github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

comedi: addi_apci_3xxx: fix subdevice count underallocation

Browse Source 
In apci3xxx_auto_attach(), the number of subdevices is computed with

    n_subdevices = (board->ai_n_chan ? 0 : 1) + board->has_ao + ...

The ternary is inverted: when the board has analog input channels
(ai_n_chan != 0), it counts 0 instead of 1, so the AI subdevice that is
actually created is not accounted for. As a result
comedi_alloc_subdevices() allocates one entry too few, and the later
subdevice initialization (notably the TTL Digital I/O subdevice, which
is populated last) writes past the end of the allocated array, causing a
slab out-of-bounds write.

Flip the ternary to count 1 when ai_n_chan is non-zero and 0 otherwise,
matching the subdevice creation order in the function.

Signed-off-by: Yang Zi <2959243019@qq.com>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Link: https://patch.msgid.link/20261014101803.11036-1-abbotti@mev.co.uk
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Yang Zi 2026-10-14 11:11:42 +01:00 committed by Greg Kroah-Hartman
parent 7dc112d608
commit 3de5aa458d
1 changed files with 1 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/comedi/drivers/addi_apci_3xxx.c
View File

@ -787,7 +787,7 @@ static int apci3xxx_auto_attach(struct comedi_device *dev,
dev->irq = pcidev->irq;
}
n_subdevices = (board->ai_n_chan ? 0 : 1) + board->has_ao +
n_subdevices = (board->ai_n_chan ? 1 : 0) + board->has_ao +
board->has_dig_in + board->has_dig_out +
board->has_ttl_io;
ret = comedi_alloc_subdevices(dev, n_subdevices);