Re: [PATCH] HID: hid-steam: fix uninit-value access in steam_get_serial

[Pei Xiao]

在 2026/8/4 09:05, Vicki Pfau 写道:
> Hi Pei,
> 
> On 8/3/26 5:58 PM, Pei Xiao wrote:
>>
>>
>> 在 2026/8/4 04:39, Vicki Pfau 写道:
>>> Hi Jiri,
>>>
>>> On 8/3/26 12:34 PM, Jiri Kosina wrote:
>>>> CCing Vicki Pfau here ... could you please give your Ack to this fix?
>>>
>>> This was already fixed in 9f8ee99f831b2711624ef81d0abba1d183f28b09 in the series I submitted earlier. I didn't realize there was an open bug report for it.
>> Hi maintainer and Vicki,
>> I took a look at this commit. In fact, my patch was nearly two months
>> earlier than this commit. I had originally thought that this one-line
>> patch, especially for an error-path case, had been ignored by the
>> maintainer.
> 
> Yes, sorry, I wasn't marked as maintainer at the time and didn't notice it before I wrote my equivalent patch. Jiri just happened to merge mine first.
> 
It's okay.
> Vicki
> 
>>
>> thanks！
>> Pei.
>>>
>>>>
>>>> Thanks.
>>>>
>>>> On Wed, 10 Jun 2026, Pei Xiao wrote:
>>>>
>>>>> The reply buffer in steam_get_serial() is allocated on the stack without
>>>>> initialization. In cases where steam_recv_report() returns a short read or
>>>>> an error, not all bytes of the buffer are written, leading to subsequent
>>>>> access of uninitialized memory when checking reply[0], reply[1], reply[2].
>>>>>
>>>>> Zero-initialize the reply array to prevent KMSAN uninit-value warnings.
>>>>>
>>>>> Logs:
>>>>> hid-steam 0003:28DE:1102.0007: unknown main item tag 0x0
>>>>> hid-steam 0003:28DE:1102.0007: unknown main item tag 0x0
>>>>> hid-steam 0003:28DE:1102.0007: :
>>>>> USB HID v7f.fd Device [HID 28de:1102] on usb-dummy_hcd.1-1/input0
>>>>> =====================================================
>>>>> BUG: KMSAN: uninit-value in steam_get_serial drivers/hid/hid-steam.c:457 [inline]
>>>>> BUG: KMSAN: uninit-value in steam_register+0xd83/0x10e0 drivers/hid/hid-steam.c:965
>>>>>  steam_get_serial drivers/hid/hid-steam.c:457 [inline]
>>>>>  steam_register+0xd83/0x10e0 drivers/hid/hid-steam.c:965
>>>>>  steam_probe+0x6f1/0x19b0 drivers/hid/hid-steam.c:1273
>>>>>  __hid_device_probe drivers/hid/hid-core.c:2822 [inline]
>>>>>  hid_device_probe+0x60d/0xb90 drivers/hid/hid-core.c:2859
>>>>>  call_driver_probe drivers/base/dd.c:-1 [inline]
>>>>>  really_probe+0x4d5/0xe40 drivers/base/dd.c:709
>>>>>  ...
>>>>>
>>>>> Local variable reply.i created at:
>>>>>  steam_get_serial drivers/hid/hid-steam.c:448 [inline]
>>>>>  steam_register+0x180/0x10e0 drivers/hid/hid-steam.c:965
>>>>>  steam_probe+0x6f1/0x19b0 drivers/hid/hid-steam.c:1273
>>>>>
>>>>> Reported-by: syzbot+75f3f9bff8c510602d36@xxxxxxxxxxxxxxxxxxxxxxxxx
>>>>> Closes: https://lore.kernel.org/lkml/6a27d055.39669fcc.33b062.008d.GAE@xxxxxxxxxx/
>>>>> Fixes: c164d6abf384 ("HID: add driver for Valve Steam Controller")
>>>>> Signed-off-by: Pei Xiao <xiaopei01@xxxxxxxxxx>
>>>>
>>>>
>>>>
>>>>> ---
>>>>>  drivers/hid/hid-steam.c | 2 +-
>>>>>  1 file changed, 1 insertion(+), 1 deletion(-)
>>>>>
>>>>> diff --git a/drivers/hid/hid-steam.c b/drivers/hid/hid-steam.c
>>>>> index 197126d6e081..f65ad1a21c01 100644
>>>>> --- a/drivers/hid/hid-steam.c
>>>>> +++ b/drivers/hid/hid-steam.c
>>>>> @@ -445,7 +445,7 @@ static int steam_get_serial(struct steam_device *steam)
>>>>>  	 */
>>>>>  	int ret = 0;
>>>>>  	u8 cmd[] = {ID_GET_STRING_ATTRIBUTE, sizeof(steam->serial_no), ATTRIB_STR_UNIT_SERIAL};
>>>>> -	u8 reply[3 + STEAM_SERIAL_LEN + 1];
>>>>> +	u8 reply[3 + STEAM_SERIAL_LEN + 1] = { 0 };
>>>>>  
>>>>>  	mutex_lock(&steam->report_mutex);
>>>>>  	ret = steam_send_report(steam, cmd, sizeof(cmd));
>>>>> -- 
>>>>> 2.25.1
>>>>>
>>>>
>>>
>>> Vicki
>>