[v1] USB: sisusbvga: Fix integer overflow and NULL dereference

[PATCH 0/2] USB: sisusbvga: Fix integer overflow and NULL dereference

Vasiliy Kovalev posted 2 patches 1 month, 2 weeks ago

Diff against v2
Download series mbox

There is a newer version of this series

drivers/usb/misc/sisusbvga/sisusbvga.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)

Expand all Fold all

[PATCH 0/2] USB: sisusbvga: Fix integer overflow and NULL dereference

Posted by Vasiliy Kovalev 1 month, 2 weeks ago

This series fixes two issues in the sisusbvga driver found by static
analysis and confirmed through testing with USB gadget emulation:

1. Integer overflow in boundary check of sisusb_clear_vram() that can be
   triggered by a compromised USB device reporting inflated VRAM size.

2. NULL pointer dereference in sisusb_read() when userspace passes a NULL
   buffer to read(), causing immediate kernel panic.

Both issues are reproducible with the 'USB Gadget Tests' framework [1].

[1] https://github.com/kovalev0/usb-gadget-tests

Vasiliy Kovalev (2):
  USB: sisusbvga: Fix integer overflow in sisusb_clear_vram
  USB: sisusbvga: Fix NULL pointer dereference in sisusb_read

 drivers/usb/misc/sisusbvga/sisusbvga.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

-- 
2.50.1