[PATCH] HID: wacom: reject short input reports

[PATCH] HID: wacom: reject short input reports

[Jiale Yao]

wacom_raw_event() passes incoming reports to the pen serial extractor and
the device-specific IRQ parsers before the HID core validates the declared
report length. A short report can therefore make either consumer read past
the valid input data.

Require the complete report described by the HID report descriptor before
invoking either parser.

Signed-off-by: Jiale Yao <yaojiale02@163.com>
---
 drivers/hid/wacom_sys.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c
index 40770affdbde..85e966e80012 100644
--- a/drivers/hid/wacom_sys.c
+++ b/drivers/hid/wacom_sys.c
@@ -175,6 +175,9 @@ static int wacom_raw_event(struct hid_device *hdev, struct hid_report *report,
 	if (wacom->wacom_wac.features.type == BOOTLOADER)
 		return 0;
 
+	if (size < hid_report_len(report))
+		return 0;
+
 	if (wacom_wac_pen_serial_enforce(hdev, report, raw_data, size))
 		return -1;
 
-- 
2.34.1

Re:[PATCH] HID: wacom: reject short input reports

[jiale yao]

At 2026-10-17 14:19:19, "Jiale Yao" <yaojiale02@163.com> wrote:
>wacom_raw_event() passes incoming reports to the pen serial extractor and
>the device-specific IRQ parsers before the HID core validates the declared
>report length. A short report can therefore make either consumer read past
>the valid input data.
>
>Require the complete report described by the HID report descriptor before
>invoking either parser.
>

Fixes: 29b4739134c7 ("Input: wacom - switch from an USB driver to a HID driver")
Fixes: 83417206427b ("HID: wacom: Queue events with missing type/serial data for later processing")

>Signed-off-by: Jiale Yao <yaojiale02@163.com>
>---
> drivers/hid/wacom_sys.c | 3 +++
> 1 file changed, 3 insertions(+)
>
>diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c
>index 40770affdbde..85e966e80012 100644
>--- a/drivers/hid/wacom_sys.c
>+++ b/drivers/hid/wacom_sys.c
>@@ -175,6 +175,9 @@ static int wacom_raw_event(struct hid_device *hdev, struct hid_report *report,
> 	if (wacom->wacom_wac.features.type == BOOTLOADER)
> 		return 0;
> 
>+	if (size < hid_report_len(report))
>+		return 0;
>+
> 	if (wacom_wac_pen_serial_enforce(hdev, report, raw_data, size))
> 		return -1;
> 
>-- 
>2.34.1

Re: [PATCH] HID: wacom: reject short input reports

[Jason Gerecke]

On Sat, Oct 17, 2026 at 12:38 AM jiale yao <19888972804@163.com> wrote:
>
> At 2026-10-17 14:19:19, "Jiale Yao" <yaojiale02@163.com> wrote:
> >wacom_raw_event() passes incoming reports to the pen serial extractor and
> >the device-specific IRQ parsers before the HID core validates the declared
> >report length. A short report can therefore make either consumer read past
> >the valid input data.
> >
> >Require the complete report described by the HID report descriptor before
> >invoking either parser.
> >
>
> Fixes: 29b4739134c7 ("Input: wacom - switch from an USB driver to a HID driver")
> Fixes: 83417206427b ("HID: wacom: Queue events with missing type/serial data for later processing")
>
> >Signed-off-by: Jiale Yao <yaojiale02@163.com>
> >---
> > drivers/hid/wacom_sys.c | 3 +++
> > 1 file changed, 3 insertions(+)
> >
> >diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c
> >index 40770affdbde..85e966e80012 100644
> >--- a/drivers/hid/wacom_sys.c
> >+++ b/drivers/hid/wacom_sys.c
> >@@ -175,6 +175,9 @@ static int wacom_raw_event(struct hid_device *hdev, struct hid_report *report,
> >       if (wacom->wacom_wac.features.type == BOOTLOADER)
> >               return 0;
> >
> >+      if (size < hid_report_len(report))
> >+              return 0;
> >+

This seems reasonable enough. The hid-core.c:hid_report_raw_event
extends the short reports with zeroes and then processes the result,
but that's not safe to do here without making our own copy of raw_data
(because we don't know how large the underlying buffer actually is).
But copying seems like overkill since I doubt that our hardware
produces such short events (based on the lack of reported irq function
misbehaviors). Returning early seems like a perfectly reasonable
reaction if this ever occurs (e.g. by mocked-up uhid devices or usb
gadgets).

I'm slightly hesitant to give a full reviewed-by given that this is
just an assumption (and one that we can't reasonably test given how
many different kinds of devices might be impacted), but I'm happy to
ack the patch.

Acked-by: Jason Gerecke <jason.gerecke@wacom.com>

Jason (she/they)
---
Now instead of four in the eights place /
you’ve got three, ‘Cause you added one  /
(That is to say, eight) to the two,     /
But you can’t take seven from three,    /
So you look at the sixty-fours....

> >       if (wacom_wac_pen_serial_enforce(hdev, report, raw_data, size))
> >               return -1;
> >
> >--
> >2.34.1