From 71424db0ebb5f484fa3f386910f8ce9da95b8b2e Mon Sep 17 00:00:00 2001 From: Yogesh Gaur Date: Wed, 9 Sep 2026 16:18:43 +0530 Subject: [PATCH] comedi: ni_atmio16d: validate the IRQ supplied by userspace comedi boards are configured through the COMEDI_DEVCONFIG ioctl, so it->options[1] is a number chosen by userspace. ni_atmio16d passes it to request_irq() without checking it first, which lets an interrupt owned by another irqdomain -- a PCI device's IO-APIC GSI, for instance -- be claimed for this board. When the owner of that interrupt is later released the descriptor is freed while this driver's handler is still installed on it. The driver already documents which interrupts the board can assert -- "0 == no irq; or 3,4,5,6,7,9,10,11,12,14,15" -- so use exactly that set rather than the whole ISA range. Bound the value before requesting it, as das16m1.c already does. An out-of-range value is ignored rather than rejected, so the board still attaches without interrupt support, exactly as it does today when request_irq() fails. Fixes: 2323b276308a ("Staging: comedi: add ni_at_atmio16d driver") Assisted-by: LLM Signed-off-by: Yogesh Gaur Link: https://patch.msgid.link/20260909104848.1763-3-yogeshgaur.83@gmail.com Signed-off-by: Greg Kroah-Hartman --- drivers/comedi/drivers/ni_atmio16d.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/comedi/drivers/ni_atmio16d.c b/drivers/comedi/drivers/ni_atmio16d.c index 6765cdc276ca..87fed16b112c 100644 --- a/drivers/comedi/drivers/ni_atmio16d.c +++ b/drivers/comedi/drivers/ni_atmio16d.c @@ -593,7 +593,9 @@ static int atmio16d_attach(struct comedi_device *dev, /* reset the atmio16d hardware */ reset_atmio16d(dev); - if (it->options[1]) { + /* only irqs 3, 4, 5, 6, 7, 9, 10, 11, 12, 14, and 15 are valid */ + if (it->options[1] >= 3 && it->options[1] <= 15 && + (1 << it->options[1]) & 0xdef8) { ret = request_irq(it->options[1], atmio16d_interrupt, 0, dev->board_name, dev); if (ret == 0)