Re: [PATCH 1/1] HID: wacom: Fix OOB write in wacom_hid_set_device_mode()

[Lee Jones <lee@kernel.org>]

On Thu, 21 May 2026, Benjamin Tissoires wrote:

> On May 19 2026, Lee Jones wrote:
> > On Wed, 13 May 2026, Ping Cheng wrote:
> > 
> > > On Wed, May 13, 2026 at 1:05 AM Lee Jones <lee@kernel.org> wrote:
> > > >
> > > > wacom_hid_set_device_mode() currently assumes that the HID_DG_INPUTMODE
> > > > usage is always located in the first field (field[0]) of the feature report.
> > > > However, a device can specify HID_DG_INPUTMODE in a different field.
> > > >
> > > > If HID_DG_INPUTMODE is in a field other than the first one and the first
> > > > field has a report_count smaller than the usage_index of HID_DG_INPUTMODE,
> > > > this leads to an out-of-bounds write to r->field[0]->value.
> > > >
> > > > Fix this by storing the field index of HID_DG_INPUTMODE in 'struct
> > > > hid_data' during feature mapping.  In wacom_hid_set_device_mode(), use
> > > > this stored field index to access the correct field and add bounds
> > > > checks to ensure both the field index and the value index are within
> > > > valid ranges before writing.
> > > >
> > > > Cc: stable@vger.kernel.org
> > > > Fixes: 5ae6e89f7409 ("HID: wacom: implement the finger part of the HID generic handling")
> > > > Signed-off-by: Lee Jones <lee@kernel.org>
> > > 
> > > Patch looks sensible to me. Thank you for your effort, Lee!
> > > 
> > > Tested-by: Ping Cheng <ping.cheng@wacom.com>
> > > Reviewed-by: Ping Cheng <ping.cheng@wacom.com>
> > 
> > Thank you Ping, I appreciate your review.
> > 
> > HID folks - any movement on this please?
> > 
> 
> I wanted to apply it today, but the patch conflicts with our current
> for-7.1/upstream-fixes.
> 
> Could you rebase on top of this branch so we can take this without me
> messing with your patch?

Sure.  Leave it with me.  Probably be early next week.

-- 
Lee Jones