[PATCH] HID: wacom: reject short input reports

[PATCH] HID: wacom: reject short input reports

[Jiale Yao]

wacom_raw_event() passes incoming reports to the pen serial extractor and
the device-specific IRQ parsers before the HID core validates the declared
report length. A short report can therefore make either consumer read past
the valid input data.

Require the complete report described by the HID report descriptor before
invoking either parser.

Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/hid/wacom_sys.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c
index 40770affdbde..85e966e80012 100644
--- a/drivers/hid/wacom_sys.c
+++ b/drivers/hid/wacom_sys.c
@@ -175,6 +175,9 @@ static int wacom_raw_event(struct hid_device *hdev, struct hid_report *report,
 	if (wacom->wacom_wac.features.type == BOOTLOADER)
 		return 0;
 
+	if (size < hid_report_len(report))
+		return 0;
+
 	if (wacom_wac_pen_serial_enforce(hdev, report, raw_data, size))
 		return -1;
 
-- 
2.34.1

Re:[PATCH] HID: wacom: reject short input reports

[jiale yao]

At 2026-10-17 14:19:19, "Jiale Yao" <yaojiale02@163.com> wrote:
>wacom_raw_event() passes incoming reports to the pen serial extractor and
>the device-specific IRQ parsers before the HID core validates the declared
>report length. A short report can therefore make either consumer read past
>the valid input data.
>
>Require the complete report described by the HID report descriptor before
>invoking either parser.
>

Fixes: 29b4739134c7 ("Input: wacom - switch from an USB driver to a HID driver")
Fixes: 83417206427b ("HID: wacom: Queue events with missing type/serial data for later processing")

>Signed-off-by: Jiale Yao <yaojiale02@163.com>
>---
> drivers/hid/wacom_sys.c | 3 +++
> 1 file changed, 3 insertions(+)
>
>diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c
>index 40770affdbde..85e966e80012 100644
>--- a/drivers/hid/wacom_sys.c
>+++ b/drivers/hid/wacom_sys.c
>@@ -175,6 +175,9 @@ static int wacom_raw_event(struct hid_device *hdev, struct hid_report *report,
> 	if (wacom->wacom_wac.features.type == BOOTLOADER)
> 		return 0;
> 
>+	if (size < hid_report_len(report))
>+		return 0;
>+
> 	if (wacom_wac_pen_serial_enforce(hdev, report, raw_data, size))
> 		return -1;
> 
>-- 
>2.34.1