[PATCH] HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait()

[PATCH] HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait()

[Georgiy Osokin]

In picolcd_send_and_wait(), an integer overflow of the signed loop counter
'k' can theoretically lead to a NULL pointer dereference of 'raw_data'.
If the loop executes more than INT_MAX times, 'k' becomes negative,
making the condition 'k < size' true even when 'size' is 0.

Change the type of 'k' to 'unsigned int' to prevent the overflow and
eliminate the out-of-bounds access.

Found by Linux Verification Center (linuxtesting.org) with the Svace static
analysis tool.

Fixes: fabdbf2 ("HID: picoLCD: split driver code")
Signed-off-by: Georgiy Osokin <g.osokin@auroraos.dev>

---
 drivers/hid/hid-picolcd_core.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/drivers/hid/hid-picolcd_core.c b/drivers/hid/hid-picolcd_core.c
index 2cc01e1bc1a8..d73e97c8b853 100644
--- a/drivers/hid/hid-picolcd_core.c
+++ b/drivers/hid/hid-picolcd_core.c
@@ -72,7 +72,8 @@ struct picolcd_pending *picolcd_send_and_wait(struct hid_device *hdev,
 	struct picolcd_pending *work;
 	struct hid_report *report = picolcd_out_report(report_id, hdev);
 	unsigned long flags;
-	int i, j, k;
+	int i, j;
+	unsigned int k;
 
 	if (!report || !data)
 		return NULL;
-- 
2.50.1

Re: [PATCH] HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait()

[Jiri Kosina]

On Sun, 17 May 2026, Georgiy Osokin wrote:

> In picolcd_send_and_wait(), an integer overflow of the signed loop counter
> 'k' can theoretically lead to a NULL pointer dereference of 'raw_data'.
> If the loop executes more than INT_MAX times, 'k' becomes negative,
> making the condition 'k < size' true even when 'size' is 0.
> 
> Change the type of 'k' to 'unsigned int' to prevent the overflow and
> eliminate the out-of-bounds access.
> 
> Found by Linux Verification Center (linuxtesting.org) with the Svace static
> analysis tool.
> 
> Fixes: fabdbf2 ("HID: picoLCD: split driver code")

Next time, please make the shas of commits a little bit longer to avoid 
uncertainity.

> Signed-off-by: Georgiy Osokin <g.osokin@auroraos.dev>

Applied, thanks!

-- 
Jiri Kosina
SUSE Labs

Re: [PATCH] HID: picolcd: prevent NULL pointer dereference in picolcd_send_and_wait()

[Sergey Shtylyov]

On 6/29/26 11:46 AM, Jiri Kosina wrote:

>> In picolcd_send_and_wait(), an integer overflow of the signed loop counter
>> 'k' can theoretically lead to a NULL pointer dereference of 'raw_data'.
>> If the loop executes more than INT_MAX times, 'k' becomes negative,
>> making the condition 'k < size' true even when 'size' is 0.
>>
>> Change the type of 'k' to 'unsigned int' to prevent the overflow and
>> eliminate the out-of-bounds access.
>>
>> Found by Linux Verification Center (linuxtesting.org) with the Svace static
>> analysis tool.
>>
>> Fixes: fabdbf2 ("HID: picoLCD: split driver code")
> 
> Next time, please make the shas of commits a little bit longer to avoid
> uncertainity.
> 
>> Signed-off-by: Georgiy Osokin <g.osokin@auroraos.dev>
> 
> Applied, thanks!

   Hm, I think we (with the help of Sashiko [1]) arrived to the conclusion
that an overflow should never happen with the current ranges of the loop
counters. We have re-resolved this issue as false positive internally...

[1] https://lore.kernel.org/all/20260517125108.BC3FDC2BCB0@smtp.kernel.org/

> --
> Jiri Kosina
> SUSE Labs

MBR, Sergey