Re: [PATCH 1/5] HID: wacom: Use hdev->product in wacom_setup_touch_input_capabilities

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing cleanup of workqueues and timers in the probe error path leads to a Use-After-Free vulnerability.
--

commit 84f0c894069529e6d333664a987e925e1ef88eb8
Author: Lee Jones <lee@kernel.org>

HID: wacom: Use hdev->product in wacom_setup_touch_input_capabilities

This commit simplifies wacom_setup_touch_input_capabilities() by replacing
lookups of wacom_wac->shared->touch->product with direct access to
hdev->product. It retrieves the hdev pointer using container_of() on the
provided wacom_wac.

> diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
> index a29bf051ada7c..4436faf2d2bbd 100644
> --- a/drivers/hid/wacom_wac.c
> +++ b/drivers/hid/wacom_wac.c
[ ... ]

While reviewing this patch, I noticed a pre-existing issue in
wacom_parse_and_register() located in drivers/hid/wacom_sys.c:

drivers/hid/wacom_sys.c:wacom_parse_and_register() {
    ...
	if (features->device_type & WACOM_DEVICETYPE_WL_MONITOR) {
		error = hid_hw_open(hdev);
		if (error) {
			hid_err(hdev, "hw open failed\n");
			goto fail_hw_stop;
		}
	}
    ...
fail_hw_stop:
	hid_hw_stop(hdev);
fail:
	wacom_release_resources(wacom);
	return error;
}

[Severity: High]
This isn't a regression introduced by this patch, but is a pre-existing
issue. Does this error path fail to cancel asynchronously scheduled works?

In wacom_probe(), the wacom structure is allocated via devm_kzalloc().
During wacom_parse_and_register(), hid_hw_start() is called which enables
hardware interrupts that can schedule async works (e.g., battery_work).
Additionally, wacom_query_tablet_data() explicitly schedules init_work.

If a subsequent initialization step fails (like hid_hw_open() above), the
function jumps to fail_hw_stop and returns an error without cancelling the
pending works.

Since wacom_probe() then returns this error, causing the devres cleanup to
free the wacom structure, could these pending works later execute and
access the freed memory?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260825151242.576456-1-lee@kernel.org?part=1