diff options
| author | Pei Xiao <xiaopei01@kylinos.cn> | 2026-09-22 15:16:57 +0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2026-10-13 15:53:52 +0200 |
| commit | 471ce96a9c415b8a67bd5081ac2089a458cacc2f (patch) | |
| tree | 280bfa889ef092d9c59e54acf71dab12bf73bbd5 /tools/lib/python | |
| parent | 7e170600b36298cba2ba7a0c63d1cebea7970708 (diff) | |
comedi: dt2811: fix shift-out-of-bounds in IRQ check
The IRQ number passed via comedi_devconfig->options[1] is a signed int
that comes from userspace. The check `it->options[1] <= 7` does not
reject negative values, so a negative IRQ number reaches
`BIT(it->options[1])`, which is undefined behavior and triggers a UBSAN
shift-out-of-bounds warning:
UBSAN: shift-out-of-bounds in drivers/comedi/drivers/dt2811.c:570:31
shift exponent -251 is negative
Add an explicit lower bound check (`it->options[1] >= 0`) so that only
valid IRQ numbers 0..7 are accepted before the shift.
Fixes: f2975a9b2ab9 ("staging: comedi: dt2811: add async command support for AI subdevice")
Reported-by: syzbot+a4cedab706d0a8a3f988@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/6ab21240.e548f532.1ca396.0018.GAE@google.com/#R
Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Tested-by: syzbot+a4cedab706d0a8a3f988@syzkaller.appspotmail.com
Link: https://patch.msgid.link/02c46315293a26169d2a3862a2047959a1651ef4.1790061387.git.xiaopei01@kylinos.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'tools/lib/python')
0 files changed, 0 insertions, 0 deletions