wacom_intuos_bt_irq() dereferences wacom->pen_input in every switch branch, both directly for dev_warn/dev_dbg and indirectly through wacom_intuos_bt_process_data() which calls input_sync(pen_input). pad_input is also used in wacom_intuos_bt_process_data(). Both can be NULL when the corresponding setup_*_input_capabilities() returns -ENODEV during a successful probe. For INTUOS4WL, pen and pad are always expected together, so guard both at function entry. Fixes: 2a6cdbdd4cc0 ("HID: wacom: Introduce new 'touch_input' device") Signed-off-by: Jinmo Yang Co-Authored-By: Claude Opus 4.6 --- drivers/hid/wacom_wac.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c index 65829de86363..e0bf03123cf9 100644 --- a/drivers/hid/wacom_wac.c +++ b/drivers/hid/wacom_wac.c @@ -1263,6 +1263,13 @@ static int wacom_intuos_bt_irq(struct wacom_wac *wacom, size_t len) int i = 1; unsigned power_raw, battery_capacity, bat_charging, ps_connected; + if (!wacom->pen_input || !wacom->pad_input) { + dev_warn_once(&container_of(wacom, struct wacom, wacom_wac)->hdev->dev, + "%s: expected pen and pad input devices\n", + __func__); + return 0; + } + switch (data[0]) { case 0x04: if (len < 32) { -- 2.53.0