Re: [PATCH v7 1/4] HID: wacom: Advertise SW_MUTE_DEVICE capability prior to registration

Thank you for your contribution! Sashiko AI review found 1 potential issue(=
s) to consider:

Pre-existing issues:
- [Critical] Use-After-Free in wacom_wac_pad_event due to dangling shared->=
touch_input pointer.
--

--- Patch [1]: [PATCH v7 1/4] HID: wacom: Advertise SW_MUTE_DEVICE capabili=
ty prior to registration ---
commit c2b94041c1337efa1a4a2cba0f9ae1c4dd7c4773
Author: Lee Jones <[email protected]>

HID: wacom: Advertise SW_MUTE_DEVICE capability prior to registration

This commit moves the advertisement of the SW_MUTE_DEVICE capability to occ=
ur
before input device registration to comply with input subsystem guidelines.=
 It
also modifies composite USB generic touch devices to advertise the mute
capability by default.

> diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c
> index 0eafa483b7f75..92b73ed0028f1 100644
> --- a/drivers/hid/wacom_sys.c
> +++ b/drivers/hid/wacom_sys.c
> @@ -2359,12 +2359,6 @@ static void wacom_set_shared_values(struct wacom_w=
ac *wacom_wac)
>  			wacom_wac->shared->is_touch_on =3D true;
>  	}
> =20
> -	if (wacom_wac->shared->has_mute_touch_switch &&
> -	    wacom_wac->shared->touch_input) {
> -		set_bit(EV_SW, wacom_wac->shared->touch_input->evbit);
> -		input_set_capability(wacom_wac->shared->touch_input, EV_SW,
> -				     SW_MUTE_DEVICE);
> -	}
>  }

[Severity: Critical]
This is a pre-existing issue and was not introduced by this patch, but while
reviewing the shared touch input changes, I noticed a potential use-after-f=
ree
with wacom_wac->shared->touch_input.

In wacom_remove_shared_data(), when the touch interface unbinds, the devres
cleanup routine clears the shared->touch pointer but leaves
shared->touch_input dangling:

drivers/hid/wacom_sys.c:wacom_remove_shared_data() {
    ...
		if (wacom_wac->shared->touch =3D=3D wacom->hdev)
			wacom_wac->shared->touch =3D NULL;
		else if (wacom_wac->shared->pen =3D=3D wacom->hdev)
			wacom_wac->shared->pen =3D NULL;
    ...
}

If the pad interface remains bound and a user triggers a touch mute event,
could wacom_wac_pad_event() access this freed input_dev?

drivers/hid/wacom_wac.c:wacom_wac_pad_event() {
    ...
	if ((equivalent_usage =3D=3D WACOM_HID_WD_MUTE_DEVICE) ||
	   (equivalent_usage =3D=3D WACOM_HID_WD_TOUCHONOFF)) {
		if (wacom_wac->shared->touch_input) {
			...
			input_report_switch(wacom_wac->shared->touch_input,
					    SW_MUTE_DEVICE, !(*is_touch_on));
			input_sync(wacom_wac->shared->touch_input);
		}
		return;
	}
    ...
}

Should wacom_remove_shared_data() also set shared->touch_input to NULL when
clearing shared->touch?

--=20
Sashiko AI review =C2=B7 https://sashiko.dev/#/patchset/20260804103209.1496=
[email protected]?part=3D1