fix(core/io): Incomplete disabling of haptics
What the developer wrote
Authored by Lukas Bielesch
fix(core/io): Incomplete disabling of haptics
What changed, and why it matters
This commit fixes a bug in the Trezor hardware wallet's vibration motor (haptics) driver for the T3T1 model. Previously, the standard haptic_play() function checked whether haptics were disabled before running, but the custom haptic_play_custom() function did not. The patch adds the same safety checks to haptic_play_custom(), so it now returns early if the driver is not initialized or if haptics are disabled. This is a consistency/bugfix change rather than a critical security patch; the main risk is that a disabled haptic motor could still be activated unexpectedly, which is primarily a user-experience or device-behavior issue rather than a code-execution or asset-theft vulnerability.
Treat as a low-severity bugfix. Include in normal firmware release testing; no urgent security response is warranted based on the diff alone. If haptics are considered a security-relevant indicator (e.g., tactile confirmation of operations), review whether any other haptic entry points can bypass the enabled flag.
Security signals we found
Missing state guard in driver API (haptic_play_custom bypassed disable flag)
Fix aligns two related functions to enforce the same access/control policy
No input sanitization changes beyond existing amplitude clamping
No references to secrets, keys, or cryptographic operations in the diff
Evidence from the diff
In core/embed/io/haptic/drv2625/drv2625.c, haptic_play_custom() was missing the initialization and enabled-state guards that haptic_play() already had. The patch adds: (1) a check that returns false if g_haptic_driver.initialized is false, and (2) a check that returns true if g_haptic_driver.enabled is false. This aligns the custom haptic path with the normal haptic path so that a disabled haptic subsystem cannot be driven via the custom API. No memory corruption, privilege escalation, or cryptographic weakness is evident in the diff.
Changed components
Trezor T3T1 hardware walletcore/embed/io/haptic/drv2625/drv2625.cDRV2625 haptic driverhaptic_play_custom() APIInspect captured patch +10 / −0
diff --git a/core/.changelog.d/5532.fixed b/core/.changelog.d/5532.fixed
new file mode 100644
index 000000000..aba92ac9d
--- /dev/null
+++ b/core/.changelog.d/5532.fixed
@@ -0,0 +1 @@
+[T3T1] Fix incomplete disabling of haptics.
diff --git a/core/embed/io/haptic/drv2625/drv2625.c b/core/embed/io/haptic/drv2625/drv2625.c
index 5546ff3d3..822bde7b7 100644
--- a/core/embed/io/haptic/drv2625/drv2625.c
+++ b/core/embed/io/haptic/drv2625/drv2625.c
@@ -362,6 +362,15 @@ bool haptic_play(haptic_effect_t effect) {
}
bool haptic_play_custom(int8_t amplitude_pct, uint16_t duration_ms) {
+ haptic_driver_t *driver = &g_haptic_driver;
+
+ if (!driver->initialized) {
+ return false;
+ }
+
+ if (!driver->enabled) {
+ return true;
+ }
if (amplitude_pct < 0) {
amplitude_pct = 0;
} else if (amplitude_pct > 100) {
Why this scored 27/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.