Re: [PATCH] comedi: dt2811: fix shift-out-of-bounds in IRQ check

[Ian Abbott]

On 2026-09-22 08:16, Pei Xiao wrote:
> The IRQ number passed via comedi_devconfig->options[1] is a signed int
> that comes from userspace.  The check `it->options[1] <= 7` does not
> reject negative values, so a negative IRQ number reaches
> `BIT(it->options[1])`, which is undefined behavior and triggers a UBSAN
> shift-out-of-bounds warning:
>
>    UBSAN: shift-out-of-bounds in drivers/comedi/drivers/dt2811.c:570:31
>    shift exponent -251 is negative
>
> Add an explicit lower bound check (`it->options[1] >= 0`) so that only
> valid IRQ numbers 0..7 are accepted before the shift.
>
> Fixes: f2975a9b2ab9 ("staging: comedi: dt2811: add async command support for AI subdevice")
> Reported-by: syzbot+a4cedab706d0a8a3f988@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes: https://lore.kernel.org/all/6ab21240.e548f532.1ca396.0018.GAE@xxxxxxxxxx/#R
> Signed-off-by: Pei Xiao <xiaopei01@xxxxxxxxxx>
> ---
>   drivers/comedi/drivers/dt2811.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/comedi/drivers/dt2811.c b/drivers/comedi/drivers/dt2811.c
> index 0438b8c90e44..53cb17993ae7 100644
> --- a/drivers/comedi/drivers/dt2811.c
> +++ b/drivers/comedi/drivers/dt2811.c
> @@ -567,7 +567,7 @@ static int dt2811_attach(struct comedi_device *dev, struct comedi_devconfig *it)
>   	dt2811_reset(dev);
>   
>   	/* IRQ's 2,3,5,7 are valid for async command support */
> -	if (it->options[1] <= 7  && (BIT(it->options[1]) & 0xac)) {
> +	if (it->options[1] >= 0 && it->options[1] <= 7 && (BIT(it->options[1]) & 0xac)) {
>   		ret = request_irq(it->options[1], dt2811_interrupt, 0,
>   				  dev->board_name, dev);
>   		if (ret == 0)

Looks good, thanks!

Please could you resend and Cc: Greg Kroah-Hartman 
<gregkh@xxxxxxxxxxxxxxxxxxx> ?  Thanks!

--
-=( Ian Abbott <abbotti@xxxxxxxxx> || MEV Ltd. is a company  )=-
-=( registered in England & Wales.  Regd. number: 02862268.  )=-
-=( Regd. addr.: S11 & 12 Building 67, Europa Business Park, )=-
-=( Bird Hall Lane, STOCKPORT, SK3 0XA, UK. || www.mev.co.uk )=-