kernel/linux.git/drivers/hid/hid-letsketch.c, branch v6.6.148

HID: letsketch: fix UAF on inrange_timer at driver unbind

2026-07-24T14:02:48+00:00

commit 46c8beeccd8ab2c863827254a85ea877654a3534 upstream. letsketch_driver does not provide a .remove callback, but letsketch_probe() arms a per-device timer: timer_setup(&data->inrange_timer, letsketch_inrange_timeout, 0); The timer is re-armed from letsketch_raw_event() with a 100 ms timeout on every pen-in-range report, and its callback dereferences data->input_tablet to deliver a synthetic BTN_TOOL_PEN release. letsketch_data is allocated with devm_kzalloc(), and its input_dev fields are devm-allocated via letsketch_setup_input_tablet(). On device unbind (USB unplug or rmmod), the HID core runs its default teardown and devm cleanup frees both letsketch_data and the input devices. Because no .remove callback exists, nothing drains the timer first: if raw_event armed it within ~100 ms of the unbind, the pending timer fires on freed memory. This is a UAF read of data and of data->input_tablet, followed by input_report_key() / input_sync() into the freed input_dev. The same problem can occur on the probe error path: if hid_hw_start() enabled I/O on an always-poll-quirk device and then failed, raw_event may have armed the timer before devm releases data. Fix by adding a .remove callback that calls hid_hw_stop() first. hid_hw_stop() synchronously kills the URBs that deliver raw_event(), so once it returns no path can re-arm the timer. timer_shutdown_sync() then drains any in-flight callback and permanently disables further mod_timer() calls. Apply the same timer_shutdown_sync() in the probe error path so the timer is guaranteed not to outlive data. Fixes: 33a5c2793451 ("HID: Add new Letsketch tablet driver") Cc: stable@vger.kernel.org Signed-off-by: Manish Khadka Signed-off-by: Jiri Kosina Signed-off-by: Greg Kroah-Hartman

HID: letsketch: Use hid_is_usb()

2023-01-17T12:44:01+00:00

Don't open code existing functionality. Signed-off-by: Thomas Weißschuh Reviewed-by: David Rheinsberg Reviewed-by: Hans de Goede Signed-off-by: Jiri Kosina

HID: Add new Letsketch tablet driver

2022-01-06T13:22:51+00:00

Add a new driver for the LetSketch / VSON WP9620N drawing tablet. This drawing tablet is also sold under other brand names such as Case U, presumably this driver will work for all of them. But it has only been tested with a LetSketch WP9620N model. These tablets also work without a special HID driver, but then only part of the active area works and both the pad and stylus buttons are hardwired to special key-combos. E.g. the 2 stylus buttons send right mouse clicks / resp. "e" key presses. BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=2005575 BugLink: https://github.com/DIGImend/digimend-kernel-drivers/issues/528 Signed-off-by: Hans de Goede Signed-off-by: Jiri Kosina