Re: [PATCH] comedi: dt2815: add hardware detection to prevent crash

[Deepanshu Kartikey]

On Mon, Mar 9, 2026 at 4:19 PM Deepanshu Kartikey <kartikey406@xxxxxxxxx> wrote:
>
> The dt2815 driver crashes when attached to I/O ports without actual
> hardware present. This occurs because syzkaller or users can attach
> the driver to arbitrary I/O addresses via COMEDI_DEVCONFIG ioctl.
>
> When no hardware exists at the specified port, inb() operations return
> 0xff (floating bus), but outb() operations can trigger page faults due
> to undefined behavior, especially under race conditions:
>
>   BUG: unable to handle page fault for address: 000000007fffff90
>   #PF: supervisor write access in kernel mode
>   #PF: error_code(0x0002) - not-present page
>   RIP: 0010:dt2815_attach+0x6e0/0x1110
>
> Add hardware detection by reading the status register before attempting
> any write operations. If the read returns 0xff, assume no hardware is
> present and fail the attach with -ENODEV. This prevents crashes from
> outb() operations on non-existent hardware.
>
> Reported-by: syzbot+72f94b474d6e50b71ffc@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes: https://syzkaller.appspot.com/bug?extid=72f94b474d6e50b71ffc
> Tested-by: syzbot+72f94b474d6e50b71ffc@xxxxxxxxxxxxxxxxxxxxxxxxx
> Reviewed-by: Ian Abbott <abbotti@xxxxxxxxx>
> Signed-off-by: Deepanshu Kartikey <kartikey406@xxxxxxxxx>
> ---
>  drivers/comedi/drivers/dt2815.c | 12 ++++++++++++
>  1 file changed, 12 insertions(+)
>
> diff --git a/drivers/comedi/drivers/dt2815.c b/drivers/comedi/drivers/dt2815.c
> index 03ba2fd18a21..7c642860f127 100644
> --- a/drivers/comedi/drivers/dt2815.c
> +++ b/drivers/comedi/drivers/dt2815.c
> @@ -175,6 +175,18 @@ static int dt2815_attach(struct comedi_device *dev, struct comedi_devconfig *it)
>                     ? current_range_type : voltage_range_type;
>         }
>
> +       /*
> +        * Check if hardware is present before attempting any I/O operations.
> +        * Reading 0xff from status register typically indicates no hardware
> +        * on the bus (floating bus reads as all 1s).
> +        */
> +       if (inb(dev->iobase + DT2815_STATUS) == 0xff) {
> +               dev_err(dev->class_dev,
> +                       "No hardware detected at I/O base 0x%lx\n",
> +                       dev->iobase);
> +               return -ENODEV;
> +       }
> +
>         /* Init the 2815 */
>         outb(0x00, dev->iobase + DT2815_STATUS);
>         for (i = 0; i < 100; i++) {
> --
> 2.43.0
>


Hi Greg,

Gentle ping on this patch. This patch was submitted on 26th jan 2026.
It. It is  Reviewed-by: Ian Abbott <abbotti@xxxxxxxxx>

Subject: [PATCH] comedi: dt2815: add hardware
detection to prevent crash
Link: [https://lore.kernel.org/all/20260126070458.10974-1-kartikey406@xxxxxxxxx/T/]

Let me know if any changes required.

Thanks