Deepanshu Kartikey 4ffea48c69 comedi: fix divide-by-zero in comedi_buf_munge() ...

commit 87b318ba81 upstream.

The comedi_buf_munge() function performs a modulo operation
`async->munge_chan %= async->cmd.chanlist_len` without first
checking if chanlist_len is zero. If a user program submits a command with
chanlist_len set to zero, this causes a divide-by-zero error when the device
processes data in the interrupt handler path.

Add a check for zero chanlist_len at the beginning of the
function, similar to the existing checks for !map and
CMDF_RAWDATA flag. When chanlist_len is zero, update
munge_count and return early, indicating the data was
handled without munging.

This prevents potential kernel panics from malformed user commands.

Reported-by: syzbot+f6c3c066162d2c43a66c@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=f6c3c066162d2c43a66c
Cc: stable@vger.kernel.org
Signed-off-by: Deepanshu Kartikey <kartikey406@gmail.com>
Reviewed-by: Ian Abbott <abbotti@mev.co.uk>
Link: https://patch.msgid.link/20250924102639.1256191-1-kartikey406@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2025-10-29 14:00:00 +01:00

..

android

…

axis-fifo

staging: axis-fifo: flush RX FIFO on read errors

2025-10-29 13:59:45 +01:00

board

…

clocking-wizard

…

comedi

comedi: fix divide-by-zero in comedi_buf_munge()

2025-10-29 14:00:00 +01:00

emxx_udc

staging: emxx_udc: Add checks for dma_alloc_coherent()

2023-03-11 16:44:14 +01:00

exfat

…

fbtft

staging: fbtft: fix potential memory leak in fbtft_framebuffer_alloc()

2025-08-28 16:21:18 +02:00

fieldbus

staging: fieldbus: Fix the error handling path in anybuss_host_common_probe()

2022-06-14 18:11:51 +02:00

fsl-dpaa2

…

fwserial

…

gasket

…

gdm724x

…

goldfish

…

greybus

staging: greybus: uart: clean up TIOCGSERIAL

2024-12-14 19:44:34 +01:00

gs_fpgaboot

…

iio

staging: iio: ad5933: Correct settling cycles encoding per datasheet

2025-06-27 11:02:52 +01:00

isdn

…

kpc2000

…

ks7010

staging: ks7010: disable bh on tx_dev_lock

2024-09-04 13:14:53 +02:00

media

media: imx: fix a potential memory leak in imx_media_csc_scaler_device_init()

2025-08-28 16:21:31 +02:00

most

treewide: Replace DECLARE_TASKLET() with DECLARE_TASKLET_OLD()

2023-04-20 12:07:32 +02:00

mt7621-dma

…

mt7621-dts

…

mt7621-pci

…

mt7621-pci-phy

…

mt7621-pinctrl

pinctrl: ralink: Check for null return of devm_kcalloc

2022-07-29 17:14:10 +02:00

netlogic

…

nvec

staging: nvec: Fix incorrect null termination of battery manufacturer

2025-08-28 16:21:19 +02:00

octeon

treewide: Replace DECLARE_TASKLET() with DECLARE_TASKLET_OLD()

2023-04-20 12:07:32 +02:00

octeon-usb

…

olpc_dcon

…

pi433

…

qlge

…

ralink-gdma

…

rtl8188eu

…

rtl8192e

Revert "staging: rtl8192e: Replace macro RTL_PCI_DEVICE with PCI_DEVICE"

2023-06-14 11:00:00 +02:00

rtl8192u

staging: rtl8192u: Fix use after free in ieee80211_rx()

2023-01-18 11:41:25 +01:00

rtl8712

staging: rtl8712: fix race condition

2023-09-23 10:59:37 +02:00

rtl8723bs

staging: rtl8723bs: Avoid memset() in aes_cipher() and aes_decipher()

2025-07-17 18:25:01 +02:00

rts5208

…

sm750fb

…

speakup

speakup: Fix sizeof() vs ARRAY_SIZE() bug

2024-06-16 13:28:30 +02:00

unisys

…

uwb

…

vc04_services

staging: vc04_services: fix information leak in create_component()

2024-04-13 12:51:35 +02:00

vme

…

vt6655

staging: vt6655: fix potential memory leak

2022-10-26 13:22:56 +02:00

vt6656

…

wilc1000

wifi: wilc1000: fix potential RCU dereference issue in wilc_parse_join_bss_param

2024-11-08 16:20:27 +01:00

wlan-ng

…

wusbcore

…

Kconfig

…

Makefile

…