diff options
| author | Pei Xiao <xiaopei01@kylinos.cn> | 2026-09-22 15:16:57 +0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2026-10-13 15:53:52 +0200 |
| commit | 471ce96a9c415b8a67bd5081ac2089a458cacc2f (patch) | |
| tree | 280bfa889ef092d9c59e54acf71dab12bf73bbd5 /drivers | |
| parent | 7e170600b36298cba2ba7a0c63d1cebea7970708 (diff) | |
comedi: dt2811: fix shift-out-of-bounds in IRQ check
The IRQ number passed via comedi_devconfig->options[1] is a signed int
that comes from userspace. The check `it->options[1] <= 7` does not
reject negative values, so a negative IRQ number reaches
`BIT(it->options[1])`, which is undefined behavior and triggers a UBSAN
shift-out-of-bounds warning:
UBSAN: shift-out-of-bounds in drivers/comedi/drivers/dt2811.c:570:31
shift exponent -251 is negative
Add an explicit lower bound check (`it->options[1] >= 0`) so that only
valid IRQ numbers 0..7 are accepted before the shift.
Fixes: f2975a9b2ab9 ("staging: comedi: dt2811: add async command support for AI subdevice")
Reported-by: syzbot+a4cedab706d0a8a3f988@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/6ab21240.e548f532.1ca396.0018.GAE@google.com/#R
Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Tested-by: syzbot+a4cedab706d0a8a3f988@syzkaller.appspotmail.com
Link: https://patch.msgid.link/02c46315293a26169d2a3862a2047959a1651ef4.1790061387.git.xiaopei01@kylinos.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/comedi/drivers/dt2811.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/comedi/drivers/dt2811.c b/drivers/comedi/drivers/dt2811.c index 0438b8c90e44..53cb17993ae7 100644 --- a/drivers/comedi/drivers/dt2811.c +++ b/drivers/comedi/drivers/dt2811.c @@ -567,7 +567,7 @@ static int dt2811_attach(struct comedi_device *dev, struct comedi_devconfig *it) dt2811_reset(dev); /* IRQ's 2,3,5,7 are valid for async command support */ - if (it->options[1] <= 7 && (BIT(it->options[1]) & 0xac)) { + if (it->options[1] >= 0 && it->options[1] <= 7 && (BIT(it->options[1]) & 0xac)) { ret = request_irq(it->options[1], dt2811_interrupt, 0, dev->board_name, dev); if (ret == 0) |