[PATCH] HID: wacom: fix wacom_intuos_irq NULL pen_input deref
From: Matheus Alves de Almeida <hidden>
Date: 2026-09-24 02:10:32
Also in:
lkml
Subsystem:
hid core layer, hid wacom driver, the rest · Maintainers:
Jiri Kosina, Benjamin Tissoires, Ping Cheng, Jason Gerecke, Linus Torvalds
Currently, wacom_intuos_irq() passes the parent of wacom_wac's
pen_input to the dev_dbg() in the unknown report path. However,
pen_input can be NULL on interfaces without a pen, causing a
NULL pointer dereference.
Get the HID device from the enclosing struct wacom and use hid_dbg()
instead.
Fixes: eb71d1bb270e ("Input: wacom - use dev_xxx() instead of naked printk()s and dbg()s")
Reported-by: syzbot+b5a7cd83622c747977de@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=b5a7cd83622c747977de
Signed-off-by: Matheus Alves de Almeida <redacted>
---
drivers/hid/wacom_wac.c | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
index 8feb8027b..5b2f65ea4 100644
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c@@ -1019,10 +1019,10 @@ static int wacom_intuos_general(struct wacom_wac *wacom) return 2; } -static int wacom_intuos_irq(struct wacom_wac *wacom) +static int wacom_intuos_irq(struct wacom_wac *wacom_wac) { - unsigned char *data = wacom->data; - struct input_dev *input = wacom->pen_input; + unsigned char *data = wacom_wac->data; + struct wacom *wacom = container_of(wacom_wac, struct wacom, wacom_wac); int result; if (data[0] != WACOM_REPORT_PENABLED &&
@@ -1033,23 +1033,23 @@ static int wacom_intuos_irq(struct wacom_wac *wacom) data[0] != WACOM_REPORT_CINTIQ && data[0] != WACOM_REPORT_CINTIQPAD && data[0] != WACOM_REPORT_INTUOS5PAD) { - dev_dbg(input->dev.parent, + hid_dbg(wacom->hdev, "%s: received unknown report #%d\n", __func__, data[0]); return 0; } /* process pad events */ - result = wacom_intuos_pad(wacom); + result = wacom_intuos_pad(wacom_wac); if (result) return result; /* process in/out prox events */ - result = wacom_intuos_inout(wacom); + result = wacom_intuos_inout(wacom_wac); if (result) return result - 1; /* process general packets */ - result = wacom_intuos_general(wacom); + result = wacom_intuos_general(wacom_wac); if (result) return result - 1;
--
2.43.0