From 471ce96a9c415b8a67bd5081ac2089a458cacc2f Mon Sep 17 00:00:00 2001 From: Pei Xiao Date: Tue, 22 Sep 2026 15:16:57 +0800 Subject: [PATCH] comedi: dt2811: fix shift-out-of-bounds in IRQ check The IRQ number passed via comedi_devconfig->options[1] is a signed int that comes from userspace. The check `it->options[1] <= 7` does not reject negative values, so a negative IRQ number reaches `BIT(it->options[1])`, which is undefined behavior and triggers a UBSAN shift-out-of-bounds warning: UBSAN: shift-out-of-bounds in drivers/comedi/drivers/dt2811.c:570:31 shift exponent -251 is negative Add an explicit lower bound check (`it->options[1] >= 0`) so that only valid IRQ numbers 0..7 are accepted before the shift. Fixes: f2975a9b2ab9 ("staging: comedi: dt2811: add async command support for AI subdevice") Reported-by: syzbot+a4cedab706d0a8a3f988@syzkaller.appspotmail.com Closes: https://lore.kernel.org/all/6ab21240.e548f532.1ca396.0018.GAE@google.com/#R Signed-off-by: Pei Xiao Reviewed-by: Ian Abbott Tested-by: syzbot+a4cedab706d0a8a3f988@syzkaller.appspotmail.com Link: https://patch.msgid.link/02c46315293a26169d2a3862a2047959a1651ef4.1790061387.git.xiaopei01@kylinos.cn Signed-off-by: Greg Kroah-Hartman --- drivers/comedi/drivers/dt2811.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/comedi/drivers/dt2811.c b/drivers/comedi/drivers/dt2811.c index 0438b8c90e44..53cb17993ae7 100644 --- a/drivers/comedi/drivers/dt2811.c +++ b/drivers/comedi/drivers/dt2811.c @@ -567,7 +567,7 @@ static int dt2811_attach(struct comedi_device *dev, struct comedi_devconfig *it) dt2811_reset(dev); /* IRQ's 2,3,5,7 are valid for async command support */ - if (it->options[1] <= 7 && (BIT(it->options[1]) & 0xac)) { + if (it->options[1] >= 0 && it->options[1] <= 7 && (BIT(it->options[1]) & 0xac)) { ret = request_irq(it->options[1], dt2811_interrupt, 0, dev->board_name, dev); if (ret == 0)