* [syzbot] [comedi?] UBSAN: shift-out-of-bounds in dt2811_attach @ 2026-09-22 5:29 syzbot 2026-09-22 6:37 ` [PATCH] test dt2811 Pei Xiao 2026-09-22 7:16 ` [PATCH] comedi: dt2811: fix shift-out-of-bounds in IRQ check Pei Xiao 0 siblings, 2 replies; 8+ messages in thread From: syzbot @ 2026-09-22 5:29 UTC (permalink / raw) To: abbotti, hsweeten, linux-kernel, syzkaller-bugs Hello, syzbot found the following issue on: HEAD commit: 93f51579e7df Linux 7.3-rc4 git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=17b45005580000 kernel config: https://syzkaller.appspot.com/x/.config?x=7d012d9c67977ee4 dashboard link: https://syzkaller.appspot.com/bug?extid=a4cedab706d0a8a3f988 compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=106ff005580000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10d054c9580000 Downloadable assets: disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-93f51579.raw.xz vmlinux: https://storage.googleapis.com/syzbot-assets/00f02ade84ed/vmlinux-93f51579.xz kernel image: https://storage.googleapis.com/syzbot-assets/93be890b3b79/bzImage-93f51579.xz IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+a4cedab706d0a8a3f988@syzkaller.appspotmail.com ------------[ cut here ]------------ UBSAN: shift-out-of-bounds in drivers/comedi/drivers/dt2811.c:570:31 shift exponent -251 is negative CPU: 0 UID: 0 PID: 5925 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 ubsan_epilogue+0xa/0x30 lib/ubsan.c:233 __ubsan_handle_shift_out_of_bounds+0x279/0x2a0 lib/ubsan.c:494 dt2811_attach.cold+0x19/0x1e drivers/comedi/drivers/dt2811.c:570 comedi_device_attach+0x40e/0x6b0 drivers/comedi/drivers.c:1101 do_devconfig_ioctl+0x1b3/0x6d0 drivers/comedi/comedi_fops.c:930 comedi_unlocked_ioctl+0x860/0x3310 drivers/comedi/comedi_fops.c:2302 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fe50959e159 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffcc3e899c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007fe509825fa0 RCX: 00007fe50959e159 RDX: 0000200000000100 RSI: 0000000040946400 RDI: 0000000000000003 RBP: 00007fe50963506b R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fe509825fac R14: 00007fe509825fa0 R15: 00007fe509825fa0 </TASK> ---[ end trace ]--- --- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller@googlegroups.com. syzbot will keep track of this issue. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. If the report is already addressed, let syzbot know by replying with: #syz fix: exact-commit-title If you want syzbot to run the reproducer, reply with: #syz test: git://repo/address.git branch-or-commit-hash If you attach or paste a git patch, syzbot will apply it before testing. If you want to overwrite report's subsystems, reply with: #syz set subsystems: new-subsystem (See the list of subsystem names on the web dashboard) If the report is a duplicate of another one, reply with: #syz dup: exact-subject-of-another-report If you want to undo deduplication, reply with: #syz undup ^ permalink raw reply [flat|nested] 8+ messages in thread
* [PATCH] test dt2811 2026-09-22 5:29 [syzbot] [comedi?] UBSAN: shift-out-of-bounds in dt2811_attach syzbot @ 2026-09-22 6:37 ` Pei Xiao 2026-09-22 6:57 ` [syzbot] [comedi?] UBSAN: shift-out-of-bounds in dt2811_attach syzbot 2026-09-22 7:16 ` [PATCH] comedi: dt2811: fix shift-out-of-bounds in IRQ check Pei Xiao 1 sibling, 1 reply; 8+ messages in thread From: Pei Xiao @ 2026-09-22 6:37 UTC (permalink / raw) To: syzbot+a4cedab706d0a8a3f988 Cc: abbotti, hsweeten, linux-kernel, syzkaller-bugs, Pei Xiao #syz test --- drivers/comedi/drivers/dt2811.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/comedi/drivers/dt2811.c b/drivers/comedi/drivers/dt2811.c index 0438b8c90e44..5af2c71de4a2 100644 --- a/drivers/comedi/drivers/dt2811.c +++ b/drivers/comedi/drivers/dt2811.c @@ -567,7 +567,7 @@ static int dt2811_attach(struct comedi_device *dev, struct comedi_devconfig *it) dt2811_reset(dev); /* IRQ's 2,3,5,7 are valid for async command support */ - if (it->options[1] <= 7 && (BIT(it->options[1]) & 0xac)) { + if (it->options[1]>= 0 && it->options[1] <= 7 && (BIT(it->options[1]) & 0xac)) { ret = request_irq(it->options[1], dt2811_interrupt, 0, dev->board_name, dev); if (ret == 0) -- 2.25.1 ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [syzbot] [comedi?] UBSAN: shift-out-of-bounds in dt2811_attach 2026-09-22 6:37 ` [PATCH] test dt2811 Pei Xiao @ 2026-09-22 6:57 ` syzbot 0 siblings, 0 replies; 8+ messages in thread From: syzbot @ 2026-09-22 6:57 UTC (permalink / raw) To: abbotti, hsweeten, linux-kernel, syzkaller-bugs, xiaopei01 Hello, syzbot has tested the proposed patch and the reproducer did not trigger any issue: Reported-by: syzbot+a4cedab706d0a8a3f988@syzkaller.appspotmail.com Tested-by: syzbot+a4cedab706d0a8a3f988@syzkaller.appspotmail.com Tested on: commit: f0100363 Merge tag 'xfs-fixes-7.3-rc5' of gitolite.ker.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=13e6f45e580000 kernel config: https://syzkaller.appspot.com/x/.config?x=7d012d9c67977ee4 dashboard link: https://syzkaller.appspot.com/bug?extid=a4cedab706d0a8a3f988 compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44 patch: https://syzkaller.appspot.com/x/patch.diff?x=16dfea71580000 Note: testing is done by a robot and is best-effort only. ^ permalink raw reply [flat|nested] 8+ messages in thread
* [PATCH] comedi: dt2811: fix shift-out-of-bounds in IRQ check 2026-09-22 5:29 [syzbot] [comedi?] UBSAN: shift-out-of-bounds in dt2811_attach syzbot 2026-09-22 6:37 ` [PATCH] test dt2811 Pei Xiao @ 2026-09-22 7:16 ` Pei Xiao 2026-09-22 9:11 ` Ian Abbott ` (2 more replies) 1 sibling, 3 replies; 8+ messages in thread From: Pei Xiao @ 2026-09-22 7:16 UTC (permalink / raw) To: abbotti, hsweeten, linux-kernel, syzbot+a4cedab706d0a8a3f988 Cc: syzkaller-bugs, Pei Xiao The IRQ number passed via comedi_devconfig->options[1] is a signed int that comes from userspace. The check `it->options[1] <= 7` does not reject negative values, so a negative IRQ number reaches `BIT(it->options[1])`, which is undefined behavior and triggers a UBSAN shift-out-of-bounds warning: UBSAN: shift-out-of-bounds in drivers/comedi/drivers/dt2811.c:570:31 shift exponent -251 is negative Add an explicit lower bound check (`it->options[1] >= 0`) so that only valid IRQ numbers 0..7 are accepted before the shift. Fixes: f2975a9b2ab9 ("staging: comedi: dt2811: add async command support for AI subdevice") Reported-by: syzbot+a4cedab706d0a8a3f988@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/6ab21240.e548f532.1ca396.0018.GAE@google.com/#R Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn> --- drivers/comedi/drivers/dt2811.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/comedi/drivers/dt2811.c b/drivers/comedi/drivers/dt2811.c index 0438b8c90e44..53cb17993ae7 100644 --- a/drivers/comedi/drivers/dt2811.c +++ b/drivers/comedi/drivers/dt2811.c @@ -567,7 +567,7 @@ static int dt2811_attach(struct comedi_device *dev, struct comedi_devconfig *it) dt2811_reset(dev); /* IRQ's 2,3,5,7 are valid for async command support */ - if (it->options[1] <= 7 && (BIT(it->options[1]) & 0xac)) { + if (it->options[1] >= 0 && it->options[1] <= 7 && (BIT(it->options[1]) & 0xac)) { ret = request_irq(it->options[1], dt2811_interrupt, 0, dev->board_name, dev); if (ret == 0) -- 2.25.1 ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH] comedi: dt2811: fix shift-out-of-bounds in IRQ check 2026-09-22 7:16 ` [PATCH] comedi: dt2811: fix shift-out-of-bounds in IRQ check Pei Xiao @ 2026-09-22 9:11 ` Ian Abbott 2026-09-22 9:17 ` Pei Xiao 2026-09-22 9:19 ` Pei Xiao 2026-09-23 9:11 ` Ian Abbott 2 siblings, 1 reply; 8+ messages in thread From: Ian Abbott @ 2026-09-22 9:11 UTC (permalink / raw) To: Pei Xiao, hsweeten, linux-kernel, syzbot+a4cedab706d0a8a3f988 Cc: syzkaller-bugs On 2026-09-22 08:16, Pei Xiao wrote: > The IRQ number passed via comedi_devconfig->options[1] is a signed int > that comes from userspace. The check `it->options[1] <= 7` does not > reject negative values, so a negative IRQ number reaches > `BIT(it->options[1])`, which is undefined behavior and triggers a UBSAN > shift-out-of-bounds warning: > > UBSAN: shift-out-of-bounds in drivers/comedi/drivers/dt2811.c:570:31 > shift exponent -251 is negative > > Add an explicit lower bound check (`it->options[1] >= 0`) so that only > valid IRQ numbers 0..7 are accepted before the shift. > > Fixes: f2975a9b2ab9 ("staging: comedi: dt2811: add async command support for AI subdevice") > Reported-by: syzbot+a4cedab706d0a8a3f988@syzkaller.appspotmail.com > Closes: https://lore.kernel.org/all/6ab21240.e548f532.1ca396.0018.GAE@google.com/#R > Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn> > --- > drivers/comedi/drivers/dt2811.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/comedi/drivers/dt2811.c b/drivers/comedi/drivers/dt2811.c > index 0438b8c90e44..53cb17993ae7 100644 > --- a/drivers/comedi/drivers/dt2811.c > +++ b/drivers/comedi/drivers/dt2811.c > @@ -567,7 +567,7 @@ static int dt2811_attach(struct comedi_device *dev, struct comedi_devconfig *it) > dt2811_reset(dev); > > /* IRQ's 2,3,5,7 are valid for async command support */ > - if (it->options[1] <= 7 && (BIT(it->options[1]) & 0xac)) { > + if (it->options[1] >= 0 && it->options[1] <= 7 && (BIT(it->options[1]) & 0xac)) { > ret = request_irq(it->options[1], dt2811_interrupt, 0, > dev->board_name, dev); > if (ret == 0) Looks good, thanks! Please could you resend and Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> ? Thanks! -- -=( Ian Abbott <abbotti@mev.co.uk> || MEV Ltd. is a company )=- -=( registered in England & Wales. Regd. number: 02862268. )=- -=( Regd. addr.: S11 & 12 Building 67, Europa Business Park, )=- -=( Bird Hall Lane, STOCKPORT, SK3 0XA, UK. || www.mev.co.uk )=- ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH] comedi: dt2811: fix shift-out-of-bounds in IRQ check 2026-09-22 9:11 ` Ian Abbott @ 2026-09-22 9:17 ` Pei Xiao 0 siblings, 0 replies; 8+ messages in thread From: Pei Xiao @ 2026-09-22 9:17 UTC (permalink / raw) To: Ian Abbott, hsweeten, linux-kernel, syzbot+a4cedab706d0a8a3f988 Cc: syzkaller-bugs 在 2026/9/22 17:11, Ian Abbott 写道: > On 2026-09-22 08:16, Pei Xiao wrote: >> The IRQ number passed via comedi_devconfig->options[1] is a signed int >> that comes from userspace. The check `it->options[1] <= 7` does not >> reject negative values, so a negative IRQ number reaches >> `BIT(it->options[1])`, which is undefined behavior and triggers a UBSAN >> shift-out-of-bounds warning: >> >> UBSAN: shift-out-of-bounds in drivers/comedi/drivers/dt2811.c:570:31 >> shift exponent -251 is negative >> >> Add an explicit lower bound check (`it->options[1] >= 0`) so that only >> valid IRQ numbers 0..7 are accepted before the shift. >> >> Fixes: f2975a9b2ab9 ("staging: comedi: dt2811: add async command >> support for AI subdevice") >> Reported-by: syzbot+a4cedab706d0a8a3f988@syzkaller.appspotmail.com >> Closes: https://lore.kernel.org/ >> all/6ab21240.e548f532.1ca396.0018.GAE@google.com/#R >> Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn> >> --- >> drivers/comedi/drivers/dt2811.c | 2 +- >> 1 file changed, 1 insertion(+), 1 deletion(-) >> >> diff --git a/drivers/comedi/drivers/dt2811.c b/drivers/comedi/drivers/ >> dt2811.c >> index 0438b8c90e44..53cb17993ae7 100644 >> --- a/drivers/comedi/drivers/dt2811.c >> +++ b/drivers/comedi/drivers/dt2811.c >> @@ -567,7 +567,7 @@ static int dt2811_attach(struct comedi_device >> *dev, struct comedi_devconfig *it) >> dt2811_reset(dev); >> /* IRQ's 2,3,5,7 are valid for async command support */ >> - if (it->options[1] <= 7 && (BIT(it->options[1]) & 0xac)) { >> + if (it->options[1] >= 0 && it->options[1] <= 7 && (BIT(it- >> >options[1]) & 0xac)) { >> ret = request_irq(it->options[1], dt2811_interrupt, 0, >> dev->board_name, dev); >> if (ret == 0) > > Looks good, thanks! > > Please could you resend and Cc: Greg Kroah-Hartman > <gregkh@linuxfoundation.org> ? Thanks! ok. Thanks! Pei.> ^ permalink raw reply [flat|nested] 8+ messages in thread
* [PATCH] comedi: dt2811: fix shift-out-of-bounds in IRQ check 2026-09-22 7:16 ` [PATCH] comedi: dt2811: fix shift-out-of-bounds in IRQ check Pei Xiao 2026-09-22 9:11 ` Ian Abbott @ 2026-09-22 9:19 ` Pei Xiao 2026-09-23 9:11 ` Ian Abbott 2 siblings, 0 replies; 8+ messages in thread From: Pei Xiao @ 2026-09-22 9:19 UTC (permalink / raw) To: abbotti, hsweeten, linux-kernel, syzbot+a4cedab706d0a8a3f988 Cc: syzkaller-bugs, gregkh, Pei Xiao The IRQ number passed via comedi_devconfig->options[1] is a signed int that comes from userspace. The check `it->options[1] <= 7` does not reject negative values, so a negative IRQ number reaches `BIT(it->options[1])`, which is undefined behavior and triggers a UBSAN shift-out-of-bounds warning: UBSAN: shift-out-of-bounds in drivers/comedi/drivers/dt2811.c:570:31 shift exponent -251 is negative Add an explicit lower bound check (`it->options[1] >= 0`) so that only valid IRQ numbers 0..7 are accepted before the shift. Fixes: f2975a9b2ab9 ("staging: comedi: dt2811: add async command support for AI subdevice") Reported-by: syzbot+a4cedab706d0a8a3f988@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/6ab21240.e548f532.1ca396.0018.GAE@google.com/#R Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn> --- drivers/comedi/drivers/dt2811.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/comedi/drivers/dt2811.c b/drivers/comedi/drivers/dt2811.c index 0438b8c90e44..53cb17993ae7 100644 --- a/drivers/comedi/drivers/dt2811.c +++ b/drivers/comedi/drivers/dt2811.c @@ -567,7 +567,7 @@ static int dt2811_attach(struct comedi_device *dev, struct comedi_devconfig *it) dt2811_reset(dev); /* IRQ's 2,3,5,7 are valid for async command support */ - if (it->options[1] <= 7 && (BIT(it->options[1]) & 0xac)) { + if (it->options[1] >= 0 && it->options[1] <= 7 && (BIT(it->options[1]) & 0xac)) { ret = request_irq(it->options[1], dt2811_interrupt, 0, dev->board_name, dev); if (ret == 0) -- 2.25.1 ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH] comedi: dt2811: fix shift-out-of-bounds in IRQ check 2026-09-22 7:16 ` [PATCH] comedi: dt2811: fix shift-out-of-bounds in IRQ check Pei Xiao 2026-09-22 9:11 ` Ian Abbott 2026-09-22 9:19 ` Pei Xiao @ 2026-09-23 9:11 ` Ian Abbott 2 siblings, 0 replies; 8+ messages in thread From: Ian Abbott @ 2026-09-23 9:11 UTC (permalink / raw) To: Pei Xiao, hsweeten, linux-kernel, syzbot+a4cedab706d0a8a3f988 Cc: syzkaller-bugs, gregkh On 2026-09-22 10:19, Pei Xiao wrote: > The IRQ number passed via comedi_devconfig->options[1] is a signed int > that comes from userspace. The check `it->options[1] <= 7` does not > reject negative values, so a negative IRQ number reaches > `BIT(it->options[1])`, which is undefined behavior and triggers a UBSAN > shift-out-of-bounds warning: > > UBSAN: shift-out-of-bounds in drivers/comedi/drivers/dt2811.c:570:31 > shift exponent -251 is negative > > Add an explicit lower bound check (`it->options[1] >= 0`) so that only > valid IRQ numbers 0..7 are accepted before the shift. > > Fixes: f2975a9b2ab9 ("staging: comedi: dt2811: add async command support for AI subdevice") > Reported-by: syzbot+a4cedab706d0a8a3f988@syzkaller.appspotmail.com > Closes: https://lore.kernel.org/all/6ab21240.e548f532.1ca396.0018.GAE@google.com/#R > Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn> > --- > drivers/comedi/drivers/dt2811.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/comedi/drivers/dt2811.c b/drivers/comedi/drivers/dt2811.c > index 0438b8c90e44..53cb17993ae7 100644 > --- a/drivers/comedi/drivers/dt2811.c > +++ b/drivers/comedi/drivers/dt2811.c > @@ -567,7 +567,7 @@ static int dt2811_attach(struct comedi_device *dev, struct comedi_devconfig *it) > dt2811_reset(dev); > > /* IRQ's 2,3,5,7 are valid for async command support */ > - if (it->options[1] <= 7 && (BIT(it->options[1]) & 0xac)) { > + if (it->options[1] >= 0 && it->options[1] <= 7 && (BIT(it->options[1]) & 0xac)) { > ret = request_irq(it->options[1], dt2811_interrupt, 0, > dev->board_name, dev); > if (ret == 0) Looks good, thanks! Reviewed-by: Ian Abbott <abbotti@mev.co.uk> -- -=( Ian Abbott <abbotti@mev.co.uk> || MEV Ltd. is a company )=- -=( registered in England & Wales. Regd. number: 02862268. )=- -=( Regd. addr.: S11 & 12 Building 67, Europa Business Park, )=- -=( Bird Hall Lane, STOCKPORT, SK3 0XA, UK. || www.mev.co.uk )=- ^ permalink raw reply [flat|nested] 8+ messages in thread
end of thread, other threads:[~2026-09-23 13:56 UTC | newest] Thread overview: 8+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2026-09-22 5:29 [syzbot] [comedi?] UBSAN: shift-out-of-bounds in dt2811_attach syzbot 2026-09-22 6:37 ` [PATCH] test dt2811 Pei Xiao 2026-09-22 6:57 ` [syzbot] [comedi?] UBSAN: shift-out-of-bounds in dt2811_attach syzbot 2026-09-22 7:16 ` [PATCH] comedi: dt2811: fix shift-out-of-bounds in IRQ check Pei Xiao 2026-09-22 9:11 ` Ian Abbott 2026-09-22 9:17 ` Pei Xiao 2026-09-22 9:19 ` Pei Xiao 2026-09-23 9:11 ` Ian Abbott
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®