github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

HID: wacom: fix wacom_intuos_irq NULL pen_input deref

Browse Source 
Currently, wacom_intuos_irq() passes the parent of wacom_wac's
pen_input to the dev_dbg() in the unknown report path. However,
pen_input can be NULL on interfaces without a pen, causing a
NULL pointer dereference.

Get the HID device from the enclosing struct wacom and use hid_dbg()
instead.

Fixes: eb71d1bb27 ("Input: wacom - use dev_xxx() instead of naked printk()s and dbg()s")
Reported-by: syzbot+b5a7cd83622c747977de@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=b5a7cd83622c747977de
Signed-off-by: Matheus Alves de Almeida <matheus.aalmeida@inf.ufrgs.br>
Reviewed-by: Jason Gerecke <jason.gerecke@wacom.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
This commit is contained in:
Matheus Alves de Almeida 2026-09-23 23:09:36 -03:00 committed by Jiri Kosina
parent 0be03caba6
commit 2f985de0af
1 changed files with 7 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
drivers/hid/wacom_wac.c
View File

@ -1019,10 +1019,10 @@ static int wacom_intuos_general(struct wacom_wac *wacom)
return 2;
}
static int wacom_intuos_irq(struct wacom_wac *wacom)
static int wacom_intuos_irq(struct wacom_wac *wacom_wac)
{
unsigned char *data = wacom->data;
struct input_dev *input = wacom->pen_input;
unsigned char *data = wacom_wac->data;
struct wacom *wacom = container_of(wacom_wac, struct wacom, wacom_wac);
int result;
if (data[0] != WACOM_REPORT_PENABLED &&
@ -1033,23 +1033,23 @@ static int wacom_intuos_irq(struct wacom_wac *wacom)
data[0] != WACOM_REPORT_CINTIQ &&
data[0] != WACOM_REPORT_CINTIQPAD &&
data[0] != WACOM_REPORT_INTUOS5PAD) {
dev_dbg(input->dev.parent,
hid_dbg(wacom->hdev,
"%s: received unknown report #%d\n", __func__, data[0]);
return 0;
}
/* process pad events */
result = wacom_intuos_pad(wacom);
result = wacom_intuos_pad(wacom_wac);
if (result)
return result;
/* process in/out prox events */
result = wacom_intuos_inout(wacom);
result = wacom_intuos_inout(wacom_wac);
if (result)
return result - 1;
/* process general packets */
result = wacom_intuos_general(wacom);
result = wacom_intuos_general(wacom_wac);
if (result)
return result - 1;