From 86472508a7ef74b525e79a79d2d02d911a641d6b Mon Sep 17 00:00:00 2001 From: Lee Jones Date: Wed, 9 Sep 2026 11:12:23 +0000 Subject: HID: wacom: Use hdev->product in wacom_setup_touch_input_capabilities Replace the lookup-dependent 'wacom_wac->shared->touch->product' references with 'hdev->product' inside wacom_setup_touch_input_capabilities() since 'hdev' is already available (via container_of) and represents the touch device itself. Cc: stable@vger.kernel.org Signed-off-by: Lee Jones Acked-by: Ping Cheng Tested-by: Ping Cheng Signed-off-by: Jiri Kosina --- drivers/hid/wacom_wac.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) (limited to 'drivers/hid') diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c index 8feb8027be95..7cf2b4de52be 100644 --- a/drivers/hid/wacom_wac.c +++ b/drivers/hid/wacom_wac.c @@ -3966,8 +3966,8 @@ int wacom_setup_pen_input_capabilities(struct input_dev *input_dev, int wacom_setup_touch_input_capabilities(struct input_dev *input_dev, struct wacom_wac *wacom_wac) { + struct hid_device *hdev = container_of(wacom_wac, struct wacom, wacom_wac)->hdev; struct wacom_features *features = &wacom_wac->features; - if (!(features->device_type & WACOM_DEVICETYPE_TOUCH)) return -ENODEV; @@ -3976,9 +3976,11 @@ int wacom_setup_touch_input_capabilities(struct input_dev *input_dev, else __set_bit(INPUT_PROP_POINTER, input_dev->propbit); - if (features->type == HID_GENERIC) + if (features->type == HID_GENERIC) { + hid_dbg(hdev, "generic touch setup\n"); /* setup has already been done */ return 0; + } input_dev->evbit[0] |= BIT_MASK(EV_KEY) | BIT_MASK(EV_ABS); __set_bit(BTN_TOUCH, input_dev->keybit); @@ -4010,19 +4012,17 @@ int wacom_setup_touch_input_capabilities(struct input_dev *input_dev, input_dev->evbit[0] |= BIT_MASK(EV_SW); __set_bit(SW_MUTE_DEVICE, input_dev->swbit); - if (wacom_wac->shared->touch->product == 0x361) { + if (hdev->product == 0x361) { input_set_abs_params(input_dev, ABS_MT_POSITION_X, 0, 12440, 4, 0); input_set_abs_params(input_dev, ABS_MT_POSITION_Y, 0, 8640, 4, 0); - } - else if (wacom_wac->shared->touch->product == 0x360) { + } else if (hdev->product == 0x360) { input_set_abs_params(input_dev, ABS_MT_POSITION_X, 0, 8960, 4, 0); input_set_abs_params(input_dev, ABS_MT_POSITION_Y, 0, 5920, 4, 0); - } - else if (wacom_wac->shared->touch->product == 0x393) { + } else if (hdev->product == 0x393) { input_set_abs_params(input_dev, ABS_MT_POSITION_X, 0, 6400, 4, 0); input_set_abs_params(input_dev, ABS_MT_POSITION_Y, @@ -4052,8 +4052,8 @@ int wacom_setup_touch_input_capabilities(struct input_dev *input_dev, fallthrough; case WACOM_27QHDT: - if (wacom_wac->shared->touch->product == 0x32C || - wacom_wac->shared->touch->product == 0xF6) { + if (hdev->product == 0x32C || + hdev->product == 0xF6) { input_dev->evbit[0] |= BIT_MASK(EV_SW); __set_bit(SW_MUTE_DEVICE, input_dev->swbit); wacom_wac->has_mute_touch_switch = true; -- cgit v1.2.3 From ba16e5ffbaa10fde960918d69af5e49f2b3fdd5e Mon Sep 17 00:00:00 2001 From: Lee Jones Date: Wed, 9 Sep 2026 11:12:24 +0000 Subject: HID: wacom: Advertise SW_MUTE_DEVICE capability prior to registration Input subsystem guidelines require that device capabilities are advertised before the input device is registered. The Wacom driver was violating this by advertising the SW_MUTE_DEVICE capability post-registration in wacom_set_shared_values() (and duplicating it in device-specific setup cases). Resolve this by moving the SW_MUTE_DEVICE capability setup to wacom_setup_touch_input_capabilities() for all touch devices that support it. For generic touch devices whose capabilities depend on mute switch usages parsed from a sibling Pen/Pad interface, defer registration with -EPROBE_DEFER until the sibling has parsed its descriptors and initialized shared capabilities. Cc: stable@vger.kernel.org Fixes: d2ec58aee8b1 ("HID: wacom: generic: support generic touch switch") Signed-off-by: Lee Jones Acked-by: Ping Cheng Tested-by: Ping Cheng Signed-off-by: Jiri Kosina --- drivers/hid/wacom_sys.c | 93 +++++++++++++++++++++++++++++++++++++++---------- drivers/hid/wacom_wac.c | 5 +++ 2 files changed, 79 insertions(+), 19 deletions(-) (limited to 'drivers/hid') diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c index 0eafa483b7f7..4eed2c189017 100644 --- a/drivers/hid/wacom_sys.c +++ b/drivers/hid/wacom_sys.c @@ -907,19 +907,14 @@ static int wacom_add_shared_data(struct hid_device *hdev) list_add_tail(&data->list, &wacom_udev_list); } - mutex_unlock(&wacom_udev_list_lock); - wacom_wac->shared = &data->shared; - retval = devm_add_action_or_reset(&hdev->dev, wacom_remove_shared_data, wacom); - if (retval) - return retval; + if (wacom_wac->has_mute_touch_switch) + WRITE_ONCE(wacom_wac->shared->has_mute_touch_switch, true); - if (wacom_wac->features.device_type & WACOM_DEVICETYPE_TOUCH) - wacom_wac->shared->touch = hdev; - else if (wacom_wac->features.device_type & WACOM_DEVICETYPE_PEN) - wacom_wac->shared->pen = hdev; + mutex_unlock(&wacom_udev_list_lock); + retval = devm_add_action_or_reset(&hdev->dev, wacom_remove_shared_data, wacom); return retval; } @@ -2343,13 +2338,12 @@ static void wacom_release_resources(struct wacom *wacom) static void wacom_set_shared_values(struct wacom_wac *wacom_wac) { - if (wacom_wac->features.device_type & WACOM_DEVICETYPE_TOUCH) { - wacom_wac->shared->type = wacom_wac->features.type; - wacom_wac->shared->touch_input = wacom_wac->touch_input; - } + struct wacom *wacom = container_of(wacom_wac, struct wacom, wacom_wac); + + guard(mutex)(&wacom_udev_list_lock); if (wacom_wac->has_mute_touch_switch) { - wacom_wac->shared->has_mute_touch_switch = true; + WRITE_ONCE(wacom_wac->shared->has_mute_touch_switch, true); /* Hardware touch switch may be off. Wait until * we know the switch state to decide is_touch_on. * Softkey state should be initialized to "on" to @@ -2359,14 +2353,69 @@ static void wacom_set_shared_values(struct wacom_wac *wacom_wac) wacom_wac->shared->is_touch_on = true; } - if (wacom_wac->shared->has_mute_touch_switch && - wacom_wac->shared->touch_input) { - set_bit(EV_SW, wacom_wac->shared->touch_input->evbit); - input_set_capability(wacom_wac->shared->touch_input, EV_SW, - SW_MUTE_DEVICE); + if (wacom_wac->features.device_type & WACOM_DEVICETYPE_TOUCH) { + wacom_wac->shared->type = wacom_wac->features.type; + wacom_wac->shared->touch_input = wacom_wac->touch_input; + wacom_wac->shared->touch = wacom->hdev; + } else if (wacom_wac->features.device_type & WACOM_DEVICETYPE_PEN) { + /* Pairs with smp_load_acquire() in wacom_sibling_pending() */ + smp_store_release(&wacom_wac->shared->pen, wacom->hdev); } } +static bool wacom_sibling_pending(struct wacom *wacom) +{ + const struct wacom_features *features = &wacom->wacom_wac.features; + struct hid_device *hdev = wacom->hdev; + struct usb_interface *sibling_intf; + int ifnum; + + if (features->type != HID_GENERIC || + !(features->device_type & WACOM_DEVICETYPE_TOUCH)) + return false; + + if (wacom->wacom_wac.shared) { + /* Pairs with smp_store_release() in wacom_set_shared_values() */ + if (smp_load_acquire(&wacom->wacom_wac.shared->pen)) + return false; + } + + if (!hid_is_usb(hdev) || !wacom->usbdev || !wacom->intf || + !wacom->intf->cur_altsetting) + return false; + + ifnum = wacom->intf->cur_altsetting->desc.bInterfaceNumber; + + /* + * On composite Wacom devices, the Pen interface is always interface 0. + * If the Touch interface is interface 0, there is no sibling Pen + * interface on this device (standalone touch device). + */ + if (ifnum == 0) + return false; + + /* Look for the sibling Pen interface at interface 0 */ + sibling_intf = usb_ifnum_to_if(wacom->usbdev, 0); + if (!sibling_intf || !sibling_intf->cur_altsetting) + return false; + + if (sibling_intf->cur_altsetting->desc.bInterfaceClass != + USB_INTERFACE_CLASS_HID) + return false; + + if (sibling_intf->cur_altsetting->desc.bInterfaceSubClass == 1 && + (sibling_intf->cur_altsetting->desc.bInterfaceProtocol == 1 || + sibling_intf->cur_altsetting->desc.bInterfaceProtocol == 2)) + return false; + + /* + * Interface 0 is a candidate HID interface on this composite device + * whose probe has not completed yet (shared->pen is NULL). Defer until + * interface 0 finishes probing and registers shared values. + */ + return true; +} + static int wacom_parse_and_register(struct wacom *wacom, bool wireless) { struct wacom_wac *wacom_wac = &wacom->wacom_wac; @@ -2444,6 +2493,11 @@ static int wacom_parse_and_register(struct wacom *wacom, bool wireless) if (error) goto fail; + if (wacom_sibling_pending(wacom)) { + error = -EPROBE_DEFER; + goto fail; + } + error = wacom_setup_inputs(wacom); if (error) goto fail; @@ -2501,6 +2555,7 @@ static int wacom_parse_and_register(struct wacom *wacom, bool wireless) fail_hw_stop: hid_hw_stop(hdev); + cancel_delayed_work_sync(&wacom->init_work); fail: wacom_release_resources(wacom); return error; diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c index 7cf2b4de52be..30df866feac8 100644 --- a/drivers/hid/wacom_wac.c +++ b/drivers/hid/wacom_wac.c @@ -3978,6 +3978,11 @@ int wacom_setup_touch_input_capabilities(struct input_dev *input_dev, if (features->type == HID_GENERIC) { hid_dbg(hdev, "generic touch setup\n"); + if (wacom_wac->has_mute_touch_switch || + (wacom_wac->shared && READ_ONCE(wacom_wac->shared->has_mute_touch_switch))) { + input_set_capability(input_dev, EV_SW, SW_MUTE_DEVICE); + wacom_wac->has_mute_touch_switch = true; + } /* setup has already been done */ return 0; } -- cgit v1.2.3 From ef32877368a7013c060ef6bd03a30b6da2fe0c41 Mon Sep 17 00:00:00 2001 From: Lee Jones Date: Wed, 9 Sep 2026 11:12:25 +0000 Subject: HID: wacom: Fix Use-After-Free in wacom_intuos_pad wacom_intuos_pad() accesses wacom->shared->touch_input locklessly inside the interrupt handler context. If the Touch sibling device is disconnected, wacom_remove_shared_data() clears 'touch_input' outside any lock, creating a Time-of-Check to Time-of-Use (TOCTOU) race condition where a preempted reader in interrupt context dereferences the freed pointer, leading to a Use-After-Free. Resolve this by introducing RCU protection for the touch_input pointer: - Annotate 'touch_input' in wacom_shared struct with __rcu - Wrap all lockless readers in wacom_wac.c with guard(rcu)() and rcu_dereference() using a unified wacom_report_touch_mute() helper - Update writers in wacom_sys.c using rcu_assign_pointer() - Call synchronize_rcu() in wacom_remove_shared_data() to ensure all active RCU readers have finished before the input device is freed Also wrap wacom_set_shared_values() and touch/pen assignments in wacom_add_shared_data() inside the wacom_udev_list_lock to serialize concurrent probe assignments, and verify that 'shared->touch == hdev' before setting touch_input to prevent concurrent sibling probe state desynchronization. Cc: stable@vger.kernel.org Fixes: 961794a00eab ("Input: wacom - add reporting of SW_MUTE_DEVICE events") Signed-off-by: Lee Jones Acked-by: Ping Cheng Tested-by: Ping Cheng Signed-off-by: Jiri Kosina --- drivers/hid/wacom_sys.c | 23 ++++++++++++++++------- drivers/hid/wacom_wac.c | 36 ++++++++++++++++++------------------ drivers/hid/wacom_wac.h | 2 +- 3 files changed, 35 insertions(+), 26 deletions(-) (limited to 'drivers/hid') diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c index 4eed2c189017..10f7de515ea2 100644 --- a/drivers/hid/wacom_sys.c +++ b/drivers/hid/wacom_sys.c @@ -875,10 +875,16 @@ static void wacom_remove_shared_data(void *res) data = container_of(wacom_wac->shared, struct wacom_hdev_data, shared); - if (wacom_wac->shared->touch == wacom->hdev) - wacom_wac->shared->touch = NULL; - else if (wacom_wac->shared->pen == wacom->hdev) - wacom_wac->shared->pen = NULL; + scoped_guard(mutex, &wacom_udev_list_lock) { + if (wacom_wac->shared->touch == wacom->hdev) { + wacom_wac->shared->touch = NULL; + rcu_assign_pointer(wacom_wac->shared->touch_input, NULL); + } else if (wacom_wac->shared->pen == wacom->hdev) { + wacom_wac->shared->pen = NULL; + } + } + + synchronize_rcu(); kref_put(&data->kref, wacom_release_shared_data); wacom_wac->shared = NULL; @@ -915,6 +921,7 @@ static int wacom_add_shared_data(struct hid_device *hdev) mutex_unlock(&wacom_udev_list_lock); retval = devm_add_action_or_reset(&hdev->dev, wacom_remove_shared_data, wacom); + return retval; } @@ -2354,9 +2361,11 @@ static void wacom_set_shared_values(struct wacom_wac *wacom_wac) } if (wacom_wac->features.device_type & WACOM_DEVICETYPE_TOUCH) { - wacom_wac->shared->type = wacom_wac->features.type; - wacom_wac->shared->touch_input = wacom_wac->touch_input; - wacom_wac->shared->touch = wacom->hdev; + if (wacom_wac->shared->touch == wacom->hdev || !wacom_wac->shared->touch) { + wacom_wac->shared->type = wacom_wac->features.type; + wacom_wac->shared->touch = wacom->hdev; + rcu_assign_pointer(wacom_wac->shared->touch_input, wacom_wac->touch_input); + } } else if (wacom_wac->features.device_type & WACOM_DEVICETYPE_PEN) { /* Pairs with smp_load_acquire() in wacom_sibling_pending() */ smp_store_release(&wacom_wac->shared->pen, wacom->hdev); diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c index 30df866feac8..c5227530f291 100644 --- a/drivers/hid/wacom_wac.c +++ b/drivers/hid/wacom_wac.c @@ -510,6 +510,18 @@ static void wacom_intuos_schedule_prox_event(struct wacom_wac *wacom_wac) } } +static void wacom_report_touch_mute(struct wacom_wac *wacom_wac, bool mute) +{ + struct input_dev *touch_input; + + guard(rcu)(); + touch_input = rcu_dereference(wacom_wac->shared->touch_input); + if (touch_input) { + input_report_switch(touch_input, SW_MUTE_DEVICE, mute); + input_sync(touch_input); + } +} + static int wacom_intuos_pad(struct wacom_wac *wacom) { struct wacom_features *features = &wacom->features; @@ -650,12 +662,8 @@ static int wacom_intuos_pad(struct wacom_wac *wacom) input_report_key(input, KEY_CONTROLPANEL, menu); input_report_key(input, KEY_INFO, info); - if (wacom->shared && wacom->shared->touch_input) { - input_report_switch(wacom->shared->touch_input, - SW_MUTE_DEVICE, - !wacom->shared->is_touch_on); - input_sync(wacom->shared->touch_input); - } + if (wacom->shared) + wacom_report_touch_mute(wacom, !wacom->shared->is_touch_on); input_report_abs(input, ABS_RX, strip1); input_report_abs(input, ABS_RY, strip2); @@ -2168,7 +2176,7 @@ static void wacom_wac_pad_event(struct hid_device *hdev, struct hid_field *field */ if ((equivalent_usage == WACOM_HID_WD_MUTE_DEVICE) || (equivalent_usage == WACOM_HID_WD_TOUCHONOFF)) { - if (wacom_wac->shared->touch_input) { + if (wacom_wac->shared) { bool *is_touch_on = &wacom_wac->shared->is_touch_on; if (equivalent_usage == WACOM_HID_WD_MUTE_DEVICE && value) @@ -2176,9 +2184,7 @@ static void wacom_wac_pad_event(struct hid_device *hdev, struct hid_field *field else if (equivalent_usage == WACOM_HID_WD_TOUCHONOFF) *is_touch_on = value; - input_report_switch(wacom_wac->shared->touch_input, - SW_MUTE_DEVICE, !(*is_touch_on)); - input_sync(wacom_wac->shared->touch_input); + wacom_report_touch_mute(wacom_wac, !(*is_touch_on)); } return; } @@ -3396,11 +3402,8 @@ static int wacom_wireless_irq(struct wacom_wac *wacom, size_t len) if ((wacom->shared->type == INTUOSHT || wacom->shared->type == INTUOSHT2) && - wacom->shared->touch_input && wacom->shared->touch_max) { - input_report_switch(wacom->shared->touch_input, - SW_MUTE_DEVICE, data[5] & 0x40); - input_sync(wacom->shared->touch_input); + wacom_report_touch_mute(wacom, data[5] & 0x40); } pid = get_unaligned_be16(&data[6]); @@ -3435,11 +3438,8 @@ static int wacom_status_irq(struct wacom_wac *wacom_wac, size_t len) if ((features->type == INTUOSHT || features->type == INTUOSHT2) && - wacom_wac->shared->touch_input && features->touch_max) { - input_report_switch(wacom_wac->shared->touch_input, - SW_MUTE_DEVICE, data[8] & 0x40); - input_sync(wacom_wac->shared->touch_input); + wacom_report_touch_mute(wacom_wac, data[8] & 0x40); } if (data[9] & 0x02) { /* wireless module is attached */ diff --git a/drivers/hid/wacom_wac.h b/drivers/hid/wacom_wac.h index 126bec6e5c0c..a8bbba4a6f37 100644 --- a/drivers/hid/wacom_wac.h +++ b/drivers/hid/wacom_wac.h @@ -285,7 +285,7 @@ struct wacom_shared { /* for wireless device to access USB interfaces */ unsigned touch_max; int type; - struct input_dev *touch_input; + struct input_dev __rcu *touch_input; struct hid_device *pen; struct hid_device *touch; bool has_mute_touch_switch; -- cgit v1.2.3 From 3a523ecf9ac3fdd33f5eb31c43937ee44135395b Mon Sep 17 00:00:00 2001 From: Lee Jones Date: Wed, 9 Sep 2026 11:12:26 +0000 Subject: HID: wacom: Fix Use-After-Free in wacom_bamboo_pad wacom_bamboo_pad_pen_event() accesses wacom->shared->pen locklessly relative to wacom_remove_shared_data() which nullifies it. This can lead to a Use-After-Free if the sibling device is removed while events are being processed. Resolve this by introducing RCU protection for pen and touch pointers: - Annotate 'pen' and 'touch' in wacom_shared struct with __rcu. - Wrap lockless readers in wacom_bamboo_pad_pen_event() with rcu_read_lock() and rcu_dereference(). - Update writers in wacom_sys.c using rcu_assign_pointer(). - Use rcu_dereference_protected for comparisons under wacom_udev_list_lock. - Also use rcu_access_pointer in wacom_sibling_pending() and wacom_mode_change_work() to avoid warnings (while lockless access in the latter remains a pre-existing issue). Cc: stable@vger.kernel.org Fixes: 8c97a765467c ("HID: wacom: add full support of the Wacom Bamboo PAD") Signed-off-by: Lee Jones Acked-by: Ping Cheng Tested-by: Ping Cheng Signed-off-by: Jiri Kosina --- drivers/hid/wacom_sys.c | 40 ++++++++++++++++++++++++++-------------- drivers/hid/wacom_wac.c | 13 ++++++------- drivers/hid/wacom_wac.h | 4 ++-- 3 files changed, 34 insertions(+), 23 deletions(-) (limited to 'drivers/hid') diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c index 10f7de515ea2..307eda9bbdd0 100644 --- a/drivers/hid/wacom_sys.c +++ b/drivers/hid/wacom_sys.c @@ -876,11 +876,18 @@ static void wacom_remove_shared_data(void *res) shared); scoped_guard(mutex, &wacom_udev_list_lock) { - if (wacom_wac->shared->touch == wacom->hdev) { - wacom_wac->shared->touch = NULL; + struct hid_device *touch = + rcu_dereference_protected(wacom_wac->shared->touch, + lockdep_is_held(&wacom_udev_list_lock)); + struct hid_device *pen = + rcu_dereference_protected(wacom_wac->shared->pen, + lockdep_is_held(&wacom_udev_list_lock)); + + if (touch == wacom->hdev) { + rcu_assign_pointer(wacom_wac->shared->touch, NULL); rcu_assign_pointer(wacom_wac->shared->touch_input, NULL); - } else if (wacom_wac->shared->pen == wacom->hdev) { - wacom_wac->shared->pen = NULL; + } else if (pen == wacom->hdev) { + rcu_assign_pointer(wacom_wac->shared->pen, NULL); } } @@ -2361,14 +2368,17 @@ static void wacom_set_shared_values(struct wacom_wac *wacom_wac) } if (wacom_wac->features.device_type & WACOM_DEVICETYPE_TOUCH) { - if (wacom_wac->shared->touch == wacom->hdev || !wacom_wac->shared->touch) { + struct hid_device *touch = + rcu_dereference_protected(wacom_wac->shared->touch, + lockdep_is_held(&wacom_udev_list_lock)); + + if (touch == wacom->hdev || !touch) { wacom_wac->shared->type = wacom_wac->features.type; - wacom_wac->shared->touch = wacom->hdev; + rcu_assign_pointer(wacom_wac->shared->touch, wacom->hdev); rcu_assign_pointer(wacom_wac->shared->touch_input, wacom_wac->touch_input); } } else if (wacom_wac->features.device_type & WACOM_DEVICETYPE_PEN) { - /* Pairs with smp_load_acquire() in wacom_sibling_pending() */ - smp_store_release(&wacom_wac->shared->pen, wacom->hdev); + rcu_assign_pointer(wacom_wac->shared->pen, wacom->hdev); } } @@ -2384,8 +2394,7 @@ static bool wacom_sibling_pending(struct wacom *wacom) return false; if (wacom->wacom_wac.shared) { - /* Pairs with smp_store_release() in wacom_set_shared_values() */ - if (smp_load_acquire(&wacom->wacom_wac.shared->pen)) + if (rcu_access_pointer(wacom->wacom_wac.shared->pen)) return false; } @@ -2852,16 +2861,19 @@ static void wacom_mode_change_work(struct work_struct *work) bool is_direct = wacom->wacom_wac.is_direct_mode; int error = 0; - if (shared->pen) { - wacom1 = hid_get_drvdata(shared->pen); + struct hid_device *pen = rcu_access_pointer(shared->pen); + struct hid_device *touch = rcu_access_pointer(shared->touch); + + if (pen) { + wacom1 = hid_get_drvdata(pen); wacom_release_resources(wacom1); hid_hw_stop(wacom1->hdev); wacom1->wacom_wac.has_mode_change = true; wacom1->wacom_wac.is_direct_mode = is_direct; } - if (shared->touch) { - wacom2 = hid_get_drvdata(shared->touch); + if (touch) { + wacom2 = hid_get_drvdata(touch); wacom_release_resources(wacom2); hid_hw_stop(wacom2->hdev); wacom2->wacom_wac.has_mode_change = true; diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c index c5227530f291..c4cd87b781c4 100644 --- a/drivers/hid/wacom_wac.c +++ b/drivers/hid/wacom_wac.c @@ -3307,6 +3307,7 @@ static int wacom_bpt_irq(struct wacom_wac *wacom, size_t len) static void wacom_bamboo_pad_pen_event(struct wacom_wac *wacom, unsigned char *data) { + struct hid_device *pen; unsigned char prefix; /* @@ -3319,13 +3320,11 @@ static void wacom_bamboo_pad_pen_event(struct wacom_wac *wacom, prefix = data[0]; data[0] = WACOM_REPORT_BPAD_PEN; - /* - * actually reroute the event. - * No need to check if wacom->shared->pen is valid, hid_input_report() - * will check for us. - */ - hid_input_report(wacom->shared->pen, HID_INPUT_REPORT, data, - WACOM_PKGLEN_PENABLED, 1); + guard(rcu)(); + pen = rcu_dereference(wacom->shared->pen); + if (pen) + hid_input_report(pen, HID_INPUT_REPORT, data, + WACOM_PKGLEN_PENABLED, 1); data[0] = prefix; } diff --git a/drivers/hid/wacom_wac.h b/drivers/hid/wacom_wac.h index a8bbba4a6f37..170d6adbe02a 100644 --- a/drivers/hid/wacom_wac.h +++ b/drivers/hid/wacom_wac.h @@ -286,8 +286,8 @@ struct wacom_shared { unsigned touch_max; int type; struct input_dev __rcu *touch_input; - struct hid_device *pen; - struct hid_device *touch; + struct hid_device __rcu *pen; + struct hid_device __rcu *touch; bool has_mute_touch_switch; bool is_touch_on; }; -- cgit v1.2.3 From 480c9cb14ae81f8e112ff83f8778b3d7b9324dc8 Mon Sep 17 00:00:00 2001 From: Lee Jones Date: Wed, 9 Sep 2026 11:12:27 +0000 Subject: HID: wacom: Redesign shared sibling data lifecycle The Wacom driver coordinates state between sibling interfaces of the same physical device using a shared structure 'wacom_shared' inside 'wacom_hdev_data'. The driver kept a volatile representative pointer 'data->dev' pointing to a sibling 'hid_device' for physical path comparisons during sibling matching. This pointer management is fragile. When the representative device is disconnected, wacom_remove_shared_data() failed to clear/update 'data->dev', leading to a Use-After-Free vulnerability when subsequent sibling probes dereference the dangling 'data->dev' pointer. Resolve this issue by redesigning the sibling data lifecycle: - Eliminate the volatile 'data->dev' representative pointer completely - Redesign 'wacom_hdev_data' to store stable static copies of the required attributes upon first allocation: 'phys' path string, 'vendor', 'product' IDs and the sibling's 'device_type' - Use these static attributes for stable sibling matching in wacom_are_sibling() and wacom_get_hdev_data() This ensures sibling matching remains safe and stable even if individual siblings are dynamically added or removed. To secure the lifecycle against concurrent probe/disconnect races: - Switch kref_put() to kref_put_mutex() in wacom_remove_shared_data() to serialize refcount drops with list traversal and lookup - Modify wacom_release_shared_data() to assume the list lock is already held Also, do not accumulate the 'device_type' capability flag during subsequent sibling probes. Keeping only the first probed sibling's device_type exactly preserves the original sibling matching behavior without introducing side effects. Cc: stable@vger.kernel.org Fixes: 4492efffffeb ("Input: wacom - share pen info with touch of the same ID") Signed-off-by: Lee Jones Acked-by: Ping Cheng Tested-by: Ping Cheng Signed-off-by: Jiri Kosina --- drivers/hid/wacom_sys.c | 70 ++++++++++++++++++++++++++++++++----------------- 1 file changed, 46 insertions(+), 24 deletions(-) (limited to 'drivers/hid') diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c index 307eda9bbdd0..8dc7aa1c0a26 100644 --- a/drivers/hid/wacom_sys.c +++ b/drivers/hid/wacom_sys.c @@ -757,27 +757,47 @@ static void wacom_retrieve_hid_descriptor(struct hid_device *hdev, struct wacom_hdev_data { struct list_head list; struct kref kref; - struct hid_device *dev; + char phys[64]; + __u32 vendor; + __u32 product; + __u32 device_type; struct wacom_shared shared; }; +static bool wacom_compare_device_paths(struct hid_device *hdev_a, + const char *phys_b, char separator) +{ + const char *p1 = strrchr(hdev_a->phys, separator); + const char *p2 = strrchr(phys_b, separator); + int n1, n2; + + if (!p1 || !p2) + return false; + + n1 = p1 - hdev_a->phys; + n2 = p2 - phys_b; + + if (n1 != n2 || n1 <= 0 || n2 <= 0) + return false; + + return !strncmp(hdev_a->phys, phys_b, n1); +} + static LIST_HEAD(wacom_udev_list); static DEFINE_MUTEX(wacom_udev_list_lock); static bool wacom_are_sibling(struct hid_device *hdev, - struct hid_device *sibling) + struct wacom_hdev_data *data) { struct wacom *wacom = hid_get_drvdata(hdev); struct wacom_features *features = &wacom->wacom_wac.features; - struct wacom *sibling_wacom = hid_get_drvdata(sibling); - struct wacom_features *sibling_features = &sibling_wacom->wacom_wac.features; __u32 oVid = features->oVid ? features->oVid : hdev->vendor; __u32 oPid = features->oPid ? features->oPid : hdev->product; /* The defined oVid/oPid must match that of the sibling */ - if (features->oVid != HID_ANY_ID && sibling->vendor != oVid) + if (features->oVid != HID_ANY_ID && data->vendor != oVid) return false; - if (features->oPid != HID_ANY_ID && sibling->product != oPid) + if (features->oPid != HID_ANY_ID && data->product != oPid) return false; /* @@ -785,11 +805,11 @@ static bool wacom_are_sibling(struct hid_device *hdev, * device path, while those with different VID/PID must share * the same physical parent device path. */ - if (hdev->vendor == sibling->vendor && hdev->product == sibling->product) { - if (!hid_compare_device_paths(hdev, sibling, '/')) + if (hdev->vendor == data->vendor && hdev->product == data->product) { + if (!wacom_compare_device_paths(hdev, data->phys, '/')) return false; } else { - if (!hid_compare_device_paths(hdev, sibling, '.')) + if (!wacom_compare_device_paths(hdev, data->phys, '.')) return false; } @@ -802,7 +822,7 @@ static bool wacom_are_sibling(struct hid_device *hdev, * devices. */ if ((features->device_type & WACOM_DEVICETYPE_DIRECT) && - !(sibling_features->device_type & WACOM_DEVICETYPE_DIRECT)) + !(data->device_type & WACOM_DEVICETYPE_DIRECT)) return false; /* @@ -810,17 +830,17 @@ static bool wacom_are_sibling(struct hid_device *hdev, * devices. */ if (!(features->device_type & WACOM_DEVICETYPE_DIRECT) && - (sibling_features->device_type & WACOM_DEVICETYPE_DIRECT)) + (data->device_type & WACOM_DEVICETYPE_DIRECT)) return false; /* Pen devices may only be siblings of touch devices */ if ((features->device_type & WACOM_DEVICETYPE_PEN) && - !(sibling_features->device_type & WACOM_DEVICETYPE_TOUCH)) + !(data->device_type & WACOM_DEVICETYPE_TOUCH)) return false; /* Touch devices may only be siblings of pen devices */ if ((features->device_type & WACOM_DEVICETYPE_TOUCH) && - !(sibling_features->device_type & WACOM_DEVICETYPE_PEN)) + !(data->device_type & WACOM_DEVICETYPE_PEN)) return false; /* @@ -836,7 +856,7 @@ static struct wacom_hdev_data *wacom_get_hdev_data(struct hid_device *hdev) /* Try to find an already-probed interface from the same device */ list_for_each_entry(data, &wacom_udev_list, list) { - if (hid_compare_device_paths(hdev, data->dev, '/')) { + if (wacom_compare_device_paths(hdev, data->phys, '/')) { kref_get(&data->kref); return data; } @@ -844,7 +864,7 @@ static struct wacom_hdev_data *wacom_get_hdev_data(struct hid_device *hdev) /* Fallback to finding devices that appear to be "siblings" */ list_for_each_entry(data, &wacom_udev_list, list) { - if (wacom_are_sibling(hdev, data->dev)) { + if (wacom_are_sibling(hdev, data)) { kref_get(&data->kref); return data; } @@ -858,18 +878,15 @@ static void wacom_release_shared_data(struct kref *kref) struct wacom_hdev_data *data = container_of(kref, struct wacom_hdev_data, kref); - mutex_lock(&wacom_udev_list_lock); list_del(&data->list); - mutex_unlock(&wacom_udev_list_lock); - kfree(data); } static void wacom_remove_shared_data(void *res) { - struct wacom *wacom = res; + struct wacom *res_wacom = res; struct wacom_hdev_data *data; - struct wacom_wac *wacom_wac = &wacom->wacom_wac; + struct wacom_wac *wacom_wac = &res_wacom->wacom_wac; if (wacom_wac->shared) { data = container_of(wacom_wac->shared, struct wacom_hdev_data, @@ -883,17 +900,19 @@ static void wacom_remove_shared_data(void *res) rcu_dereference_protected(wacom_wac->shared->pen, lockdep_is_held(&wacom_udev_list_lock)); - if (touch == wacom->hdev) { + if (touch == res_wacom->hdev) { rcu_assign_pointer(wacom_wac->shared->touch, NULL); rcu_assign_pointer(wacom_wac->shared->touch_input, NULL); - } else if (pen == wacom->hdev) { + } else if (pen == res_wacom->hdev) { rcu_assign_pointer(wacom_wac->shared->pen, NULL); } } synchronize_rcu(); - kref_put(&data->kref, wacom_release_shared_data); + if (kref_put_mutex(&data->kref, wacom_release_shared_data, &wacom_udev_list_lock)) + mutex_unlock(&wacom_udev_list_lock); + wacom_wac->shared = NULL; } } @@ -916,7 +935,10 @@ static int wacom_add_shared_data(struct hid_device *hdev) } kref_init(&data->kref); - data->dev = hdev; + strscpy(data->phys, hdev->phys, sizeof(data->phys)); + data->vendor = hdev->vendor; + data->product = hdev->product; + data->device_type = wacom_wac->features.device_type; list_add_tail(&data->list, &wacom_udev_list); } -- cgit v1.2.3 From dbafba22aa0325d9e7ee04387052482fb32eae97 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Uwe=20Kleine-K=C3=B6nig=20=28The=20Capable=20Hub=29?= Date: Mon, 6 Jul 2026 11:21:40 +0200 Subject: HID: wacom: #include instead of MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The single device-id structure that is used by drivers/hid/wacom.h and its users (drivers/hid/wacom_sys.c + drivers/hid/wacom_wac.c) is struct hid_device_id. So #include the much more lightweight instead the full . Signed-off-by: Uwe Kleine-König (The Capable Hub) Acked-by: Ping Cheng Tested-by: Ping Cheng Signed-off-by: Jiri Kosina --- drivers/hid/wacom.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers/hid') diff --git a/drivers/hid/wacom.h b/drivers/hid/wacom.h index 1deacb4568cb..d2398b1cdbb2 100644 --- a/drivers/hid/wacom.h +++ b/drivers/hid/wacom.h @@ -82,7 +82,7 @@ #include #include #include -#include +#include #include #include #include -- cgit v1.2.3 From cae3031c691dff0be61a26bc64e31a6939010d5c Mon Sep 17 00:00:00 2001 From: Ping Cheng Date: Wed, 7 Oct 2026 15:00:27 -0700 Subject: HID: wacom: Write shared touch initial status only once For consistency with how the shared has_mute_touch_switch is handled during registration, let's apply WRITE_ONCE to is_touch_on too. Cc: stable@vger.kernel.org Fixes: ba16e5ffbaa1 ("HID: wacom: Advertise SW_MUTE_DEVICE capability prior to registration") Reviewed-by: Lee Jones Signed-off-by: Ping Cheng Signed-off-by: Jiri Kosina --- drivers/hid/wacom_sys.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers/hid') diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c index 8dc7aa1c0a26..33fa491fba92 100644 --- a/drivers/hid/wacom_sys.c +++ b/drivers/hid/wacom_sys.c @@ -2386,7 +2386,7 @@ static void wacom_set_shared_values(struct wacom_wac *wacom_wac) * match historic default. */ if (wacom_wac->is_soft_touch_switch) - wacom_wac->shared->is_touch_on = true; + WRITE_ONCE(wacom_wac->shared->is_touch_on, true); } if (wacom_wac->features.device_type & WACOM_DEVICETYPE_TOUCH) { -- cgit v1.2.3 From 97ce491bcef2d231b8d51cee8e579183319a5ba4 Mon Sep 17 00:00:00 2001 From: Ping Cheng Date: Wed, 7 Oct 2026 15:03:35 -0700 Subject: HID: wacom: Setup SW_MUTE_DEVICE according to the order of input registration The refactored SW_MUTE_DEVICE code assumed that stylus will be the first regiestered input. In reality, touch can be registered before stylus, such as the Wacom Cintiq Pro 13 and 16. This patch covers both touch-first and stylus-first cases. Cc: stable@vger.kernel.org Fixes: ba16e5ffbaa1 ("HID: wacom: Advertise SW_MUTE_DEVICE capability prior to registration") Reviewed-by: Lee Jones Signed-off-by: Ping Cheng Signed-off-by: Jiri Kosina --- drivers/hid/wacom_wac.c | 33 ++++++++++++++++++++++++++++++--- 1 file changed, 30 insertions(+), 3 deletions(-) (limited to 'drivers/hid') diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c index c4cd87b781c4..cf459c16b39a 100644 --- a/drivers/hid/wacom_wac.c +++ b/drivers/hid/wacom_wac.c @@ -3977,10 +3977,18 @@ int wacom_setup_touch_input_capabilities(struct input_dev *input_dev, if (features->type == HID_GENERIC) { hid_dbg(hdev, "generic touch setup\n"); - if (wacom_wac->has_mute_touch_switch || - (wacom_wac->shared && READ_ONCE(wacom_wac->shared->has_mute_touch_switch))) { + + /* + * This is to setup the touch switch for those devices that report + * pen interface first. The setup can only be done here since this + * routine is only called once. When we are here, the shared + * has_mute_touch_switch has been set by the pad. + + * There are two ways of reporting inputs from firmware: stylus first + * or touch first. This path covers the stylus input first case. + */ + if (wacom_wac->shared && READ_ONCE(wacom_wac->shared->has_mute_touch_switch)) { input_set_capability(input_dev, EV_SW, SW_MUTE_DEVICE); - wacom_wac->has_mute_touch_switch = true; } /* setup has already been done */ return 0; @@ -4403,7 +4411,26 @@ int wacom_setup_pad_input_capabilities(struct input_dev *input_dev, break; case INTUOSHT3_BT: + break; + case HID_GENERIC: + if (wacom_wac->shared) { + /* + * The setup of touch switch capability can only be done + * here for those devices, such as Cintiq Pro 13 and 16, + * that have touch input registered before stylus and pad + * inputs. + * + * There are two ways of reporting inputs from firmware: + * stylus first or touch first. This path covers the touch + * input first case. + */ + if (wacom_wac->has_mute_touch_switch && + wacom_wac->shared->touch_input) { + input_set_capability(wacom_wac->shared->touch_input, + EV_SW, SW_MUTE_DEVICE); + } + } break; default: -- cgit v1.2.3