Re: [PATCH] HID: wacom: Prevent NULL dereference in wireless work

[Jason Gerecke]

Sashiko responses notwithstanding (which the rest of the function
would be need to be updated to implement, not *just* this patch):

Reviewed-by: Jason Gerecke <jason.gerecke@xxxxxxxxx>

Jason (she/they)
---
Now instead of four in the eights place /
you’ve got three, ‘Cause you added one  /
(That is to say, eight) to the two,     /
But you can’t take seven from three,    /
So you look at the sixty-fours....


On Fri, Oct 30, 2026 at 10:35 AM Devarjya Purkayastha
<unseentactician27062006@xxxxxxxxx> wrote:
>
> wacom_wireless_work() assumes that the active USB configuration has
> three interfaces and unconditionally accesses interface[1] and
> interface[2].
>
> A malformed configuration with fewer interfaces can therefore cause a
> NULL pointer dereference in the wireless workqueue. Return early unless
> the configuration has at least three interfaces.
>
> Reported-by: Indrath <indrathftw@xxxxxxxxx>
> Signed-off-by: Devarjya Purkayastha <unseentactician27062006@xxxxxxxxx>
> ---
>  drivers/hid/wacom_sys.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c
> index 628372ab818a..dcf2811a5c48 100644
> --- a/drivers/hid/wacom_sys.c
> +++ b/drivers/hid/wacom_sys.c
> @@ -2619,7 +2619,7 @@ static void wacom_wireless_work(struct work_struct *work)
>
>         wacom_destroy_battery(wacom);
>
> -       if (!usbdev)
> +       if (!usbdev || usbdev->config->desc.bNumInterfaces < 3)
>                 return;
>
>         /* Stylus interface */
> --
> 2.53.0
>
>