[syzbot] [usb?] [input?] KMSAN: uninit-value in steam_register

[syzbot] [usb?] [input?] KMSAN: uninit-value in steam_register

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit:    8e65320d91cd Merge tag 'drm-fixes-2026-06-06' of https://g..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=13cb9e7a580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=a0ca3b8cb3875012
dashboard link: https://syzkaller.appspot.com/bug?extid=75f3f9bff8c510602d36
compiler:       Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/793bd3b9425c/disk-8e65320d.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/4bfe5cfc266c/vmlinux-8e65320d.xz
kernel image: https://storage.googleapis.com/syzbot-assets/99c7cd705a06/bzImage-8e65320d.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+75f3f9bff8c510602d36@syzkaller.appspotmail.com

hid-steam 0003:28DE:1102.0007: unknown main item tag 0x0
hid-steam 0003:28DE:1102.0007: unknown main item tag 0x0
hid-steam 0003:28DE:1102.0007: : USB HID v7f.fd Device [HID 28de:1102] on usb-dummy_hcd.1-1/input0
=====================================================
BUG: KMSAN: uninit-value in steam_get_serial drivers/hid/hid-steam.c:457 [inline]
BUG: KMSAN: uninit-value in steam_register+0xd83/0x10e0 drivers/hid/hid-steam.c:965
 steam_get_serial drivers/hid/hid-steam.c:457 [inline]
 steam_register+0xd83/0x10e0 drivers/hid/hid-steam.c:965
 steam_probe+0x6f1/0x19b0 drivers/hid/hid-steam.c:1273
 __hid_device_probe drivers/hid/hid-core.c:2822 [inline]
 hid_device_probe+0x60d/0xb90 drivers/hid/hid-core.c:2859
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x4d5/0xe40 drivers/base/dd.c:709
 __driver_probe_device+0x2fb/0x410 drivers/base/dd.c:871
 driver_probe_device+0x70/0x8f0 drivers/base/dd.c:901
 __device_attach_driver+0x4ee/0x950 drivers/base/dd.c:1029
 bus_for_each_drv+0x3e3/0x680 drivers/base/bus.c:500
 __device_attach+0x3c5/0x5f0 drivers/base/dd.c:1101
 device_initial_probe+0x126/0x170 drivers/base/dd.c:1156
 bus_probe_device+0x287/0x530 drivers/base/bus.c:613
 device_add+0x12e3/0x1c90 drivers/base/core.c:3706
 hid_add_device+0x440/0x5d0 drivers/hid/hid-core.c:3003
 usbhid_probe+0x1a25/0x20e0 drivers/hid/usbhid/hid-core.c:1449
 usb_probe_interface+0xd51/0x1440 drivers/usb/core/driver.c:396
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x4d5/0xe40 drivers/base/dd.c:709
 __driver_probe_device+0x2fb/0x410 drivers/base/dd.c:871
 driver_probe_device+0x70/0x8f0 drivers/base/dd.c:901
 __device_attach_driver+0x4ee/0x950 drivers/base/dd.c:1029
 bus_for_each_drv+0x3e3/0x680 drivers/base/bus.c:500
 __device_attach+0x3c5/0x5f0 drivers/base/dd.c:1101
 device_initial_probe+0x126/0x170 drivers/base/dd.c:1156
 bus_probe_device+0x287/0x530 drivers/base/bus.c:613
 device_add+0x12e3/0x1c90 drivers/base/core.c:3706
 usb_set_configuration+0x3484/0x3b60 drivers/usb/core/message.c:2268
 usb_generic_driver_probe+0xfc/0x290 drivers/usb/core/generic.c:250
 usb_probe_device+0x38d/0x690 drivers/usb/core/driver.c:291
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x4d5/0xe40 drivers/base/dd.c:709
 __driver_probe_device+0x2fb/0x410 drivers/base/dd.c:871
 driver_probe_device+0x70/0x8f0 drivers/base/dd.c:901
 __device_attach_driver+0x4ee/0x950 drivers/base/dd.c:1029
 bus_for_each_drv+0x3e3/0x680 drivers/base/bus.c:500
 __device_attach+0x3c5/0x5f0 drivers/base/dd.c:1101
 device_initial_probe+0x126/0x170 drivers/base/dd.c:1156
 bus_probe_device+0x287/0x530 drivers/base/bus.c:613
 device_add+0x12e3/0x1c90 drivers/base/core.c:3706
 usb_new_device+0x106a/0x2120 drivers/usb/core/hub.c:2695
 hub_port_connect drivers/usb/core/hub.c:5567 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]
 port_event drivers/usb/core/hub.c:5871 [inline]
 hub_event+0x5404/0x77c0 drivers/usb/core/hub.c:5953
 process_one_work kernel/workqueue.c:3314 [inline]
 process_scheduled_works+0xb65/0x1e40 kernel/workqueue.c:3397
 worker_thread+0xee4/0x1590 kernel/workqueue.c:3478
 kthread+0x53a/0x5f0 kernel/kthread.c:436
 ret_from_fork+0x20f/0x8d0 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

Local variable reply.i created at:
 steam_get_serial drivers/hid/hid-steam.c:448 [inline]
 steam_register+0x180/0x10e0 drivers/hid/hid-steam.c:965
 steam_probe+0x6f1/0x19b0 drivers/hid/hid-steam.c:1273

CPU: 0 UID: 0 PID: 7403 Comm: kworker/0:6 Tainted: G             L      syzkaller #0 PREEMPT(lazy) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
Workqueue: usb_hub_wq hub_event
=====================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[PATCH] HID: hid-steam: fix uninit-value access in steam_get_serial

[Pei Xiao]

The reply buffer in steam_get_serial() is allocated on the stack without
initialization. In cases where steam_recv_report() returns a short read or
an error, not all bytes of the buffer are written, leading to subsequent
access of uninitialized memory when checking reply[0], reply[1], reply[2].

Zero-initialize the reply array to prevent KMSAN uninit-value warnings.

Logs:
hid-steam 0003:28DE:1102.0007: unknown main item tag 0x0
hid-steam 0003:28DE:1102.0007: unknown main item tag 0x0
hid-steam 0003:28DE:1102.0007: :
USB HID v7f.fd Device [HID 28de:1102] on usb-dummy_hcd.1-1/input0
=====================================================
BUG: KMSAN: uninit-value in steam_get_serial drivers/hid/hid-steam.c:457 [inline]
BUG: KMSAN: uninit-value in steam_register+0xd83/0x10e0 drivers/hid/hid-steam.c:965
 steam_get_serial drivers/hid/hid-steam.c:457 [inline]
 steam_register+0xd83/0x10e0 drivers/hid/hid-steam.c:965
 steam_probe+0x6f1/0x19b0 drivers/hid/hid-steam.c:1273
 __hid_device_probe drivers/hid/hid-core.c:2822 [inline]
 hid_device_probe+0x60d/0xb90 drivers/hid/hid-core.c:2859
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x4d5/0xe40 drivers/base/dd.c:709
 ...

Local variable reply.i created at:
 steam_get_serial drivers/hid/hid-steam.c:448 [inline]
 steam_register+0x180/0x10e0 drivers/hid/hid-steam.c:965
 steam_probe+0x6f1/0x19b0 drivers/hid/hid-steam.c:1273

Reported-by: syzbot+75f3f9bff8c510602d36@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/lkml/6a27d055.39669fcc.33b062.008d.GAE@google.com/
Fixes: c164d6abf384 ("HID: add driver for Valve Steam Controller")
Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn>
---
 drivers/hid/hid-steam.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/hid/hid-steam.c b/drivers/hid/hid-steam.c
index 197126d6e081..f65ad1a21c01 100644
--- a/drivers/hid/hid-steam.c
+++ b/drivers/hid/hid-steam.c
@@ -445,7 +445,7 @@ static int steam_get_serial(struct steam_device *steam)
 	 */
 	int ret = 0;
 	u8 cmd[] = {ID_GET_STRING_ATTRIBUTE, sizeof(steam->serial_no), ATTRIB_STR_UNIT_SERIAL};
-	u8 reply[3 + STEAM_SERIAL_LEN + 1];
+	u8 reply[3 + STEAM_SERIAL_LEN + 1] = { 0 };
 
 	mutex_lock(&steam->report_mutex);
 	ret = steam_send_report(steam, cmd, sizeof(cmd));
-- 
2.25.1

Re: [PATCH] HID: hid-steam: fix uninit-value access in steam_get_serial

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider:

Pre-existing issues:
- [High] Missing payload length validation in `steam_get_serial()` allows a short report to produce an empty serial number, leading to list corruption (Use-After-Free) during device unregistration.
- [High] Probe error path leaves a freed object in the global `steam_devices` list, causing a Use-After-Free.
- [Medium] Incorrect size argument passed to `strscpy()` causes truncation of the last character of the device's serial number.
--

commit ecebdbfdb0a084297c080f3d3ad65a720d3b9ec6
Author: Pei Xiao <xiaopei01@kylinos.cn>

HID: hid-steam: fix uninit-value access in steam_get_serial

The reply buffer in steam_get_serial() is zero-initialized to prevent KMSAN
uninit-value warnings. These warnings occur when steam_recv_report()
returns a short read or an error.

Reported-by: syzbot+75f3f9bff8c510602d36@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/lkml/6a27d055.39669fcc.33b062.008d.GAE@google.com/
Fixes: c164d6abf384 ("HID: add driver for Valve Steam Controller")
Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn>

> diff --git a/drivers/hid/hid-steam.c b/drivers/hid/hid-steam.c
> index 197126d6e0810..f65ad1a21c018 100644
> --- a/drivers/hid/hid-steam.c
> +++ b/drivers/hid/hid-steam.c
> @@ -445,7 +445,7 @@ static int steam_get_serial(struct steam_device *steam)
>  	 */
>  	int ret = 0;
>  	u8 cmd[] = {ID_GET_STRING_ATTRIBUTE, sizeof(steam->serial_no), ATTRIB_STR_UNIT_SERIAL};
> -	u8 reply[3 + STEAM_SERIAL_LEN + 1];
> +	u8 reply[3 + STEAM_SERIAL_LEN + 1] = { 0 };
>  
>  	mutex_lock(&steam->report_mutex);
>  	ret = steam_send_report(steam, cmd, sizeof(cmd));

[Severity: High]
This is a pre-existing issue, but does steam_get_serial() properly validate
the payload length before copying the serial number?

If a device returns a short report (e.g., 4 bytes), steam_recv_report()
returns 4. The buffer validation checks reply[0] through reply[2], and if
they match, execution reaches the copy:

drivers/hid/hid-steam.c:steam_get_serial() {
    ...
    strscpy(steam->serial_no, reply + 3, reply[1]);
    ...
}

If reply[1] is 1, strscpy() will copy 0 characters and write a null
terminator at steam->serial_no[0]. steam_get_serial() then returns 4
(success), bypassing the fallback assignment in steam_register().

Later, during device unregistration:

drivers/hid/hid-steam.c:steam_unregister() {
    if (steam->serial_no[0]) {
        ...
        list_del_init(&steam->list);
        ...
    }
}

Could this skip list removal because steam->serial_no[0] is null, leaving a
freed object on the global steam_devices list and causing a use-after-free?

[Severity: Medium]
This isn't a bug introduced by this patch, but does the strscpy() call inside
steam_get_serial() pass the correct size argument?

drivers/hid/hid-steam.c:steam_get_serial() {
    ...
    strscpy(steam->serial_no, reply + 3, reply[1]);
    ...
}

Since strscpy() reserves one byte for the null terminator, passing the exact
string length (reply[1]) as the size will cause it to copy only reply[1] - 1
characters. Will this truncate the last character of a valid serial number if
the device specifies its exact length in reply[1]?

[Severity: High]
This is a pre-existing issue, but does steam_register() properly clean up
the global steam_devices list on failure?

During registration, the device is added to the global list:

drivers/hid/hid-steam.c:steam_register() {
    ...
    mutex_lock(&steam_devices_lock);
    if (list_empty(&steam->list))
        list_add(&steam->list, &steam_devices);
    mutex_unlock(&steam_devices_lock);
    ...
    ret = steam_input_register(steam);
    if (ret != 0)
        goto steam_register_input_fail;
    ...
steam_register_input_fail:
    return ret;
}

If steam_input_register() fails, steam_register() returns an error without
removing the object from the steam_devices list.

In the probe function:

drivers/hid/hid-steam.c:steam_probe() {
    ...
    ret = steam_register(steam);
    if (ret) {
        hid_err(hdev,
            "%s:steam_register failed with error %d\n",
            __func__, ret);
        goto err_hw_close;
    }
    ...
}

If steam_register() fails, the driver core will free the devres-managed
steam_device struct. Could this leave a dangling pointer in the global
steam_devices list and lead to a use-after-free upon later list traversal?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/0c5f5bcd3d01776615a97d7f23b5c1bff6a2acce.1781092734.git.xiaopei01@kylinos.cn?part=1

Re: [PATCH] HID: hid-steam: fix uninit-value access in steam_get_serial

[Jiri Kosina]

CCing Vicki Pfau here ... could you please give your Ack to this fix?

Thanks.

On Wed, 10 Jun 2026, Pei Xiao wrote:

> The reply buffer in steam_get_serial() is allocated on the stack without
> initialization. In cases where steam_recv_report() returns a short read or
> an error, not all bytes of the buffer are written, leading to subsequent
> access of uninitialized memory when checking reply[0], reply[1], reply[2].
> 
> Zero-initialize the reply array to prevent KMSAN uninit-value warnings.
> 
> Logs:
> hid-steam 0003:28DE:1102.0007: unknown main item tag 0x0
> hid-steam 0003:28DE:1102.0007: unknown main item tag 0x0
> hid-steam 0003:28DE:1102.0007: :
> USB HID v7f.fd Device [HID 28de:1102] on usb-dummy_hcd.1-1/input0
> =====================================================
> BUG: KMSAN: uninit-value in steam_get_serial drivers/hid/hid-steam.c:457 [inline]
> BUG: KMSAN: uninit-value in steam_register+0xd83/0x10e0 drivers/hid/hid-steam.c:965
>  steam_get_serial drivers/hid/hid-steam.c:457 [inline]
>  steam_register+0xd83/0x10e0 drivers/hid/hid-steam.c:965
>  steam_probe+0x6f1/0x19b0 drivers/hid/hid-steam.c:1273
>  __hid_device_probe drivers/hid/hid-core.c:2822 [inline]
>  hid_device_probe+0x60d/0xb90 drivers/hid/hid-core.c:2859
>  call_driver_probe drivers/base/dd.c:-1 [inline]
>  really_probe+0x4d5/0xe40 drivers/base/dd.c:709
>  ...
> 
> Local variable reply.i created at:
>  steam_get_serial drivers/hid/hid-steam.c:448 [inline]
>  steam_register+0x180/0x10e0 drivers/hid/hid-steam.c:965
>  steam_probe+0x6f1/0x19b0 drivers/hid/hid-steam.c:1273
> 
> Reported-by: syzbot+75f3f9bff8c510602d36@syzkaller.appspotmail.com
> Closes: https://lore.kernel.org/lkml/6a27d055.39669fcc.33b062.008d.GAE@google.com/
> Fixes: c164d6abf384 ("HID: add driver for Valve Steam Controller")
> Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn>



> ---
>  drivers/hid/hid-steam.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/hid/hid-steam.c b/drivers/hid/hid-steam.c
> index 197126d6e081..f65ad1a21c01 100644
> --- a/drivers/hid/hid-steam.c
> +++ b/drivers/hid/hid-steam.c
> @@ -445,7 +445,7 @@ static int steam_get_serial(struct steam_device *steam)
>  	 */
>  	int ret = 0;
>  	u8 cmd[] = {ID_GET_STRING_ATTRIBUTE, sizeof(steam->serial_no), ATTRIB_STR_UNIT_SERIAL};
> -	u8 reply[3 + STEAM_SERIAL_LEN + 1];
> +	u8 reply[3 + STEAM_SERIAL_LEN + 1] = { 0 };
>  
>  	mutex_lock(&steam->report_mutex);
>  	ret = steam_send_report(steam, cmd, sizeof(cmd));
> -- 
> 2.25.1
> 

-- 
Jiri Kosina
SUSE Labs

Re: [PATCH] HID: hid-steam: fix uninit-value access in steam_get_serial

[Vicki Pfau]

Hi Jiri,

On 8/3/26 12:34 PM, Jiri Kosina wrote:
> CCing Vicki Pfau here ... could you please give your Ack to this fix?

This was already fixed in 9f8ee99f831b2711624ef81d0abba1d183f28b09 in the series I submitted earlier. I didn't realize there was an open bug report for it.

> 
> Thanks.
> 
> On Wed, 10 Jun 2026, Pei Xiao wrote:
> 
>> The reply buffer in steam_get_serial() is allocated on the stack without
>> initialization. In cases where steam_recv_report() returns a short read or
>> an error, not all bytes of the buffer are written, leading to subsequent
>> access of uninitialized memory when checking reply[0], reply[1], reply[2].
>>
>> Zero-initialize the reply array to prevent KMSAN uninit-value warnings.
>>
>> Logs:
>> hid-steam 0003:28DE:1102.0007: unknown main item tag 0x0
>> hid-steam 0003:28DE:1102.0007: unknown main item tag 0x0
>> hid-steam 0003:28DE:1102.0007: :
>> USB HID v7f.fd Device [HID 28de:1102] on usb-dummy_hcd.1-1/input0
>> =====================================================
>> BUG: KMSAN: uninit-value in steam_get_serial drivers/hid/hid-steam.c:457 [inline]
>> BUG: KMSAN: uninit-value in steam_register+0xd83/0x10e0 drivers/hid/hid-steam.c:965
>>  steam_get_serial drivers/hid/hid-steam.c:457 [inline]
>>  steam_register+0xd83/0x10e0 drivers/hid/hid-steam.c:965
>>  steam_probe+0x6f1/0x19b0 drivers/hid/hid-steam.c:1273
>>  __hid_device_probe drivers/hid/hid-core.c:2822 [inline]
>>  hid_device_probe+0x60d/0xb90 drivers/hid/hid-core.c:2859
>>  call_driver_probe drivers/base/dd.c:-1 [inline]
>>  really_probe+0x4d5/0xe40 drivers/base/dd.c:709
>>  ...
>>
>> Local variable reply.i created at:
>>  steam_get_serial drivers/hid/hid-steam.c:448 [inline]
>>  steam_register+0x180/0x10e0 drivers/hid/hid-steam.c:965
>>  steam_probe+0x6f1/0x19b0 drivers/hid/hid-steam.c:1273
>>
>> Reported-by: syzbot+75f3f9bff8c510602d36@syzkaller.appspotmail.com
>> Closes: https://lore.kernel.org/lkml/6a27d055.39669fcc.33b062.008d.GAE@google.com/
>> Fixes: c164d6abf384 ("HID: add driver for Valve Steam Controller")
>> Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn>
> 
> 
> 
>> ---
>>  drivers/hid/hid-steam.c | 2 +-
>>  1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/drivers/hid/hid-steam.c b/drivers/hid/hid-steam.c
>> index 197126d6e081..f65ad1a21c01 100644
>> --- a/drivers/hid/hid-steam.c
>> +++ b/drivers/hid/hid-steam.c
>> @@ -445,7 +445,7 @@ static int steam_get_serial(struct steam_device *steam)
>>  	 */
>>  	int ret = 0;
>>  	u8 cmd[] = {ID_GET_STRING_ATTRIBUTE, sizeof(steam->serial_no), ATTRIB_STR_UNIT_SERIAL};
>> -	u8 reply[3 + STEAM_SERIAL_LEN + 1];
>> +	u8 reply[3 + STEAM_SERIAL_LEN + 1] = { 0 };
>>  
>>  	mutex_lock(&steam->report_mutex);
>>  	ret = steam_send_report(steam, cmd, sizeof(cmd));
>> -- 
>> 2.25.1
>>
> 

Vicki

Re: [PATCH] HID: hid-steam: fix uninit-value access in steam_get_serial

[Pei Xiao]

在 2026/8/4 04:39, Vicki Pfau 写道:
> Hi Jiri,
> 
> On 8/3/26 12:34 PM, Jiri Kosina wrote:
>> CCing Vicki Pfau here ... could you please give your Ack to this fix?
> 
> This was already fixed in 9f8ee99f831b2711624ef81d0abba1d183f28b09 in the series I submitted earlier. I didn't realize there was an open bug report for it.
Hi maintainer and Vicki,
I took a look at this commit. In fact, my patch was nearly two months
earlier than this commit. I had originally thought that this one-line
patch, especially for an error-path case, had been ignored by the
maintainer.

thanks！
Pei.
> 
>>
>> Thanks.
>>
>> On Wed, 10 Jun 2026, Pei Xiao wrote:
>>
>>> The reply buffer in steam_get_serial() is allocated on the stack without
>>> initialization. In cases where steam_recv_report() returns a short read or
>>> an error, not all bytes of the buffer are written, leading to subsequent
>>> access of uninitialized memory when checking reply[0], reply[1], reply[2].
>>>
>>> Zero-initialize the reply array to prevent KMSAN uninit-value warnings.
>>>
>>> Logs:
>>> hid-steam 0003:28DE:1102.0007: unknown main item tag 0x0
>>> hid-steam 0003:28DE:1102.0007: unknown main item tag 0x0
>>> hid-steam 0003:28DE:1102.0007: :
>>> USB HID v7f.fd Device [HID 28de:1102] on usb-dummy_hcd.1-1/input0
>>> =====================================================
>>> BUG: KMSAN: uninit-value in steam_get_serial drivers/hid/hid-steam.c:457 [inline]
>>> BUG: KMSAN: uninit-value in steam_register+0xd83/0x10e0 drivers/hid/hid-steam.c:965
>>>  steam_get_serial drivers/hid/hid-steam.c:457 [inline]
>>>  steam_register+0xd83/0x10e0 drivers/hid/hid-steam.c:965
>>>  steam_probe+0x6f1/0x19b0 drivers/hid/hid-steam.c:1273
>>>  __hid_device_probe drivers/hid/hid-core.c:2822 [inline]
>>>  hid_device_probe+0x60d/0xb90 drivers/hid/hid-core.c:2859
>>>  call_driver_probe drivers/base/dd.c:-1 [inline]
>>>  really_probe+0x4d5/0xe40 drivers/base/dd.c:709
>>>  ...
>>>
>>> Local variable reply.i created at:
>>>  steam_get_serial drivers/hid/hid-steam.c:448 [inline]
>>>  steam_register+0x180/0x10e0 drivers/hid/hid-steam.c:965
>>>  steam_probe+0x6f1/0x19b0 drivers/hid/hid-steam.c:1273
>>>
>>> Reported-by: syzbot+75f3f9bff8c510602d36@syzkaller.appspotmail.com
>>> Closes: https://lore.kernel.org/lkml/6a27d055.39669fcc.33b062.008d.GAE@google.com/
>>> Fixes: c164d6abf384 ("HID: add driver for Valve Steam Controller")
>>> Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn>
>>
>>
>>
>>> ---
>>>  drivers/hid/hid-steam.c | 2 +-
>>>  1 file changed, 1 insertion(+), 1 deletion(-)
>>>
>>> diff --git a/drivers/hid/hid-steam.c b/drivers/hid/hid-steam.c
>>> index 197126d6e081..f65ad1a21c01 100644
>>> --- a/drivers/hid/hid-steam.c
>>> +++ b/drivers/hid/hid-steam.c
>>> @@ -445,7 +445,7 @@ static int steam_get_serial(struct steam_device *steam)
>>>  	 */
>>>  	int ret = 0;
>>>  	u8 cmd[] = {ID_GET_STRING_ATTRIBUTE, sizeof(steam->serial_no), ATTRIB_STR_UNIT_SERIAL};
>>> -	u8 reply[3 + STEAM_SERIAL_LEN + 1];
>>> +	u8 reply[3 + STEAM_SERIAL_LEN + 1] = { 0 };
>>>  
>>>  	mutex_lock(&steam->report_mutex);
>>>  	ret = steam_send_report(steam, cmd, sizeof(cmd));
>>> -- 
>>> 2.25.1
>>>
>>
> 
> Vicki

Re: [PATCH] HID: hid-steam: fix uninit-value access in steam_get_serial

[Vicki Pfau]

Hi Pei,

On 8/3/26 5:58 PM, Pei Xiao wrote:
> 
> 
> 在 2026/8/4 04:39, Vicki Pfau 写道:
>> Hi Jiri,
>>
>> On 8/3/26 12:34 PM, Jiri Kosina wrote:
>>> CCing Vicki Pfau here ... could you please give your Ack to this fix?
>>
>> This was already fixed in 9f8ee99f831b2711624ef81d0abba1d183f28b09 in the series I submitted earlier. I didn't realize there was an open bug report for it.
> Hi maintainer and Vicki,
> I took a look at this commit. In fact, my patch was nearly two months
> earlier than this commit. I had originally thought that this one-line
> patch, especially for an error-path case, had been ignored by the
> maintainer.

Yes, sorry, I wasn't marked as maintainer at the time and didn't notice it before I wrote my equivalent patch. Jiri just happened to merge mine first.

Vicki

> 
> thanks！
> Pei.
>>
>>>
>>> Thanks.
>>>
>>> On Wed, 10 Jun 2026, Pei Xiao wrote:
>>>
>>>> The reply buffer in steam_get_serial() is allocated on the stack without
>>>> initialization. In cases where steam_recv_report() returns a short read or
>>>> an error, not all bytes of the buffer are written, leading to subsequent
>>>> access of uninitialized memory when checking reply[0], reply[1], reply[2].
>>>>
>>>> Zero-initialize the reply array to prevent KMSAN uninit-value warnings.
>>>>
>>>> Logs:
>>>> hid-steam 0003:28DE:1102.0007: unknown main item tag 0x0
>>>> hid-steam 0003:28DE:1102.0007: unknown main item tag 0x0
>>>> hid-steam 0003:28DE:1102.0007: :
>>>> USB HID v7f.fd Device [HID 28de:1102] on usb-dummy_hcd.1-1/input0
>>>> =====================================================
>>>> BUG: KMSAN: uninit-value in steam_get_serial drivers/hid/hid-steam.c:457 [inline]
>>>> BUG: KMSAN: uninit-value in steam_register+0xd83/0x10e0 drivers/hid/hid-steam.c:965
>>>>  steam_get_serial drivers/hid/hid-steam.c:457 [inline]
>>>>  steam_register+0xd83/0x10e0 drivers/hid/hid-steam.c:965
>>>>  steam_probe+0x6f1/0x19b0 drivers/hid/hid-steam.c:1273
>>>>  __hid_device_probe drivers/hid/hid-core.c:2822 [inline]
>>>>  hid_device_probe+0x60d/0xb90 drivers/hid/hid-core.c:2859
>>>>  call_driver_probe drivers/base/dd.c:-1 [inline]
>>>>  really_probe+0x4d5/0xe40 drivers/base/dd.c:709
>>>>  ...
>>>>
>>>> Local variable reply.i created at:
>>>>  steam_get_serial drivers/hid/hid-steam.c:448 [inline]
>>>>  steam_register+0x180/0x10e0 drivers/hid/hid-steam.c:965
>>>>  steam_probe+0x6f1/0x19b0 drivers/hid/hid-steam.c:1273
>>>>
>>>> Reported-by: syzbot+75f3f9bff8c510602d36@syzkaller.appspotmail.com
>>>> Closes: https://lore.kernel.org/lkml/6a27d055.39669fcc.33b062.008d.GAE@google.com/
>>>> Fixes: c164d6abf384 ("HID: add driver for Valve Steam Controller")
>>>> Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn>
>>>
>>>
>>>
>>>> ---
>>>>  drivers/hid/hid-steam.c | 2 +-
>>>>  1 file changed, 1 insertion(+), 1 deletion(-)
>>>>
>>>> diff --git a/drivers/hid/hid-steam.c b/drivers/hid/hid-steam.c
>>>> index 197126d6e081..f65ad1a21c01 100644
>>>> --- a/drivers/hid/hid-steam.c
>>>> +++ b/drivers/hid/hid-steam.c
>>>> @@ -445,7 +445,7 @@ static int steam_get_serial(struct steam_device *steam)
>>>>  	 */
>>>>  	int ret = 0;
>>>>  	u8 cmd[] = {ID_GET_STRING_ATTRIBUTE, sizeof(steam->serial_no), ATTRIB_STR_UNIT_SERIAL};
>>>> -	u8 reply[3 + STEAM_SERIAL_LEN + 1];
>>>> +	u8 reply[3 + STEAM_SERIAL_LEN + 1] = { 0 };
>>>>  
>>>>  	mutex_lock(&steam->report_mutex);
>>>>  	ret = steam_send_report(steam, cmd, sizeof(cmd));
>>>> -- 
>>>> 2.25.1
>>>>
>>>
>>
>> Vicki
> 

Re: [PATCH] HID: hid-steam: fix uninit-value access in steam_get_serial

[Pei Xiao]

在 2026/8/4 09:05, Vicki Pfau 写道:
> Hi Pei,
> 
> On 8/3/26 5:58 PM, Pei Xiao wrote:
>>
>>
>> 在 2026/8/4 04:39, Vicki Pfau 写道:
>>> Hi Jiri,
>>>
>>> On 8/3/26 12:34 PM, Jiri Kosina wrote:
>>>> CCing Vicki Pfau here ... could you please give your Ack to this fix?
>>>
>>> This was already fixed in 9f8ee99f831b2711624ef81d0abba1d183f28b09 in the series I submitted earlier. I didn't realize there was an open bug report for it.
>> Hi maintainer and Vicki,
>> I took a look at this commit. In fact, my patch was nearly two months
>> earlier than this commit. I had originally thought that this one-line
>> patch, especially for an error-path case, had been ignored by the
>> maintainer.
> 
> Yes, sorry, I wasn't marked as maintainer at the time and didn't notice it before I wrote my equivalent patch. Jiri just happened to merge mine first.
> 
It's okay.
> Vicki
> 
>>
>> thanks！
>> Pei.
>>>
>>>>
>>>> Thanks.
>>>>
>>>> On Wed, 10 Jun 2026, Pei Xiao wrote:
>>>>
>>>>> The reply buffer in steam_get_serial() is allocated on the stack without
>>>>> initialization. In cases where steam_recv_report() returns a short read or
>>>>> an error, not all bytes of the buffer are written, leading to subsequent
>>>>> access of uninitialized memory when checking reply[0], reply[1], reply[2].
>>>>>
>>>>> Zero-initialize the reply array to prevent KMSAN uninit-value warnings.
>>>>>
>>>>> Logs:
>>>>> hid-steam 0003:28DE:1102.0007: unknown main item tag 0x0
>>>>> hid-steam 0003:28DE:1102.0007: unknown main item tag 0x0
>>>>> hid-steam 0003:28DE:1102.0007: :
>>>>> USB HID v7f.fd Device [HID 28de:1102] on usb-dummy_hcd.1-1/input0
>>>>> =====================================================
>>>>> BUG: KMSAN: uninit-value in steam_get_serial drivers/hid/hid-steam.c:457 [inline]
>>>>> BUG: KMSAN: uninit-value in steam_register+0xd83/0x10e0 drivers/hid/hid-steam.c:965
>>>>>  steam_get_serial drivers/hid/hid-steam.c:457 [inline]
>>>>>  steam_register+0xd83/0x10e0 drivers/hid/hid-steam.c:965
>>>>>  steam_probe+0x6f1/0x19b0 drivers/hid/hid-steam.c:1273
>>>>>  __hid_device_probe drivers/hid/hid-core.c:2822 [inline]
>>>>>  hid_device_probe+0x60d/0xb90 drivers/hid/hid-core.c:2859
>>>>>  call_driver_probe drivers/base/dd.c:-1 [inline]
>>>>>  really_probe+0x4d5/0xe40 drivers/base/dd.c:709
>>>>>  ...
>>>>>
>>>>> Local variable reply.i created at:
>>>>>  steam_get_serial drivers/hid/hid-steam.c:448 [inline]
>>>>>  steam_register+0x180/0x10e0 drivers/hid/hid-steam.c:965
>>>>>  steam_probe+0x6f1/0x19b0 drivers/hid/hid-steam.c:1273
>>>>>
>>>>> Reported-by: syzbot+75f3f9bff8c510602d36@syzkaller.appspotmail.com
>>>>> Closes: https://lore.kernel.org/lkml/6a27d055.39669fcc.33b062.008d.GAE@google.com/
>>>>> Fixes: c164d6abf384 ("HID: add driver for Valve Steam Controller")
>>>>> Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn>
>>>>
>>>>
>>>>
>>>>> ---
>>>>>  drivers/hid/hid-steam.c | 2 +-
>>>>>  1 file changed, 1 insertion(+), 1 deletion(-)
>>>>>
>>>>> diff --git a/drivers/hid/hid-steam.c b/drivers/hid/hid-steam.c
>>>>> index 197126d6e081..f65ad1a21c01 100644
>>>>> --- a/drivers/hid/hid-steam.c
>>>>> +++ b/drivers/hid/hid-steam.c
>>>>> @@ -445,7 +445,7 @@ static int steam_get_serial(struct steam_device *steam)
>>>>>  	 */
>>>>>  	int ret = 0;
>>>>>  	u8 cmd[] = {ID_GET_STRING_ATTRIBUTE, sizeof(steam->serial_no), ATTRIB_STR_UNIT_SERIAL};
>>>>> -	u8 reply[3 + STEAM_SERIAL_LEN + 1];
>>>>> +	u8 reply[3 + STEAM_SERIAL_LEN + 1] = { 0 };
>>>>>  
>>>>>  	mutex_lock(&steam->report_mutex);
>>>>>  	ret = steam_send_report(steam, cmd, sizeof(cmd));
>>>>> -- 
>>>>> 2.25.1
>>>>>
>>>>
>>>
>>> Vicki
>>