Re: [PATCH V3 REPOST] comedi: pcl726: Prevent invalid irq number

[Ian Abbott]

On 24/07/2025 12:07, Ian Abbott wrote:
> From: Edward Adam Davis <eadavis@xxxxxx>
>
> The reproducer passed in an irq number(0x80008000) that was too large,
> which triggered the oob.
>
> Added an interrupt number check to prevent users from passing in an irq
> number that was too large.
>
> If `it->options[1]` is 31, then `1 << it->options[1]` is still invalid
> because it shifts a 1-bit into the sign bit (which is UB in C).
> Possible solutions include reducing the upper bound on the
> `it->options[1]` value to 30 or lower, or using `1U << it->options[1]`.
>
> The old code would just not attempt to request the IRQ if the
> `options[1]` value were invalid.  And it would still configure the
> device without interrupts even if the call to `request_irq` returned an
> error.  So it would be better to combine this test with the test below.
>
> Fixes: fff46207245c ("staging: comedi: pcl726: enable the interrupt support code")
> Cc: <stable@xxxxxxxxxxxxxxx> # 5.13+
> Cc: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
> Reported-by: syzbot+5cd373521edd68bebcb3@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes: https://syzkaller.appspot.com/bug?extid=5cd373521edd68bebcb3
> Tested-by: syzbot+5cd373521edd68bebcb3@xxxxxxxxxxxxxxxxxxxxxxxxx
> Signed-off-by: Edward Adam Davis <eadavis@xxxxxx>
> Reviewed-by: Ian Abbott <abbotti@xxxxxxxxx>

I forgot to append the changelog from the original email:

V1 -> V2: combine test with old test
V2 -> V3: fix misspelled

Ian

--
-=( Ian Abbott <abbotti@xxxxxxxxx> || MEV Ltd. is a company  )=-
-=( registered in England & Wales.  Regd. number: 02862268.  )=-
-=( Regd. addr.: S11 & 12 Building 67, Europa Business Park, )=-
-=( Bird Hall Lane, STOCKPORT, SK3 0XA, UK. || www.mev.co.uk )=-