G2MZaeRyMF2RpIy68H8f/FMkJftFxdD24PrtB7dc= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, syzbot+72f94b474d6e50b71ffc@syzkaller.appspotmail.com, stable , Ian Abbott , Deepanshu Kartikey Subject: [PATCH 6.1 246/312] comedi: dt2815: add hardware detection to prevent crash Date: Wed, 8 Apr 2026 20:02:43 +0200 Message-ID: <20260408175942.936560212@linuxfoundation.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <20260408175933.715315542@linuxfoundation.org> References: <20260408175933.715315542@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.1-stable review patch. If anyone has any objections, please let me know. ------------------ From: Deepanshu Kartikey commit 93853512f565e625df2397f0d8050d6aafd7c3ad upstream. The dt2815 driver crashes when attached to I/O ports without actual hardware present. This occurs because syzkaller or users can attach the driver to arbitrary I/O addresses via COMEDI_DEVCONFIG ioctl. When no hardware exists at the specified port, inb() operations return 0xff (floating bus), but outb() operations can trigger page faults due to undefined behavior, especially under race conditions: BUG: unable to handle page fault for address: 000000007fffff90 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page RIP: 0010:dt2815_attach+0x6e0/0x1110 Add hardware detection by reading the status register before attempting any write operations. If the read returns 0xff, assume no hardware is present and fail the attach with -ENODEV. This prevents crashes from outb() operations on non-existent hardware. Reported-by: syzbot+72f94b474d6e50b71ffc@syzkaller.appspotmail.com Cc: stable Closes: https://syzkaller.appspot.com/bug?extid=72f94b474d6e50b71ffc Tested-by: syzbot+72f94b474d6e50b71ffc@syzkaller.appspotmail.com Reviewed-by: Ian Abbott Signed-off-by: Deepanshu Kartikey Link: [https://lore.kernel.org/all/20260126070458.10974-1-kartikey406@gmail.com/T/] Link: [https://lore.kernel.org/all/20260126070458.10974-1-kartikey406@gmail.com/T/ Link: https://patch.msgid.link/20260309104859.503529-1-kartikey406@gmail.com Signed-off-by: Greg Kroah-Hartman Signed-off-by: Greg Kroah-Hartman --- drivers/comedi/drivers/dt2815.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) --- a/drivers/comedi/drivers/dt2815.c +++ b/drivers/comedi/drivers/dt2815.c @@ -175,6 +175,18 @@ static int dt2815_attach(struct comedi_d ? current_range_type : voltage_range_type; } + /* + * Check if hardware is present before attempting any I/O operations. + * Reading 0xff from status register typically indicates no hardware + * on the bus (floating bus reads as all 1s). + */ + if (inb(dev->iobase + DT2815_STATUS) == 0xff) { + dev_err(dev->class_dev, + "No hardware detected at I/O base 0x%lx\n", + dev->iobase); + return -ENODEV; + } + /* Init the 2815 */ outb(0x00, dev->iobase + DT2815_STATUS); for (i = 0; i < 100; i++) {