Re: [PATCH 1/1] HID: wacom: Fix multiple Use-After-Free issues in shared state

[Dmitry Torokhov <dmitry.torokhov@gmail.com>]

Hi Lee,

On Wed, May 27, 2026 at 03:07:30PM +0100, Lee Jones wrote:
> The Wacom driver coordinates state between sibling interfaces of the same
> physical device (like Pen, Touch, Pad) using a shared structure
> 'wacom_shared' inside 'wacom_hdev_data'.  The driver kept a volatile
> representative pointer 'data->dev' pointing to a sibling 'hid_device'
> for physical path comparisons during sibling matching.
> 
> This pointer management is fragile.  When the representative device is
> disconnected, wacom_remove_shared_data() failed to clear/update
> 'data->dev' or wacom_wac->shared->touch_input, leading to two Use-After-Free
> vulnerabilities:
> 
>   1. dangling 'touch_input' dereferenced during touch switch sync.
>   2. dangling 'data->dev' dereferenced during subsequent sibling probes.
> 
> Instead of adding complex pointer handover logic to keep 'data->dev'
> updated (which has logic gaps with Pad siblings and introduces race
> conditions), completely eliminate 'data->dev' pointer.
> 
> Redesign 'wacom_hdev_data' to store stable static copies of the required
> representative attributes when it is first allocated:
> 
>   - Copy 'phys' path string (stored in data->phys) for stable path comparison.
>   - Copy 'vendor' and 'product' IDs.

This I think makes sense.

>   - Copy and accumulate 'device_type' capabilities as siblings are probed.

This (accumulation) I unconvinced is safe. In any case I think it should
be a separate patch as it may change the behavior.

> 
> Also explicitly clear 'touch_input = NULL' in wacom_remove_shared_data()
> under wacom_udev_list_lock to safely avoid the touch_input UAF.

The fix is incomplete and should be split out. It is not enough to take
the lock, you need to make sure you are not racing with URB/IRQ
handling. Maybe RCU can help here.

> 
> This resolves all vulnerabilities permanently at the design level without
> complex pointer lifecycles or race-prone swaps on device removal.
> 
> Fixes: 471d17148c8b ("Input: wacom - move the USB (now hid) Wacom driver in drivers/hid")

This is not the commit that introduced this behavior IIRC.

Thanks.

-- 
Dmitry