Re: [PATCH v9 4/5] HID: wacom: Fix Use-After-Free in wacom_bamboo_pad

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Critical] Cross-device Use-After-Free in `wacom_mode_change_work()` due to lockless access to sibling devices without RCU read lock.
--

commit 4b7151c8603346fbd9de5581ed53af8776799547
Author: Lee Jones <lee@kernel.org>

HID: wacom: Fix Use-After-Free in wacom_bamboo_pad

This commit fixes a Use-After-Free in wacom_bamboo_pad_pen_event by introducing
RCU protection for pen and touch pointers. It adds rcu_read_lock() and
rcu_dereference() wrappers to lockless readers, while using rcu_access_pointer
in wacom_mode_change_work() to suppress warnings.

Cc: stable@vger.kernel.org

> diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c
> index 1af0d518260d6..12f6a32cbc5fc 100644
> --- a/drivers/hid/wacom_sys.c
> +++ b/drivers/hid/wacom_sys.c
[ ... ]
> @@ -2833,16 +2844,19 @@ static void wacom_mode_change_work(struct work_struct *work)
>  	bool is_direct = wacom->wacom_wac.is_direct_mode;
>  	int error = 0;
>  
> -	if (shared->pen) {
> -		wacom1 = hid_get_drvdata(shared->pen);
> +	struct hid_device *pen = rcu_access_pointer(shared->pen);
> +	struct hid_device *touch = rcu_access_pointer(shared->touch);
> +
> +	if (pen) {
> +		wacom1 = hid_get_drvdata(pen);

[Severity: Critical]
This is a pre-existing issue, but can this lockless access to sibling devices
result in a cross-device Use-After-Free?

If wacom_mode_change_work() runs on a sibling device (e.g., touch) and reads
shared->pen using rcu_access_pointer() without holding rcu_read_lock():

1. Concurrently, the pen device is physically disconnected or unbound.
2. The pen device's unbind path calls wacom_remove_shared_data(), which
   nullifies shared->pen and calls synchronize_rcu().
3. Because wacom_mode_change_work() does not hold rcu_read_lock(),
   synchronize_rcu() does not block, allowing the pen device's unbind to
   complete.
4. The pen device's struct wacom is freed via devres (devm_kzalloc in probe).
5. wacom_mode_change_work() then proceeds to dereference the freed pointer
   via hid_get_drvdata(pen) and calls wacom_release_resources(wacom1) and
   hid_hw_stop(wacom1->hdev) on it.

While the commit message notes this lockless access is a pre-existing issue,
could this still be triggered during a hot-unplug of a composite device during
a mode change event?

>  		wacom_release_resources(wacom1);
>  		hid_hw_stop(wacom1->hdev);
>  		wacom1->wacom_wac.has_mode_change = true;
>  		wacom1->wacom_wac.is_direct_mode = is_direct;
>  	}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260902134417.1270552-1-lee@kernel.org?part=4