From 23c6fc62e754f8bc412ceb5c0d9aaa14f2c9ff31 Mon Sep 17 00:00:00 2001 From: Yogesh Gaur Date: Wed, 9 Sep 2026 16:18:46 +0530 Subject: [PATCH] comedi: pcmmio: validate the IRQ supplied by userspace comedi boards are configured through the COMEDI_DEVCONFIG ioctl, so it->options[1] is a number chosen by userspace. pcmmio passes it to request_irq() without checking it first, which lets an interrupt owned by another irqdomain -- a PCI device's IO-APIC GSI, for instance -- be claimed for this board. When the owner of that interrupt is later released the descriptor is freed while this driver's handler is still installed on it. The board's interrupt is routed in software rather than jumpered, and the driver notes that "any IRQ from 1-15 is OK", so the ISA range is exactly the right bound. Bound the value before requesting it, as das16m1.c already does. An out-of-range value is ignored rather than rejected, so the board still attaches without interrupt support, exactly as it does today when request_irq() fails. Fixes: 6baef150380d ("Staging: comedi: add pcmmio and pcmuio drivers") Assisted-by: LLM Signed-off-by: Yogesh Gaur Link: https://patch.msgid.link/20260909104848.1763-6-yogeshgaur.83@gmail.com Signed-off-by: Greg Kroah-Hartman --- drivers/comedi/drivers/pcmmio.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/comedi/drivers/pcmmio.c b/drivers/comedi/drivers/pcmmio.c index f42b7343b4e4..afe2bda91659 100644 --- a/drivers/comedi/drivers/pcmmio.c +++ b/drivers/comedi/drivers/pcmmio.c @@ -684,7 +684,8 @@ static int pcmmio_attach(struct comedi_device *dev, struct comedi_devconfig *it) pcmmio_reset(dev); - if (it->options[1]) { + /* the irq is configured in software, so any ISA irq is OK */ + if (it->options[1] >= 1 && it->options[1] <= 15) { ret = request_irq(it->options[1], interrupt_pcmmio, 0, dev->board_name, dev); if (ret == 0) {