| e03b29b5 | 12-Jan-2026 |
Ian Abbott <abbotti@mev.co.uk> |
comedi: dmm32at: serialize use of paged registers
Some of the hardware registers of the DMM-32-AT board are multiplexed, using the least significant two bits of the Miscellaneous Control register to
comedi: dmm32at: serialize use of paged registers
Some of the hardware registers of the DMM-32-AT board are multiplexed, using the least significant two bits of the Miscellaneous Control register to select the function of registers at offsets 12 to 15:
00 => 8254 timer/counter registers are accessible 01 => 8255 digital I/O registers are accessible 10 => Reserved 11 => Calibration registers are accessible
The interrupt service routine (`dmm32at_isr()`) clobbers the bottom two bits of the register with value 00, which would interfere with access to the 8255 registers by the `dm32at_8255_io()` function (used for Comedi instruction handling on the digital I/O subdevice).
Make use of the generic Comedi device spin-lock `dev->spinlock` (which is otherwise unused by this driver) to serialize access to the miscellaneous control register and paged registers.
Fixes: 3c501880ac44 ("Staging: comedi: add dmm32at driver") Cc: stable@vger.kernel.org Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Link: https://patch.msgid.link/20260112162835.91688-1-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
show more ...
|
| b842f8c6 | 10-Dec-2025 |
Ian Abbott <abbotti@mev.co.uk> |
comedi: comedi_test: add a DIO subdevice
The fake "comedi_test" device currently has two subdevices: an analog input subdevice, and an analog output subdevice. To make it a bit more useful for test
comedi: comedi_test: add a DIO subdevice
The fake "comedi_test" device currently has two subdevices: an analog input subdevice, and an analog output subdevice. To make it a bit more useful for testing, add a third subdevice for digital I/O.
The new DIO subdevice has 32 channels with each channel individually programmable as an input or an output. To add a bit of interaction, channels 0 to 15 are wired to channels 16 to 31 (0 to 16, 1 to 17, etc.), and the state of each wire can be read back on both of the channels connected to it. The outputs are modelled as NPN open collector outputs with a pull-up resistor on the wire, so the state of each wire (and the value read back from each channel connected to it) will be logic level 1 unless either channel is configured as an output at logic level 0.
Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Link: https://patch.msgid.link/20251210124455.69131-1-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
show more ...
|
| 98d86d87 | 28-Oct-2025 |
Ian Abbott <abbotti@mev.co.uk> |
comedi: 8255: Fail to attach if fail to request I/O port region
The COMEDI standalone 8255 driver can be used to configure a COMEDI device consisting of one of more subdevices, each using an 8255 di
comedi: 8255: Fail to attach if fail to request I/O port region
The COMEDI standalone 8255 driver can be used to configure a COMEDI device consisting of one of more subdevices, each using an 8255 digital I/O chip mapped to a range of port I/O addresses. The base port I/O address of each chip is specified in an array of integer option values by the `COMEDI_DEVCONFIG` ioctl.
When support for multiple 8255 subdevices per device was added in the out-of-tree comedi 0.7.27 back in 1999, if any port I/O region could not be requested, then the corresponding subdevice was set to be an "unused" subdevice, and the COMEDI device would still be set-up OK as long as those were the only types of errors. That has persisted until the present day, but seems a bit odd in retrospect. All the other COMEDI drivers that use port I/O or memory regions will fail to set up the device if any region cannot be requested. It seems unlikely that the sys admin would deliberately choose a port that cannot be requested just to leave a gap in the device's usable subdevice numbers, and failing to set-up the device will provide a more noticeable indication that something hasn't been set-up correctly, so change the driver to fail to set up the device if any of the port I/O regions cannot be requested.
Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Link: https://patch.msgid.link/20251028112833.15033-1-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
show more ...
|
| 2402f958 | 27-Oct-2025 |
Ian Abbott <abbotti@mev.co.uk> |
comedi: comedi_bond: Check for loops when bonding devices
The "comedi_bond" driver allows a composite COMEDI device to be built up from the subdevices of other COMEDI devices, although it currently
comedi: comedi_bond: Check for loops when bonding devices
The "comedi_bond" driver allows a composite COMEDI device to be built up from the subdevices of other COMEDI devices, although it currently only supports digital I/O subdevices. Although it checks that it is not trying to bind to itself, it is possible to end up with a cycle of "comedi_bond" devices bound to each other. For example:
1. Configure /dev/comedi0 to use some COMEDI hardware device with digital I/O subdevices, but not a "comedi_bond" device. 2. Configure /dev/comedi1 as a "comedi_bond" device bound to /dev/comedi0. 3. Unconfigure /dev/comedi0 and reconfigure it as a "comedi_bond" device bound to /dev/comedi1.
Now we have /dev/comedi0 and /dev/comedi1 bound in a cycle. When an operation is performed on the digital I/O subdevice of /dev/comedi0 for example, it will try and perform the operation on /dev/comedi1, which will try and perform the operation on /dev/comedi0. The task will end up deadlocked trying to lock /dev/comedi0's mutex which it has already locked.
I discovered that possibility while investigating fix sysbot crash https://syzkaller.appspot.com/bug?extid=4a6138c17a47937dcea1 ("possible deadlock in comedi_do_insn"), but I think that report may be a false positive.
To avoid that, replace the calls to `comedi_open()` and `comedi_close()` in "kcomedilib" with calls to `comedi_open_from()` and `comedi_close_from()`. These take an extra parameter that indicates the COMEDI minor device number from which the open or close is being performed. `comedi_open_from()` will refuse to open the device if doing so would result in a cycle. The cycle detection depends on the extra parameter having the correct value for this device and also for existing devices in the chain.
Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Link: https://patch.msgid.link/20251027153748.4569-3-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
show more ...
|
| d1b3b9c7 | 27-Oct-2025 |
Ian Abbott <abbotti@mev.co.uk> |
comedi: kcomedilib: Add loop checking variants of open and close
Add `comedi_open_from(path, from)` and `comedi_close_from(dev, from)` as variants of the existing `comedi_from(path)` and `comedi_clo
comedi: kcomedilib: Add loop checking variants of open and close
Add `comedi_open_from(path, from)` and `comedi_close_from(dev, from)` as variants of the existing `comedi_from(path)` and `comedi_close(dev)`. The additional `from` parameter is a minor device number that tells the function that the COMEDI device is being opened or closed from another COMEDI device if the value is in the range [0, `COMEDI_NUM_BOARD_MINORS`-1]. In that case the function will refuse to open the device if it would lead to a chain of devices opening each other. (It will also impose a limit on the number of simultaneous opens from one device to another because we need to count those.)
The new functions are intended to be used by the "comedi_bond" driver, which is the only driver that uses the existing `comedi_open()` and `comedi_close()` functions. The new functions will be used to avoid some possible deadlock situations.
Replace the existing, exported `comedi_open()` and `comedi_close()` functions with inline wrapper functions that call the newly exported `comedi_open_from()` and `comedi_close_from()` functions.
Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Link: https://patch.msgid.link/20251027153748.4569-2-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
show more ...
|
| 51495254 | 23-Oct-2025 |
Ian Abbott <abbotti@mev.co.uk> |
comedi: Use reference count for asynchronous command functions
For interrupts from badly behaved hardware (as emulated by Syzbot), it is possible for the Comedi core functions that manage the progre
comedi: Use reference count for asynchronous command functions
For interrupts from badly behaved hardware (as emulated by Syzbot), it is possible for the Comedi core functions that manage the progress of asynchronous data acquisition to be called from driver ISRs while no asynchronous command has been set up, which can cause problems such as invalid pointer dereferencing or dividing by zero.
Change those functions in the Comedi core to use this pattern: if `comedi_get_is_subdevice_running(s)` returns `true` then call a safe version of the function with the same name prefixed with an underscore, followed by a call to `comedi_put_is_subdevice_running(s)`, otherwise take some default action.
`comedi_get_is_subdevice_running(s)` returning `true` ensures that the details of the asynchronous command will not be destroyed before the matching call to `comedi_put_is_subdevice_running(s)`.
Replace calls to those functions from elsewhere in the Comedi core with calls to the safe versions of the functions.
The modified functions are: `comedi_buf_read_alloc()`, `comedi_buf_read_free()`, `comedi_buf_read_n_available()`, `comedi_buf_read_samples()`, `comedi_buf_write_alloc()`, `comedi_buf_write_free()`, `comedi_buf_write_samples()`, `comedi_bytes_per_scan()`, `comedi_event()`, `comedi_handle_events()`, `comedi_inc_scan_progress()`, `comedi_nsamples_left()`, `comedi_nscans_left()`.
Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Link: https://patch.msgid.link/20251023133001.8439-3-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
show more ...
|
| 4e1da516 | 23-Oct-2025 |
Ian Abbott <abbotti@mev.co.uk> |
comedi: Add reference counting for Comedi command handling
For interrupts from badly behaved hardware (as emulated by Syzbot), it is possible for the Comedi core functions that manage the progress o
comedi: Add reference counting for Comedi command handling
For interrupts from badly behaved hardware (as emulated by Syzbot), it is possible for the Comedi core functions that manage the progress of asynchronous data acquisition to be called from driver ISRs while no asynchronous command has been set up, which can cause problems such as invalid pointer dereferencing or dividing by zero.
To help protect against that, introduce new functions to maintain a reference counter for asynchronous commands that are being set up. `comedi_get_is_subdevice_running(s)` will check if a command has been set up on a subdevice and is still marked as running, and if so will increment the reference counter and return `true`, otherwise it will return `false` without modifying the reference counter. `comedi_put_is_subdevice_running(s)` will decrement the reference counter and set a completion event when decremented to 0.
Change the `do_cmd_ioctl()` function (responsible for setting up the asynchronous command) to reinitialize the completion event and set the reference counter to 1 before it marks the subdevice as running. Change the `do_become_nonbusy()` function (responsible for destroying a completed command) to call `comedi_put_is_subdevice_running(s)` and wait for the completion event after marking the subdevice as not running.
Because the subdevice normally gets marked as not running before the call to `do_become_nonbusy()` (and may also be called when the Comedi device is being detached from the low-level driver), add a new flag `COMEDI_SRF_BUSY` to the set of subdevice run-flags that indicates that an asynchronous command was set up and will need to be destroyed. This flag is set by `do_cmd_ioctl()` and cleared and checked by `do_become_nonbusy()`.
Subsequent patches will change the Comedi core functions that are called from low-level drivers for asynchrous command handling to make use of the `comedi_get_is_subdevice_running()` and `comedi_put_is_subdevice_running()` functions, and will modify the ISRs of some of these low-level drivers if they dereference the subdevice's `async` pointer directly.
Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Link: https://patch.msgid.link/20251023133001.8439-2-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
show more ...
|
| a51f025b | 23-Oct-2025 |
Nikita Zhandarovich <n.zhandarovich@fintech.ru> |
comedi: pcl818: fix null-ptr-deref in pcl818_ai_cancel()
Syzbot identified an issue [1] in pcl818_ai_cancel(), which stems from the fact that in case of early device detach via pcl818_detach(), subd
comedi: pcl818: fix null-ptr-deref in pcl818_ai_cancel()
Syzbot identified an issue [1] in pcl818_ai_cancel(), which stems from the fact that in case of early device detach via pcl818_detach(), subdevice dev->read_subdev may not have initialized its pointer to &struct comedi_async as intended. Thus, any such dereferencing of &s->async->cmd will lead to general protection fault and kernel crash.
Mitigate this problem by removing a call to pcl818_ai_cancel() from pcl818_detach() altogether. This way, if the subdevice setups its support for async commands, everything async-related will be handled via subdevice's own ->cancel() function in comedi_device_detach_locked() even before pcl818_detach(). If no support for asynchronous commands is provided, there is no need to cancel anything either.
[1] Syzbot crash: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000005: 0000 [#1] SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000028-0x000000000000002f] CPU: 1 UID: 0 PID: 6050 Comm: syz.0.18 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 RIP: 0010:pcl818_ai_cancel+0x69/0x3f0 drivers/comedi/drivers/pcl818.c:762 ... Call Trace: <TASK> pcl818_detach+0x66/0xd0 drivers/comedi/drivers/pcl818.c:1115 comedi_device_detach_locked+0x178/0x750 drivers/comedi/drivers.c:207 do_devconfig_ioctl drivers/comedi/comedi_fops.c:848 [inline] comedi_unlocked_ioctl+0xcde/0x1020 drivers/comedi/comedi_fops.c:2178 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] ...
Reported-by: syzbot+fce5d9d5bd067d6fbe9b@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=fce5d9d5bd067d6fbe9b Fixes: 00aba6e7b565 ("staging: comedi: pcl818: remove 'neverending_ai' from private data") Cc: stable <stable@kernel.org> Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru> Reviewed-by: Ian Abbott <abbotti@mev.co.uk> Link: https://patch.msgid.link/20251023141457.398685-1-n.zhandarovich@fintech.ru Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
show more ...
|
| f24c6e3a | 23-Oct-2025 |
Nikita Zhandarovich <n.zhandarovich@fintech.ru> |
comedi: multiq3: sanitize config options in multiq3_attach()
Syzbot identified an issue [1] in multiq3_attach() that induces a task timeout due to open() or COMEDI_DEVCONFIG ioctl operations, specif
comedi: multiq3: sanitize config options in multiq3_attach()
Syzbot identified an issue [1] in multiq3_attach() that induces a task timeout due to open() or COMEDI_DEVCONFIG ioctl operations, specifically, in the case of multiq3 driver.
This problem arose when syzkaller managed to craft weird configuration options used to specify the number of channels in encoder subdevice. If a particularly great number is passed to s->n_chan in multiq3_attach() via it->options[2], then multiple calls to multiq3_encoder_reset() at the end of driver-specific attach() method will be running for minutes, thus blocking tasks and affected devices as well.
While this issue is most likely not too dangerous for real-life devices, it still makes sense to sanitize configuration inputs. Enable a sensible limit on the number of encoder chips (4 chips max, each with 2 channels) to stop this behaviour from manifesting.
[1] Syzbot crash: INFO: task syz.2.19:6067 blocked for more than 143 seconds. ... Call Trace: <TASK> context_switch kernel/sched/core.c:5254 [inline] __schedule+0x17c4/0x4d60 kernel/sched/core.c:6862 __schedule_loop kernel/sched/core.c:6944 [inline] schedule+0x165/0x360 kernel/sched/core.c:6959 schedule_preempt_disabled+0x13/0x30 kernel/sched/core.c:7016 __mutex_lock_common kernel/locking/mutex.c:676 [inline] __mutex_lock+0x7e6/0x1350 kernel/locking/mutex.c:760 comedi_open+0xc0/0x590 drivers/comedi/comedi_fops.c:2868 chrdev_open+0x4cc/0x5e0 fs/char_dev.c:414 do_dentry_open+0x953/0x13f0 fs/open.c:965 vfs_open+0x3b/0x340 fs/open.c:1097 ...
Reported-by: syzbot+7811bb68a317954a0347@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=7811bb68a317954a0347 Fixes: 77e01cdbad51 ("Staging: comedi: add multiq3 driver") Cc: stable <stable@kernel.org> Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru> Reviewed-by: Ian Abbott <abbotti@mev.co.uk> Link: https://patch.msgid.link/20251023132205.395753-1-n.zhandarovich@fintech.ru Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
show more ...
|
| 0de7d9cd | 23-Oct-2025 |
Nikita Zhandarovich <n.zhandarovich@fintech.ru> |
comedi: check device's attached status in compat ioctls
Syzbot identified an issue [1] that crashes kernel, seemingly due to unexistent callback dev->get_valid_routes(). By all means, this should no
comedi: check device's attached status in compat ioctls
Syzbot identified an issue [1] that crashes kernel, seemingly due to unexistent callback dev->get_valid_routes(). By all means, this should not occur as said callback must always be set to get_zero_valid_routes() in __comedi_device_postconfig().
As the crash seems to appear exclusively in i386 kernels, at least, judging from [1] reports, the blame lies with compat versions of standard IOCTL handlers. Several of them are modified and do not use comedi_unlocked_ioctl(). While functionality of these ioctls essentially copy their original versions, they do not have required sanity check for device's attached status. This, in turn, leads to a possibility of calling select IOCTLs on a device that has not been properly setup, even via COMEDI_DEVCONFIG.
Doing so on unconfigured devices means that several crucial steps are missed, for instance, specifying dev->get_valid_routes() callback.
Fix this somewhat crudely by ensuring device's attached status before performing any ioctls, improving logic consistency between modern and compat functions.
[1] Syzbot report: BUG: kernel NULL pointer dereference, address: 0000000000000000 ... CR2: ffffffffffffffd6 CR3: 000000006c717000 CR4: 0000000000352ef0 Call Trace: <TASK> get_valid_routes drivers/comedi/comedi_fops.c:1322 [inline] parse_insn+0x78c/0x1970 drivers/comedi/comedi_fops.c:1401 do_insnlist_ioctl+0x272/0x700 drivers/comedi/comedi_fops.c:1594 compat_insnlist drivers/comedi/comedi_fops.c:3208 [inline] comedi_compat_ioctl+0x810/0x990 drivers/comedi/comedi_fops.c:3273 __do_compat_sys_ioctl fs/ioctl.c:695 [inline] __se_compat_sys_ioctl fs/ioctl.c:638 [inline] __ia32_compat_sys_ioctl+0x242/0x370 fs/ioctl.c:638 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline] ...
Reported-by: syzbot+ab8008c24e84adee93ff@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=ab8008c24e84adee93ff Fixes: 3fbfd2223a27 ("comedi: get rid of compat_alloc_user_space() mess in COMEDI_CHANINFO compat") Cc: stable <stable@kernel.org> Reviewed-by: Ian Abbott <abbotti@mev.co.uk> Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru> Link: https://patch.msgid.link/20251023132234.395794-1-n.zhandarovich@fintech.ru Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
show more ...
|
| 72262330 | 23-Oct-2025 |
Ian Abbott <abbotti@mev.co.uk> |
comedi: c6xdigio: Fix invalid PNP driver unregistration
The Comedi low-level driver "c6xdigio" seems to be for a parallel port connected device. When the Comedi core calls the driver's Comedi "atta
comedi: c6xdigio: Fix invalid PNP driver unregistration
The Comedi low-level driver "c6xdigio" seems to be for a parallel port connected device. When the Comedi core calls the driver's Comedi "attach" handler `c6xdigio_attach()` to configure a Comedi to use this driver, it tries to enable the parallel port PNP resources by registering a PNP driver with `pnp_register_driver()`, but ignores the return value. (The `struct pnp_driver` it uses has only the `name` and `id_table` members filled in.) The driver's Comedi "detach" handler `c6xdigio_detach()` unconditionally unregisters the PNP driver with `pnp_unregister_driver()`.
It is possible for `c6xdigio_attach()` to return an error before it calls `pnp_register_driver()` and it is possible for the call to `pnp_register_driver()` to return an error (that is ignored). In both cases, the driver should not be calling `pnp_unregister_driver()` as it does in `c6xdigio_detach()`. (Note that `c6xdigio_detach()` will be called by the Comedi core if `c6xdigio_attach()` returns an error, or if the Comedi core decides to detach the Comedi device from the driver for some other reason.)
The unconditional call to `pnp_unregister_driver()` without a previous successful call to `pnp_register_driver()` will cause `driver_unregister()` to issue a warning "Unexpected driver unregister!". This was detected by Syzbot [1].
Also, the PNP driver registration and unregistration should be done at module init and exit time, respectively, not when attaching or detaching Comedi devices to the driver. (There might be more than one Comedi device being attached to the driver, although that is unlikely.)
Change the driver to do the PNP driver registration at module init time, and the unregistration at module exit time. Since `c6xdigio_detach()` now only calls `comedi_legacy_detach()`, remove the function and change the Comedi driver "detach" handler to `comedi_legacy_detach`.
------------------------------------------- [1] Syzbot sample crash report: Unexpected driver unregister! WARNING: CPU: 0 PID: 5970 at drivers/base/driver.c:273 driver_unregister drivers/base/driver.c:273 [inline] WARNING: CPU: 0 PID: 5970 at drivers/base/driver.c:273 driver_unregister+0x90/0xb0 drivers/base/driver.c:270 Modules linked in: CPU: 0 UID: 0 PID: 5970 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 RIP: 0010:driver_unregister drivers/base/driver.c:273 [inline] RIP: 0010:driver_unregister+0x90/0xb0 drivers/base/driver.c:270 Code: 48 89 ef e8 c2 e6 82 fc 48 89 df e8 3a 93 ff ff 5b 5d e9 c3 6d d9 fb e8 be 6d d9 fb 90 48 c7 c7 e0 f8 1f 8c e8 51 a2 97 fb 90 <0f> 0b 90 90 5b 5d e9 a5 6d d9 fb e8 e0 f4 41 fc eb 94 e8 d9 f4 41 RSP: 0018:ffffc9000373f9a0 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffffffff8ff24720 RCX: ffffffff817b6ee8 RDX: ffff88807c932480 RSI: ffffffff817b6ef5 RDI: 0000000000000001 RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000001 R12: ffffffff8ff24660 R13: dffffc0000000000 R14: 0000000000000000 R15: ffff88814cca0000 FS: 000055556dab1500(0000) GS:ffff8881249d9000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055f77f285cd0 CR3: 000000007d871000 CR4: 00000000003526f0 Call Trace: <TASK> comedi_device_detach_locked+0x12f/0xa50 drivers/comedi/drivers.c:207 comedi_device_detach+0x67/0xb0 drivers/comedi/drivers.c:215 comedi_device_attach+0x43d/0x900 drivers/comedi/drivers.c:1011 do_devconfig_ioctl+0x1b1/0x710 drivers/comedi/comedi_fops.c:872 comedi_unlocked_ioctl+0x165d/0x2f00 drivers/comedi/comedi_fops.c:2178 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0xfa0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fc05798eec9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffcf8184238 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007fc057be5fa0 RCX: 00007fc05798eec9 RDX: 0000200000000080 RSI: 0000000040946400 RDI: 0000000000000003 RBP: 00007fc057a11f91 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fc057be5fa0 R14: 00007fc057be5fa0 R15: 0000000000000003 </TASK> -------------------------------------------
Reported-by: syzbot+6616bba359cec7a1def1@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=6616bba359cec7a1def1 Fixes: 2c89e159cd2f ("Staging: comedi: add c6xdigio driver") Cc: stable <stable@kernel.org> Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Link: https://patch.msgid.link/20251023123141.6537-1-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
show more ...
/linux/Documentation/ABI/testing/sysfs-bus-iio/linux/Documentation/devicetree/bindings/arm/qcom,coresight-tpdm.yaml/linux/Documentation/devicetree/bindings/fpga/fpga-region.yaml/linux/Documentation/devicetree/bindings/iio/accel/adi,adxl345.yaml/linux/Documentation/devicetree/bindings/iio/accel/adi,adxl380.yaml/linux/Documentation/devicetree/bindings/iio/accel/bosch,bma220.yaml/linux/Documentation/devicetree/bindings/iio/adc/adi,ad4080.yaml/linux/Documentation/devicetree/bindings/iio/adc/adi,max14001.yaml/linux/Documentation/devicetree/bindings/iio/adc/aspeed,ast2600-adc.yaml/linux/Documentation/devicetree/bindings/iio/adc/mediatek,mt2701-auxadc.yaml/linux/Documentation/devicetree/bindings/iio/adc/renesas,r9a09g077-adc.yaml/linux/Documentation/devicetree/bindings/iio/adc/renesas,rzn1-adc.yaml/linux/Documentation/devicetree/bindings/iio/adc/rockchip-saradc.yaml/linux/Documentation/devicetree/bindings/iio/dac/adi,ad5446.yaml/linux/Documentation/devicetree/bindings/iio/health/maxim,max30100.yaml/linux/Documentation/devicetree/bindings/iio/imu/bosch,smi330.yaml/linux/Documentation/devicetree/bindings/iio/imu/invensense,icm45600.yaml/linux/Documentation/devicetree/bindings/iio/imu/invensense,mpu6050.yaml/linux/Documentation/devicetree/bindings/iio/pressure/aosong,adp810.yaml/linux/Documentation/devicetree/bindings/iio/pressure/fsl,mpl3115.yaml/linux/Documentation/devicetree/bindings/iio/pressure/infineon,dps310.yaml/linux/Documentation/devicetree/bindings/interconnect/qcom,kaanapali-rpmh.yaml/linux/Documentation/devicetree/bindings/interconnect/qcom,msm8998-bwmon.yaml/linux/Documentation/devicetree/bindings/interconnect/qcom,sa8775p-rpmh.yaml/linux/Documentation/devicetree/bindings/interconnect/qcom,sm6350-rpmh.yaml/linux/Documentation/devicetree/bindings/nvmem/imx-ocotp.yaml/linux/Documentation/devicetree/bindings/nvmem/layouts/u-boot,env.yaml/linux/Documentation/devicetree/bindings/nvmem/mediatek,efuse.yaml/linux/Documentation/devicetree/bindings/nvmem/qcom,qfprom.yaml/linux/Documentation/devicetree/bindings/nvmem/st,stm32-romem.yaml/linux/Documentation/devicetree/bindings/trivial-devices.yaml/linux/Documentation/iio/ade9000.rst/linux/Documentation/iio/adis16475.rst/linux/Documentation/iio/adis16480.rst/linux/Documentation/iio/adis16550.rst/linux/Documentation/iio/adxl345.rst/linux/Documentation/iio/adxl380.rst/linux/MAINTAINERS/linux/arch/arm64/boot/dts/qcom/msm8996.dtsi/linux/drivers/android/binder.c/linux/drivers/android/binder/node.rs/linux/drivers/android/binder/process.rs/linux/drivers/android/binder/rust_binder_main.rs/linux/drivers/android/binder/thread.rs/linux/drivers/android/binderfs.c/linux/drivers/android/tests/binder_alloc_kunit.c/linux/drivers/bus/mhi/ep/internal.h/linux/drivers/bus/mhi/ep/main.c/linux/drivers/bus/mhi/host/pci_generic.cdrivers/c6xdigio.c/linux/drivers/firmware/stratix10-rsu.c/linux/drivers/firmware/stratix10-svc.c/linux/drivers/fpga/altera-cvp.c/linux/drivers/fpga/xilinx-spi.c/linux/drivers/hwtracing/coresight/coresight-catu.c/linux/drivers/hwtracing/coresight/coresight-core.c/linux/drivers/hwtracing/coresight/coresight-ctcu-core.c/linux/drivers/hwtracing/coresight/coresight-cti-core.c/linux/drivers/hwtracing/coresight/coresight-cti.h/linux/drivers/hwtracing/coresight/coresight-dummy.c/linux/drivers/hwtracing/coresight/coresight-etb10.c/linux/drivers/hwtracing/coresight/coresight-etm-perf.c/linux/drivers/hwtracing/coresight/coresight-etm3x-core.c/linux/drivers/hwtracing/coresight/coresight-etm4x-core.c/linux/drivers/hwtracing/coresight/coresight-etm4x.h/linux/drivers/hwtracing/coresight/coresight-priv.h/linux/drivers/hwtracing/coresight/coresight-sysfs.c/linux/drivers/hwtracing/coresight/coresight-tmc-etf.c/linux/drivers/hwtracing/coresight/coresight-tmc-etr.c/linux/drivers/hwtracing/coresight/coresight-tmc.h/linux/drivers/hwtracing/coresight/coresight-tpda.c/linux/drivers/hwtracing/coresight/coresight-tpdm.c/linux/drivers/hwtracing/coresight/coresight-tpdm.h/linux/drivers/hwtracing/coresight/coresight-tpiu.c/linux/drivers/hwtracing/coresight/coresight-trbe.c/linux/drivers/hwtracing/coresight/ultrasoc-smb.c/linux/drivers/iio/accel/Kconfig/linux/drivers/iio/accel/Makefile/linux/drivers/iio/accel/adxl380.c/linux/drivers/iio/accel/adxl380.h/linux/drivers/iio/accel/adxl380_i2c.c/linux/drivers/iio/accel/adxl380_spi.c/linux/drivers/iio/accel/bma220.h/linux/drivers/iio/accel/bma220_core.c/linux/drivers/iio/accel/bma220_i2c.c/linux/drivers/iio/accel/bma220_spi.c/linux/drivers/iio/accel/bma400.h/linux/drivers/iio/accel/bma400_core.c/linux/drivers/iio/adc/Kconfig/linux/drivers/iio/adc/Makefile/linux/drivers/iio/adc/ad4030.c/linux/drivers/iio/adc/ad4080.c/linux/drivers/iio/adc/ad7124.c/linux/drivers/iio/adc/ad7768-1.c/linux/drivers/iio/adc/ade9000.c/linux/drivers/iio/adc/aspeed_adc.c/linux/drivers/iio/adc/max14001.c/linux/drivers/iio/adc/mcp3564.c/linux/drivers/iio/adc/meson_saradc.c/linux/drivers/iio/adc/mt6360-adc.c/linux/drivers/iio/adc/pac1921.c/linux/drivers/iio/adc/pac1934.c/linux/drivers/iio/adc/qcom-spmi-rradc.c/linux/drivers/iio/adc/rohm-bd79112.c/linux/drivers/iio/adc/rohm-bd79124.c/linux/drivers/iio/adc/rzn1-adc.c/linux/drivers/iio/adc/rzt2h_adc.c/linux/drivers/iio/adc/ti-ads131e08.c/linux/drivers/iio/adc/ti_am335x_adc.c/linux/drivers/iio/buffer/industrialio-buffer-cb.c/linux/drivers/iio/common/scmi_sensors/scmi_iio.c/linux/drivers/iio/dac/Kconfig/linux/drivers/iio/dac/Makefile/linux/drivers/iio/dac/ad5446-i2c.c/linux/drivers/iio/dac/ad5446-spi.c/linux/drivers/iio/dac/ad5446.c/linux/drivers/iio/dac/ad5446.h/linux/drivers/iio/dac/ltc2688.c/linux/drivers/iio/health/max30100.c/linux/drivers/iio/imu/Kconfig/linux/drivers/iio/imu/Makefile/linux/drivers/iio/imu/bmi270/bmi270_core.c/linux/drivers/iio/imu/bmi270/bmi270_spi.c/linux/drivers/iio/imu/inv_icm45600/Kconfig/linux/drivers/iio/imu/inv_icm45600/Makefile/linux/drivers/iio/imu/inv_icm45600/inv_icm45600.h/linux/drivers/iio/imu/inv_icm45600/inv_icm45600_accel.c/linux/drivers/iio/imu/inv_icm45600/inv_icm45600_buffer.c/linux/drivers/iio/imu/inv_icm45600/inv_icm45600_buffer.h/linux/drivers/iio/imu/inv_icm45600/inv_icm45600_core.c/linux/drivers/iio/imu/inv_icm45600/inv_icm45600_gyro.c/linux/drivers/iio/imu/inv_icm45600/inv_icm45600_i2c.c/linux/drivers/iio/imu/inv_icm45600/inv_icm45600_i3c.c/linux/drivers/iio/imu/inv_icm45600/inv_icm45600_spi.c/linux/drivers/iio/imu/smi330/Kconfig/linux/drivers/iio/imu/smi330/Makefile/linux/drivers/iio/imu/smi330/smi330.h/linux/drivers/iio/imu/smi330/smi330_core.c/linux/drivers/iio/imu/smi330/smi330_i2c.c/linux/drivers/iio/imu/smi330/smi330_spi.c/linux/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx.h/linux/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_buffer.c/linux/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c/linux/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_shub.c/linux/drivers/iio/industrialio-backend.c/linux/drivers/iio/industrialio-buffer.c/linux/drivers/iio/industrialio-core.c/linux/drivers/iio/light/apds9306.c/linux/drivers/iio/light/apds9960.c/linux/drivers/iio/light/ltr390.c/linux/drivers/iio/light/veml3235.c/linux/drivers/iio/position/hid-sensor-custom-intel-hinge.c/linux/drivers/iio/pressure/Kconfig/linux/drivers/iio/pressure/Makefile/linux/drivers/iio/pressure/adp810.c/linux/drivers/iio/pressure/mpl3115.c/linux/drivers/iio/resolver/ad2s1210.c/linux/drivers/interconnect/debugfs-client.c/linux/drivers/interconnect/qcom/Kconfig/linux/drivers/interconnect/qcom/Makefile/linux/drivers/interconnect/qcom/glymur.c/linux/drivers/interconnect/qcom/icc-rpmh.c/linux/drivers/interconnect/qcom/icc-rpmh.h/linux/drivers/interconnect/qcom/kaanapali.c/linux/drivers/interconnect/qcom/milos.c/linux/drivers/interconnect/qcom/msm8996.c/linux/drivers/interconnect/qcom/qcs615.c/linux/drivers/interconnect/qcom/qcs8300.c/linux/drivers/interconnect/qcom/qdu1000.c/linux/drivers/interconnect/qcom/sa8775p.c/linux/drivers/interconnect/qcom/sar2130p.c/linux/drivers/interconnect/qcom/sc7180.c/linux/drivers/interconnect/qcom/sc7280.c/linux/drivers/interconnect/qcom/sc8180x.c/linux/drivers/interconnect/qcom/sc8280xp.c/linux/drivers/interconnect/qcom/sdm670.c/linux/drivers/interconnect/qcom/sdm845.c/linux/drivers/interconnect/qcom/sdx55.c/linux/drivers/interconnect/qcom/sdx65.c/linux/drivers/interconnect/qcom/sdx75.c/linux/drivers/interconnect/qcom/sm6350.c/linux/drivers/interconnect/qcom/sm7150.c/linux/drivers/interconnect/qcom/sm8150.c/linux/drivers/interconnect/qcom/sm8250.c/linux/drivers/interconnect/qcom/sm8350.c/linux/drivers/interconnect/qcom/sm8450.c/linux/drivers/interconnect/qcom/sm8550.c/linux/drivers/interconnect/qcom/sm8650.c/linux/drivers/interconnect/qcom/sm8750.c/linux/drivers/interconnect/qcom/x1e80100.c/linux/drivers/misc/mei/Kconfig/linux/drivers/misc/mei/client.c/linux/drivers/misc/mei/interrupt.c/linux/drivers/misc/mei/main.c/linux/drivers/nvmem/Kconfig/linux/drivers/nvmem/Makefile/linux/drivers/nvmem/imx-ocotp-ele.c/linux/drivers/nvmem/layouts/u-boot-env.c/linux/drivers/nvmem/qnap-mcu-eeprom.c/linux/drivers/peci/controller/peci-aspeed.c/linux/drivers/staging/iio/addac/adt7316.c/linux/drivers/staging/iio/frequency/ad9834.c/linux/drivers/w1/masters/omap_hdq.c/linux/drivers/w1/slaves/w1_ds28e17.c/linux/drivers/w1/w1.c/linux/include/dt-bindings/interconnect/qcom,kaanapali-rpmh.h/linux/include/dt-bindings/interconnect/qcom,sdx75.h/linux/include/linux/coresight.h/linux/include/linux/firmware/intel/stratix10-smc.h/linux/include/linux/firmware/intel/stratix10-svc-client.h/linux/include/linux/iio/adc/qcom-vadc-common.h/linux/include/linux/iio/buffer.h/linux/include/linux/iio/buffer_impl.h/linux/include/linux/iio/consumer.h/linux/include/linux/iio/imu/adis.h/linux/include/linux/interconnect.h/linux/rust/kernel/list.rs |