]> git.proxmox.com Git - mirror_ubuntu-focal-kernel.git/commit
HID: wacom: Avoid using stale array indicies to read contact count
authorJason Gerecke <killertofu@gmail.com>
Tue, 18 Jan 2022 22:38:41 +0000 (14:38 -0800)
committerStefan Bader <stefan.bader@canonical.com>
Mon, 7 Mar 2022 15:35:15 +0000 (16:35 +0100)
commitffc27ef37a4a0e521be8895b46371f5201b07f8e
treed9052a50df2bd41cd5dfb14bc3521e4ad1bfeb93
parent71727febef6e30dd05a6a112c894da5a5513379d
HID: wacom: Avoid using stale array indicies to read contact count

BugLink: https://bugs.launchpad.net/bugs/1960566
commit 20f3cf5f860f9f267a6a6e5642d3d0525edb1814 upstream.

If we ever see a touch report with contact count data we initialize
several variables used to read the contact count in the pre-report
phase. These variables are never reset if we process a report which
doesn't contain a contact count, however. This can cause the pre-
report function to trigger a read of arbitrary memory (e.g. NULL
if we're lucky) and potentially crash the driver.

This commit restores resetting of the variables back to default
"none" values that were used prior to the commit mentioned
below.

Link: https://github.com/linuxwacom/input-wacom/issues/276
Fixes: 003f50ab673c (HID: wacom: Update last_slot_field during pre_report phase)
CC: stable@vger.kernel.org
Signed-off-by: Jason Gerecke <jason.gerecke@wacom.com>
Reviewed-by: Ping Cheng <ping.cheng@wacom.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>
drivers/hid/wacom_wac.c