From 790ea6844593bcd03b0379986fc821d8c511746e Mon Sep 17 00:00:00 2001 From: Yogesh Gaur Date: Wed, 9 Sep 2026 16:18:42 +0530 Subject: [PATCH] comedi: comedi_parport: validate the IRQ supplied by userspace comedi boards are configured through the COMEDI_DEVCONFIG ioctl, so it->options[1] is a number chosen by userspace. comedi_parport passes it to request_irq() without checking it first, which lets an interrupt owned by another irqdomain -- a PCI device's IO-APIC GSI, for instance -- be claimed for this board. When the owner of that interrupt is later released the descriptor is freed while this driver's handler is still installed on it. A parallel port asserts a legacy ISA interrupt, so the ISA range is the right bound; it is also sufficient, because mp_chip_data->isa_irq is set only by alloc_isa_irq_from_domain() and mp_unmap_irq() returns early when it is set. syzbot hit this one: remove_proc_entry: removing non-empty directory 'irq/20', leaking at least 'comedi_parport' WARNING: fs/proc/generic.c:747 at remove_proc_entry+0x4e7/0x610 fs/proc/generic.c:747 Call Trace: unregister_irq_proc+0x206/0x2a0 kernel/irq/proc.c:406 free_desc+0x89/0x330 kernel/irq/irqdesc.c:482 irq_free_descs+0x84/0xc0 kernel/irq/irqdesc.c:865 irq_domain_free_irqs+0x46a/0x5c0 kernel/irq/irqdomain.c:1917 mp_unmap_irq+0xf8/0x130 arch/x86/kernel/apic/io_apic.c:1061 acpi_unregister_gsi_ioapic+0x40/0x60 arch/x86/kernel/acpi/boot.c:722 acpi_pci_irq_disable+0x275/0x360 drivers/acpi/pci_irq.c:517 pci_disable_device+0x130/0x270 drivers/pci/pci.c:2206 pci_device_remove+0xb2/0x1d0 drivers/pci/pci-driver.c:512 device_release_driver_internal+0x44e/0x620 drivers/base/dd.c:1372 unbind_store+0xf8/0x110 drivers/base/bus.c:244 The leaked /proc entry the warning names is the mild part. mp_chip_data->count tracks GSI mappings rather than request_irq() users, and __setup_irq() takes no reference on the descriptor, so the irq_desc is freed with the comedi irqaction still attached to it. Bound the value before requesting it, as das16m1.c already does. An out-of-range value is ignored rather than rejected, so the board still attaches without interrupt support, exactly as it does today when request_irq() fails. Fixes: 241ab6ad7108 ("Staging: comedi: add comedi_parport driver") Reported-by: syzbot+690d666eb12fca6e1e61@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=690d666eb12fca6e1e61 Assisted-by: LLM Signed-off-by: Yogesh Gaur Link: https://patch.msgid.link/20260909104848.1763-2-yogeshgaur.83@gmail.com Signed-off-by: Greg Kroah-Hartman --- drivers/comedi/drivers/comedi_parport.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/comedi/drivers/comedi_parport.c b/drivers/comedi/drivers/comedi_parport.c index 57ee3f9dfba2..94284ff157ac 100644 --- a/drivers/comedi/drivers/comedi_parport.c +++ b/drivers/comedi/drivers/comedi_parport.c @@ -243,7 +243,8 @@ static int parport_attach(struct comedi_device *dev, outb(0, dev->iobase + PARPORT_DATA_REG); outb(0, dev->iobase + PARPORT_CTRL_REG); - if (it->options[1]) { + /* only ISA interrupts are valid on a parallel port */ + if (it->options[1] >= 1 && it->options[1] <= 15) { ret = request_irq(it->options[1], parport_interrupt, 0, dev->board_name, dev); if (ret == 0)