From 2f985de0afbe9366af9d322ea20589712c1dc8fe Mon Sep 17 00:00:00 2001 From: Matheus Alves de Almeida Date: Wed, 23 Sep 2026 23:09:36 -0300 Subject: [PATCH] HID: wacom: fix wacom_intuos_irq NULL pen_input deref Currently, wacom_intuos_irq() passes the parent of wacom_wac's pen_input to the dev_dbg() in the unknown report path. However, pen_input can be NULL on interfaces without a pen, causing a NULL pointer dereference. Get the HID device from the enclosing struct wacom and use hid_dbg() instead. Fixes: eb71d1bb270e ("Input: wacom - use dev_xxx() instead of naked printk()s and dbg()s") Reported-by: syzbot+b5a7cd83622c747977de@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=b5a7cd83622c747977de Signed-off-by: Matheus Alves de Almeida Reviewed-by: Jason Gerecke Signed-off-by: Jiri Kosina --- drivers/hid/wacom_wac.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c index 8feb8027be95..5b2f65ea4b51 100644 --- a/drivers/hid/wacom_wac.c +++ b/drivers/hid/wacom_wac.c @@ -1019,10 +1019,10 @@ static int wacom_intuos_general(struct wacom_wac *wacom) return 2; } -static int wacom_intuos_irq(struct wacom_wac *wacom) +static int wacom_intuos_irq(struct wacom_wac *wacom_wac) { - unsigned char *data = wacom->data; - struct input_dev *input = wacom->pen_input; + unsigned char *data = wacom_wac->data; + struct wacom *wacom = container_of(wacom_wac, struct wacom, wacom_wac); int result; if (data[0] != WACOM_REPORT_PENABLED && @@ -1033,23 +1033,23 @@ static int wacom_intuos_irq(struct wacom_wac *wacom) data[0] != WACOM_REPORT_CINTIQ && data[0] != WACOM_REPORT_CINTIQPAD && data[0] != WACOM_REPORT_INTUOS5PAD) { - dev_dbg(input->dev.parent, + hid_dbg(wacom->hdev, "%s: received unknown report #%d\n", __func__, data[0]); return 0; } /* process pad events */ - result = wacom_intuos_pad(wacom); + result = wacom_intuos_pad(wacom_wac); if (result) return result; /* process in/out prox events */ - result = wacom_intuos_inout(wacom); + result = wacom_intuos_inout(wacom_wac); if (result) return result - 1; /* process general packets */ - result = wacom_intuos_general(wacom); + result = wacom_intuos_general(wacom_wac); if (result) return result - 1;