Re: [PATCH 1/1] HID: wacom: Fix OOB write in wacom_hid_set_device_mode()

[Lee Jones]

On Wed, 27 May 2026, Lee Jones wrote:

> On Thu, 21 May 2026, Lee Jones wrote:
> 
> > On Thu, 21 May 2026, Benjamin Tissoires wrote:
> > 
> > > On May 19 2026, Lee Jones wrote:
> > > > On Wed, 13 May 2026, Ping Cheng wrote:
> > > > 
> > > > > On Wed, May 13, 2026 at 1:05 AM Lee Jones <lee@xxxxxxxxxx> wrote:
> > > > > >
> > > > > > wacom_hid_set_device_mode() currently assumes that the HID_DG_INPUTMODE
> > > > > > usage is always located in the first field (field[0]) of the feature report.
> > > > > > However, a device can specify HID_DG_INPUTMODE in a different field.
> > > > > >
> > > > > > If HID_DG_INPUTMODE is in a field other than the first one and the first
> > > > > > field has a report_count smaller than the usage_index of HID_DG_INPUTMODE,
> > > > > > this leads to an out-of-bounds write to r->field[0]->value.
> > > > > >
> > > > > > Fix this by storing the field index of HID_DG_INPUTMODE in 'struct
> > > > > > hid_data' during feature mapping.  In wacom_hid_set_device_mode(), use
> > > > > > this stored field index to access the correct field and add bounds
> > > > > > checks to ensure both the field index and the value index are within
> > > > > > valid ranges before writing.
> > > > > >
> > > > > > Cc: stable@xxxxxxxxxxxxxxx
> > > > > > Fixes: 5ae6e89f7409 ("HID: wacom: implement the finger part of the HID generic handling")
> > > > > > Signed-off-by: Lee Jones <lee@xxxxxxxxxx>
> > > > > 
> > > > > Patch looks sensible to me. Thank you for your effort, Lee!
> > > > > 
> > > > > Tested-by: Ping Cheng <ping.cheng@xxxxxxxxx>
> > > > > Reviewed-by: Ping Cheng <ping.cheng@xxxxxxxxx>
> > > > 
> > > > Thank you Ping, I appreciate your review.
> > > > 
> > > > HID folks - any movement on this please?
> > > > 
> > > 
> > > I wanted to apply it today, but the patch conflicts with our current
> > > for-7.1/upstream-fixes.
> > > 
> > > Could you rebase on top of this branch so we can take this without me
> > > messing with your patch?
> > 
> > Sure.  Leave it with me.  Probably be early next week.
> 
> Are you sure this conflicted?
> 
> I just rebased it onto hid/for-7.1/upstream-fixes without issue.

Rebased patch here (not sure if it's actually different:

https://lore.kernel.org/all/20260527160528.847928-1-lee@xxxxxxxxxx/

-- 
Lee Jones