Re:[PATCH] HID: wacom: reject short input reports

[jiale yao]

At 2026-10-17 14:19:19, "Jiale Yao" <yaojiale02@xxxxxxx> wrote:
>wacom_raw_event() passes incoming reports to the pen serial extractor and
>the device-specific IRQ parsers before the HID core validates the declared
>report length. A short report can therefore make either consumer read past
>the valid input data.
>
>Require the complete report described by the HID report descriptor before
>invoking either parser.
>

Fixes: 29b4739134c7 ("Input: wacom - switch from an USB driver to a HID driver")
Fixes: 83417206427b ("HID: wacom: Queue events with missing type/serial data for later processing")

>Signed-off-by: Jiale Yao <yaojiale02@xxxxxxx>
>---
> drivers/hid/wacom_sys.c | 3 +++
> 1 file changed, 3 insertions(+)
>
>diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c
>index 40770affdbde..85e966e80012 100644
>--- a/drivers/hid/wacom_sys.c
>+++ b/drivers/hid/wacom_sys.c
>@@ -175,6 +175,9 @@ static int wacom_raw_event(struct hid_device *hdev, struct hid_report *report,
> 	if (wacom->wacom_wac.features.type == BOOTLOADER)
> 		return 0;
> 
>+	if (size < hid_report_len(report))
>+		return 0;
>+
> 	if (wacom_wac_pen_serial_enforce(hdev, report, raw_data, size))
> 		return -1;
> 
>-- 
>2.34.1