[PATCH] HID: wacom: validate GRAPHIRE_BT report length

[Aamir Ahmed]

wacom_graphire_irq() parses GRAPHIRE_BT reports by dereferencing
wacom->data at fixed offsets up to data[7], guarded only by the
data[0] == WACOM_REPORT_PENABLED_BT report-id check. It never consults
the report length, and wacom_wac_irq() does not pass len down for this
device type.

A malformed, malfunctioning or spoofed Bluetooth Graphire (VID 0x056a,
PID 0x81) can send a report shorter than 8 bytes that still passes the
report-id check. The handler then reads past the received report and
forwards the bytes to userspace as ABS_X/ABS_Y/ABS_PRESSURE/ABS_MISC/
ABS_DISTANCE and battery state.

On the Bluetooth transports the backing buffer is large and fixed (hidp
copies into input_buf[HID_MAX_BUFFER_SIZE]; uhid uses UHID_DATA_MAX), so
this reads stale in-buffer bytes rather than overrunning the allocation.
It is the same missing-length-check class already fixed in the sibling
handlers wacom_intuos_bt_irq() (commit 2f1763f62909 ("HID: wacom: fix
out-of-bounds read in wacom_intuos_bt_irq")) and
wacom_intuos_pro2_bt_irq() (commit a8e04f3f894c ("HID: wacom: validate
report length in wacom_intuos_pro2_bt_irq")); the GRAPHIRE_BT handler was
not covered by those changes. The issue was found by LLM-assisted variant
analysis of those two fixes.

Pass the wire length to wacom_graphire_irq() and reject GRAPHIRE_BT
reports shorter than the furthest offset the parser dereferences.

Fixes: 387142bb8fcb ("Input: wacom - handle Graphire BT tablets in wacom.ko")
Assisted-by: LLM:opus-4.8
Signed-off-by: Aamir Ahmed <elb12345@xxxxxxxxxxxxx>
---

Notes (not part of the changelog):
- Compile-tested on x86_64 with CONFIG_HID_WACOM=m; builds with no new
  warnings. No runtime reproducer: per the changelog, on the hidp/uhid
  transports this is a stale-buffer read, so KASAN is not expected to fire.
- Found by LLM-assisted variant analysis of the two sibling fixes cited
  above (see the Assisted-by tag).
 drivers/hid/wacom_wac.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
index 8feb8027be95..31da8b956607 100644
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c
@@ -338,7 +338,7 @@ static int wacom_dtus_irq(struct wacom_wac *wacom)
 	}
 }
 
-static int wacom_graphire_irq(struct wacom_wac *wacom)
+static int wacom_graphire_irq(struct wacom_wac *wacom, size_t len)
 {
 	struct wacom_features *features = &wacom->features;
 	unsigned char *data = wacom->data;
@@ -350,6 +350,12 @@ static int wacom_graphire_irq(struct wacom_wac *wacom)
 	int retval = 0;
 
 	if (features->type == GRAPHIRE_BT) {
+		if (len < WACOM_PKGLEN_PENABLED) {
+			dev_warn(input->dev.parent,
+				 "Graphire BT report too short: %zu bytes\n",
+				 len);
+			goto exit;
+		}
 		if (data[0] != WACOM_REPORT_PENABLED_BT) {
 			dev_dbg(input->dev.parent,
 				"%s: received unknown report #%d\n", __func__,
@@ -3475,7 +3481,7 @@ void wacom_wac_irq(struct wacom_wac *wacom_wac, size_t len)
 	case GRAPHIRE:
 	case GRAPHIRE_BT:
 	case WACOM_MO:
-		sync = wacom_graphire_irq(wacom_wac);
+		sync = wacom_graphire_irq(wacom_wac, len);
 		break;
 
 	case PTU:
-- 
2.53.0.windows.1