Re: [PATCH v4 0/6] HID: wacom: guard against NULL input devices on successful probe

[Jason Gerecke]

On Fri, Oct 23, 2026 at 8:31 PM Jinmo Yang <jinmo44.yang@xxxxxxxxx> wrote:
>
> When wacom_setup_{pen,touch,pad}_input_capabilities() returns -ENODEV,
> the corresponding input pointer is set to NULL but probe still succeeds.
> Subsequent irq handlers dereference those pointers unconditionally,
> causing NULL-pointer dereferences reachable from a spoofed HID device.
>
> This series adds per-function NULL guards across all affected handlers.
>
> Changes in v4:
>   - wacom_intuos_pad() now returns 2 for the normal path, 1 for the
>     NULL-guard path; wacom_intuos_irq() applies "result - 1" uniformly,
>     suppressing the spurious input_sync() the old "return 1" would
>     trigger (Jason).
>   - Added pen_input NULL guard at the top of wacom_intuos_irq() to
>     protect its helpers wacom_intuos_inout() and
>     wacom_intuos_general() (Jason).
>   - Added pen_input NULL guard to wacom_bpt_pen() (Jason).
>
> Changes in v3:
>   - Fixed wacom_dtus_irq(): DTUSX is pen-only, so do not require
>     pad_input for it (sashiko-bot).
>   - Added patch 6: touch_input guards for wacom_intuos_pro2_bt_touch(),
>     wacom_24hdt_irq(), and wacom_bamboo_pad_touch_event().
>
> Changes in v2:
>   - Restructured per Jason's review: per-function checks for dtus_irq,
>     graphire_irq, and the Bamboo handlers.
>   - wacom_intuos_pad() returns non-zero when pad_input is NULL so the
>     report does not fall through to wacom_intuos_inout() (sashiko-bot).
>   - wacom_intuos_bt_irq() guards both pen_input and pad_input (Jason).
>   - Added dev_warn_once at every guard (Jason).
>   - Dropped the cp2112 patch (Benjamin prefers Dmitry's series).
>
> Jinmo Yang (6):
>   HID: wacom: check the input device in the shared report helpers
>   HID: wacom: check the input devices in the legacy irq handlers
>   HID: wacom: add NULL input guards to wacom_intuos_irq() and its
>     helpers
>   HID: wacom: add NULL input guards to wacom_intuos_bt_irq()
>   HID: wacom: add NULL input guards to Bamboo handlers
>   HID: wacom: add NULL touch_input guards to remaining touch handlers
>
>  drivers/hid/wacom_wac.c | 127 ++++++++++++++++++++++++++++++++++++++--
>  1 file changed, 122 insertions(+), 5 deletions(-)
>
> --
> 2.53.0
>
>

Apologies for the delay in reviewing and responding. I'm happy with
the series in its current state.

For the set:
Reviewed-by: Jason Gerecke <jason.gerecke@xxxxxxxxx>

Jason (she/they)
---
Now instead of four in the eights place /
you’ve got three, ‘Cause you added one  /
(That is to say, eight) to the two,     /
But you can’t take seven from three,    /
So you look at the sixty-fours....