diff options
| author | Ian Abbott <abbotti@mev.co.uk> | 2025-07-07 14:34:29 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-07-24 08:51:50 +0200 |
| commit | 5bfa301e1e59a9b1a7b62a800b54852337c97416 (patch) | |
| tree | 24794a3359425120f2704a9a8d7cbc31c7cbb0c4 | |
| parent | 3eed525163c2a7164401b19bd0f4f530aa1d0bfb (diff) | |
| download | linux-5bfa301e1e59a9b1a7b62a800b54852337c97416.tar.gz linux-5bfa301e1e59a9b1a7b62a800b54852337c97416.tar.bz2 linux-5bfa301e1e59a9b1a7b62a800b54852337c97416.zip | |
comedi: pcl812: Fix bit shift out of bounds
commit b14b076ce593f72585412fc7fd3747e03a5e3632 upstream.
When checking for a supported IRQ number, the following test is used:
if ((1 << it->options[1]) & board->irq_bits) {
However, `it->options[i]` is an unchecked `int` value from userspace, so
the shift amount could be negative or out of bounds. Fix the test by
requiring `it->options[1]` to be within bounds before proceeding with
the original test. Valid `it->options[1]` values that select the IRQ
will be in the range [1,15]. The value 0 explicitly disables the use of
interrupts.
Reported-by: syzbot+32de323b0addb9e114ff@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=32de323b0addb9e114ff
Fixes: fcdb427bc7cf ("Staging: comedi: add pcl821 driver")
Cc: stable@vger.kernel.org # 5.13+
Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
Link: https://lore.kernel.org/r/20250707133429.73202-1-abbotti@mev.co.uk
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| -rw-r--r-- | drivers/comedi/drivers/pcl812.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/comedi/drivers/pcl812.c b/drivers/comedi/drivers/pcl812.c index 70dbc129fcf5..e0459f286fa6 100644 --- a/drivers/comedi/drivers/pcl812.c +++ b/drivers/comedi/drivers/pcl812.c @@ -1149,7 +1149,8 @@ static int pcl812_attach(struct comedi_device *dev, struct comedi_devconfig *it) if (!dev->pacer) return -ENOMEM; - if ((1 << it->options[1]) & board->irq_bits) { + if (it->options[1] > 0 && it->options[1] < 16 && + (1 << it->options[1]) & board->irq_bits) { ret = request_irq(it->options[1], pcl812_interrupt, 0, dev->board_name, dev); if (ret == 0) |