kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-20 19:23:40 +00:00
Code Issues Releases Packages Activity
linux/drivers/hid
History
Lee Jones 83bd8a5756 HID: wacom: Fix OOB write in wacom_hid_set_device_mode() 
commit c0a8899e02 upstream.

wacom_hid_set_device_mode() currently assumes that the HID_DG_INPUTMODE
usage is always located in the first field (field[0]) of the feature report.
However, a device can specify HID_DG_INPUTMODE in a different field.

If HID_DG_INPUTMODE is in a field other than the first one and the first
field has a report_count smaller than the usage_index of HID_DG_INPUTMODE,
this leads to an out-of-bounds write to r->field[0]->value.

Fix this by storing the field index of HID_DG_INPUTMODE in 'struct
hid_data' during feature mapping.  In wacom_hid_set_device_mode(), use
this stored field index to access the correct field and add bounds
checks to ensure both the field index and the value index are within
valid ranges before writing.

Cc: stable@vger.kernel.org
Fixes: 5ae6e89f74 ("HID: wacom: implement the finger part of the HID generic handling")
Tested-by: Ping Cheng <ping.cheng@wacom.com>
Reviewed-by: Ping Cheng <ping.cheng@wacom.com>
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2026-06-19 13:33:28 +02:00
..
amd-sfh-hid HID: amd_sfh: Switch to device-managed dmam_alloc_coherent() 2024-10-17 15:11:59 +02:00
i2c-hid HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up 2024-05-02 16:24:50 +02:00
intel-ish-hid HID: intel-ish-hid: Reset enum_devices_done before enumeration 2026-02-11 13:35:29 +01:00
surface-hid HID: surface-hid: Allow driver matching for target ID 1 devices 2021-11-18 19:15:59 +01:00
usbhid HID: usbhid: fix deadlock in hid_post_reset() 2026-06-01 17:35:35 +02:00
hid-a4tech.c HID: a4tech: use A4_2WHEEL_MOUSE_HACK_B8 for A4TECH NB-95 2021-05-05 14:29:13 +02:00
hid-accutouch.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-alps.c HID: alps: fix NULL pointer dereference in alps_raw_event() 2026-06-01 17:35:04 +02:00
hid-apple.c HID: apple: Add 2021 magic keyboard FN key mapping 2024-02-23 08:54:55 +01:00
hid-appleir.c HID: appleir: Fix potential NULL dereference at raw event handle 2025-03-13 12:51:01 +01:00
hid-asus.c HID: asus: do not abort probe when not necessary 2026-06-01 17:35:34 +02:00
hid-aureal.c treewide: Add SPDX license identifier for more missed files 2019-05-21 10:50:45 +02:00
hid-axff.c HID: Fix assumption that devices have inputs 2019-10-03 15:36:40 -04:00
hid-belkin.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-betopff.c HID: betop: check shape of output reports 2023-02-01 08:27:13 +01:00
hid-bigbenff.c hid: bigben_probe(): validate report count 2023-03-10 09:39:31 +01:00
hid-cherry.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-chicony.c HID: check for valid USB device for many HID drivers 2021-12-14 10:57:06 +01:00
hid-cmedia.c HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them 2026-04-18 10:33:08 +02:00
hid-core.c HID: core: clamp report_size in s32ton() to avoid undefined shift 2026-06-01 17:35:04 +02:00
hid-corsair.c HID: check for valid USB device for many HID drivers 2021-12-14 10:57:06 +01:00
hid-cougar.c HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup 2024-09-12 11:07:49 +02:00
hid-cp2112.c hid: cp2112: Fix IRQ shutdown stopping polling for all IRQs on chip 2023-11-20 11:08:23 +01:00
hid-creative-sb0540.c HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them 2026-04-18 10:33:08 +02:00
hid-cypress.c HID: cypress: Support Varmilo Keyboards' media hotkeys 2020-10-23 13:23:44 +02:00
hid-debug.c HID: fix HID device resource race between HID core and debugging support 2023-12-03 07:31:22 +01:00
hid-dr.c HID: Fix assumption that devices have inputs 2019-10-03 15:36:40 -04:00
hid-elan.c HID: elan: Fix potential double free in elan_input_configured 2022-06-09 10:22:47 +02:00
hid-elecom.c HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK 2026-03-04 07:20:06 -05:00
hid-elo.c HID: elo: Revert USB reference counting 2022-03-16 14:23:35 +01:00
hid-emsff.c HID: Fix assumption that devices have inputs 2019-10-03 15:36:40 -04:00
hid-ezkey.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-ft260.c HID: check for valid USB device for many HID drivers 2021-12-14 10:57:06 +01:00
hid-gaff.c HID: Fix assumption that devices have inputs 2019-10-03 15:36:40 -04:00
hid-gembird.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-generic.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-gfrm.c HID: do not call hid_set_drvdata(hdev, NULL) in drivers 2019-08-22 17:11:58 +02:00
hid-glorious.c HID: glorious: fix Glorious Model I HID report 2023-12-20 15:17:40 +01:00
hid-google-hammer.c HID: google: fix unused variable warning under !CONFIG_ACPI 2025-03-13 12:51:04 +01:00
hid-gt683r.c HID: gt683r: add missing MODULE_DEVICE_TABLE 2021-05-27 15:40:34 +02:00
hid-gyration.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-holtek-kbd.c HID: holtek: fix slab-out-of-bounds Write in holtek_kbd_input_event 2023-10-25 11:59:00 +02:00
hid-holtek-mouse.c HID: holtek: fix mouse probing 2021-12-29 12:28:37 +01:00
hid-holtekff.c HID: Fix assumption that devices have inputs 2019-10-03 15:36:40 -04:00
hid-hyperv.c HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() 2025-06-27 11:05:34 +01:00
hid-icade.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-ids.h HID: quirks: add HID_QUIRK_ALWAYS_POLL for 8BitDo Pro 3 2026-06-01 17:35:01 +02:00
hid-input.c HID: input: map HID_GD_Z to ABS_DISTANCE for stylus/pen 2026-01-19 13:09:45 +01:00
hid-ite.c HID: ite: Enable QUIRK_TOUCHPAD_ON_OFF_REPORT on Acer Aspire Switch V 10 2022-12-14 11:37:21 +01:00
hid-jabra.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-kensington.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-keytouch.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-kye.c HID: hid-kye: Fix incorrect function name for kye_tablet_enable() 2021-04-07 18:46:20 +02:00
hid-lcpower.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-led.c HID: hid-led: fix maximum brightness for Dream Cheeky 2022-06-09 10:22:47 +02:00
hid-lenovo.c HID: lenovo: Add support for ThinkPad X1 Tablet Thin Keyboard Gen2 2025-07-17 18:30:54 +02:00
hid-lg-g15.c HID: lg-g15 + ite: Add MODULE_AUTHOR 2021-05-05 14:39:24 +02:00
hid-lg.c HID: check for valid USB device for many HID drivers 2021-12-14 10:57:06 +01:00
hid-lg.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
hid-lg2ff.c HID: Fix assumption that devices have inputs 2019-10-03 15:36:40 -04:00
hid-lg3ff.c HID: Fix assumption that devices have inputs 2019-10-03 15:36:40 -04:00
hid-lg4ff.c HID: hid-lg4ff: Add check for empty lbuf 2022-12-14 11:37:21 +01:00
hid-lg4ff.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
hid-lgff.c HID: Fix assumption that devices have inputs 2019-10-03 15:36:40 -04:00
hid-logitech-dj.c HID: logitech-dj: Remove duplicate error logging 2026-01-19 13:10:00 +01:00
hid-logitech-hidpp.c HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() 2026-03-04 07:20:26 -05:00
hid-macally.c HID: macally: Constify macally_id_table 2020-08-17 11:38:49 +02:00
hid-magicmouse.c HID: magicmouse: avoid memory leak in magicmouse_report_fixup() 2026-04-18 10:33:23 +02:00
hid-maltron.c Support for Maltron L90 keyboard media keys 2019-01-14 20:11:01 +01:00
hid-mcp2221.c HID: mcp2221: cancel last I2C command on read error 2026-04-18 10:33:23 +02:00
hid-mf.c HID: mf: add support for 0079:1846 Mayflash/Dragonrise USB Gamecube Adapter 2020-11-25 14:30:33 +01:00
hid-microsoft.c HID: microsoft: Add rumble support to latest xbox controllers 2024-09-04 13:23:36 +02:00
hid-monterey.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-multitouch.c HID: multitouch: Check to ensure report responses match the request 2026-04-18 10:33:29 +02:00
hid-nti.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-ntrig.c HID: hid-ntrig: Prevent memory leak in ntrig_report_version() 2025-12-07 06:09:29 +09:00
hid-ortek.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-penmount.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-petalynx.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-picolcd.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 265 2019-06-05 17:30:28 +02:00
hid-picolcd_backlight.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 265 2019-06-05 17:30:28 +02:00
hid-picolcd_cir.c media: rc: harmonize infrared durations to microseconds 2020-09-03 16:18:55 +02:00
hid-picolcd_core.c HID: hid-picolcd_core: Remove unused variable 'ret' 2021-04-07 18:46:20 +02:00
hid-picolcd_debugfs.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 265 2019-06-05 17:30:28 +02:00
hid-picolcd_fb.c fbdev: Rename pagelist to pagereflist for deferred I/O 2024-02-23 08:55:13 +01:00
hid-picolcd_lcd.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 265 2019-06-05 17:30:28 +02:00
hid-picolcd_leds.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 265 2019-06-05 17:30:28 +02:00
hid-pl.c HID: hid-pl: handle probe errors 2026-03-04 07:20:26 -05:00
hid-plantronics.c HID: hid-plantronics: Add mic mute mapping and generalize quirks 2025-04-10 14:31:55 +02:00
hid-playstation.c HID: playstation: Add missing check for input_ff_create_memless 2026-03-04 07:19:32 -05:00
hid-primax.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 282 2019-06-05 17:36:37 +02:00
hid-prodikeys.c HID: prodikeys: Check presence of pm->input_ep82 2026-03-04 07:20:26 -05:00
hid-quirks.c HID: quirks: really enable the intended work around for appledisplay 2026-06-01 17:35:50 +02:00
hid-redragon.c HID: redragon: fix num lock and caps lock LEDs 2018-06-25 15:23:40 +02:00
hid-retrode.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-rmi.c Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input 2020-10-23 16:16:31 -07:00
hid-roccat-arvo.c HID: check for valid USB device for many HID drivers 2021-12-14 10:57:06 +01:00
hid-roccat-arvo.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-roccat-common.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-roccat-common.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-roccat-isku.c HID: check for valid USB device for many HID drivers 2021-12-14 10:57:06 +01:00
hid-roccat-isku.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-roccat-kone.c HID: check for valid USB device for many HID drivers 2021-12-14 10:57:06 +01:00
hid-roccat-kone.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-roccat-koneplus.c HID: check for valid USB device for many HID drivers 2021-12-14 10:57:06 +01:00
hid-roccat-koneplus.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-roccat-konepure.c HID: check for valid USB device for many HID drivers 2021-12-14 10:57:06 +01:00
hid-roccat-kovaplus.c HID: check for valid USB device for many HID drivers 2021-12-14 10:57:06 +01:00
hid-roccat-kovaplus.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-roccat-lua.c HID: check for valid USB device for many HID drivers 2021-12-14 10:57:06 +01:00
hid-roccat-lua.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-roccat-pyra.c HID: check for valid USB device for many HID drivers 2021-12-14 10:57:06 +01:00
hid-roccat-pyra.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-roccat-ryos.c HID: check for valid USB device for many HID drivers 2021-12-14 10:57:06 +01:00
hid-roccat-savu.c HID: check for valid USB device for many HID drivers 2021-12-14 10:57:06 +01:00
hid-roccat-savu.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-roccat.c HID: roccat: fix use-after-free in roccat_report_event 2026-06-01 17:35:01 +02:00
hid-saitek.c HID: saitek: add madcatz variant of MMO7 mouse device ID 2022-11-10 18:15:34 +01:00
hid-samsung.c HID: check for valid USB device for many HID drivers 2021-12-14 10:57:06 +01:00
hid-semitek.c HID: semitek: new driver for GK6X series keyboards 2021-05-05 14:21:08 +02:00
hid-sensor-custom.c HID: hid-sensor-custom: set fixed size for custom attributes 2022-12-31 13:14:11 +01:00
hid-sensor-hub.c HID: hid-sensor-hub: don't use stale platform-data on remove 2025-03-13 12:50:26 +01:00
hid-sjoy.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 156 2019-05-30 11:26:35 -07:00
hid-sony.c HID: sony: remove duplicate NULL check before calling usb_free_urb() 2023-10-10 21:59:08 +02:00
hid-speedlink.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-steam.c HID: steam: Prevent NULL pointer dereference in steam_{recv,send}_report 2022-09-05 10:30:06 +02:00
hid-steelseries.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-sunplus.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-thrustmaster.c HID: thrustmaster: Add sparco wheel and fix array length 2022-09-05 10:30:08 +02:00
hid-tivo.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-tmff.c HID: Fix assumption that devices have inputs 2019-10-03 15:36:40 -04:00
hid-topseed.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-twinhan.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 178 2019-05-30 11:29:19 -07:00
hid-u2fzero.c HID: add hid_is_usb() function to make it simpler for USB detection 2021-12-14 10:57:05 +01:00
hid-uclogic-core.c HID: uclogic: Add NULL check in uclogic_input_configured() 2026-02-06 16:42:05 +01:00
hid-uclogic-params.c HID: hid-uclogic-params: Invalid parameter check in uclogic_params_frame_init_v1_buttonpad 2022-01-27 11:03:55 +01:00
hid-uclogic-params.h HID: uclogic: Support Gray-coded rotary encoders 2019-02-21 12:00:54 +01:00
hid-uclogic-rdesc.c HID: hid-uclogic-rdesc: Kernel-doc is for functions and structs 2021-04-07 18:46:20 +02:00
hid-uclogic-rdesc.h HID: uclogic: Add support for Ugee G5 2019-02-21 12:00:54 +01:00
hid-udraw-ps3.c HID: udraw-ps3: Replace HTTP links with HTTPS ones 2020-07-20 12:24:41 +02:00
hid-viewsonic.c HID: viewsonic: Support PD1011 signature pad 2019-02-21 12:00:53 +01:00
hid-vivaldi.c HID: vivaldi: fix sysfs attributes leak 2022-03-16 14:23:35 +01:00
hid-waltop.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-wiimote-core.c HID: wiimote: remove h from printk format specifier 2021-01-07 10:14:58 +01:00
hid-wiimote-debug.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-wiimote-modules.c HID: Wiimote: Treat the d-pad as an analogue stick 2020-06-19 14:17:22 +02:00
hid-wiimote.h HID: Wiimote: Treat the d-pad as an analogue stick 2020-06-19 14:17:22 +02:00
hid-xinmo.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
hid-zpff.c HID: Fix assumption that devices have inputs 2019-10-03 15:36:40 -04:00
hid-zydacron.c HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them 2026-04-18 10:33:08 +02:00
hidraw.c HID: hidraw: fix memory leak in hidraw_release() 2022-09-05 10:30:07 +02:00
Kconfig HID: elecom: Add support for ELECOM HUGE Plus M-HT1MRBK 2026-03-04 07:20:06 -05:00
Makefile HID: remove superfluous (and wrong) Makefile entry for CONFIG_INTEL_ISH_FIRMWARE_DOWNLOADER 2025-04-10 14:31:58 +02:00
uhid.c HID: uhid: Use READ_ONCE()/WRITE_ONCE() for ->running 2024-04-10 16:19:42 +02:00
wacom.h HID: wacom: remove the battery when the EKR is off 2023-09-06 21:28:38 +01:00
wacom_sys.c HID: wacom: Fix OOB write in wacom_hid_set_device_mode() 2026-06-19 13:33:28 +02:00
wacom_wac.c HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq 2026-04-18 10:33:29 +02:00
wacom_wac.h HID: wacom: Fix OOB write in wacom_hid_set_device_mode() 2026-06-19 13:33:28 +02:00