Re: [PATCH v3 5/6] HID: wacom: add NULL input guards to Bamboo touch/button handlers

[Jason Gerecke]

On Sun, Oct 18, 2026 at 5:51 AM Jinmo Yang <jinmo44.yang@xxxxxxxxx> wrote:
>
> wacom_bpt_touch() dereferences both touch_input and pad_input.
> wacom_bpt3_touch_msg() dereferences touch_input.
> wacom_bpt3_button_msg() dereferences pad_input.
>
> All three can be NULL when the corresponding
> wacom_setup_{touch,pad}_input_capabilities() returns -ENODEV during a
> successful probe. Add per-function guards.
>

Seems reasonable to also add a check in wacom_bpt_pen(), even if (in
its current state) a null pen_input is not possible for these devices.

Jason (she/they)
---
Now instead of four in the eights place /
you’ve got three, ‘Cause you added one  /
(That is to say, eight) to the two,     /
But you can’t take seven from three,    /
So you look at the sixty-fours....



> Fixes: 2a6cdbdd4cc0 ("HID: wacom: Introduce new 'touch_input' device")
> Fixes: 862cf5535c0c ("HID: wacom: Introduce a new WACOM_DEVICETYPE_PAD device_type")
> Signed-off-by: Jinmo Yang <jinmo44.yang@xxxxxxxxx>
> Co-Authored-By: Claude Opus 4.6 <noreply@xxxxxxxxxxxxx>
> ---
>  drivers/hid/wacom_wac.c | 25 +++++++++++++++++++++++--
>  1 file changed, 23 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
> index e0bf03123cf9..a34db1505625 100644
> --- a/drivers/hid/wacom_wac.c
> +++ b/drivers/hid/wacom_wac.c
> @@ -3151,6 +3151,12 @@ static int wacom_bpt_touch(struct wacom_wac *wacom)
>         if (data[0] != 0x02)
>             return 0;
>
> +       if (!input || !pad_input) {
> +               dev_warn_once(&container_of(wacom, struct wacom, wacom_wac)->hdev->dev,
> +                             "%s: input is NULL\n", __func__);
> +               return 0;
> +       }
> +
>         for (i = 0; i < 2; i++) {
>                 int offset = (data[1] & 0x80) ? (8 * i) : (9 * i);
>                 bool touch = report_touch_events(wacom)
> @@ -3185,8 +3191,17 @@ static void wacom_bpt3_touch_msg(struct wacom_wac *wacom, unsigned char *data)
>  {
>         struct wacom_features *features = &wacom->features;
>         struct input_dev *input = wacom->touch_input;
> -       bool touch = data[1] & 0x80;
> -       int slot = input_mt_get_slot_by_key(input, data[0]);
> +       bool touch;
> +       int slot;
> +
> +       if (!input) {
> +               dev_warn_once(&container_of(wacom, struct wacom, wacom_wac)->hdev->dev,
> +                             "%s: touch_input is NULL\n", __func__);
> +               return;
> +       }
> +
> +       touch = data[1] & 0x80;
> +       slot = input_mt_get_slot_by_key(input, data[0]);
>
>         if (slot < 0)
>                 return;
> @@ -3229,6 +3244,12 @@ static void wacom_bpt3_button_msg(struct wacom_wac *wacom, unsigned char *data)
>         struct input_dev *input = wacom->pad_input;
>         struct wacom_features *features = &wacom->features;
>
> +       if (!input) {
> +               dev_warn_once(&container_of(wacom, struct wacom, wacom_wac)->hdev->dev,
> +                             "%s: pad_input is NULL\n", __func__);
> +               return;
> +       }
> +
>         if (features->type == INTUOSHT || features->type == INTUOSHT2) {
>                 input_report_key(input, BTN_LEFT, (data[1] & 0x02) != 0);
>                 input_report_key(input, BTN_BACK, (data[1] & 0x08) != 0);
> --
> 2.53.0
>
>