* [syzbot] [usb?] [input?] KMSAN: uninit-value in steam_register @ 2026-06-09 8:35 syzbot 2026-06-10 12:01 ` [PATCH] HID: hid-steam: fix uninit-value access in steam_get_serial Pei Xiao 0 siblings, 1 reply; 3+ messages in thread From: syzbot @ 2026-06-09 8:35 UTC (permalink / raw) To: linux-input, linux-kernel, linux-usb, syzkaller-bugs Hello, syzbot found the following issue on: HEAD commit: 8e65320d91cd Merge tag 'drm-fixes-2026-06-06' of https://g.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=13cb9e7a580000 kernel config: https://syzkaller.appspot.com/x/.config?x=a0ca3b8cb3875012 dashboard link: https://syzkaller.appspot.com/bug?extid=75f3f9bff8c510602d36 compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8 Unfortunately, I don't have any reproducer for this issue yet. Downloadable assets: disk image: https://storage.googleapis.com/syzbot-assets/793bd3b9425c/disk-8e65320d.raw.xz vmlinux: https://storage.googleapis.com/syzbot-assets/4bfe5cfc266c/vmlinux-8e65320d.xz kernel image: https://storage.googleapis.com/syzbot-assets/99c7cd705a06/bzImage-8e65320d.xz IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+75f3f9bff8c510602d36@syzkaller.appspotmail.com hid-steam 0003:28DE:1102.0007: unknown main item tag 0x0 hid-steam 0003:28DE:1102.0007: unknown main item tag 0x0 hid-steam 0003:28DE:1102.0007: : USB HID v7f.fd Device [HID 28de:1102] on usb-dummy_hcd.1-1/input0 ===================================================== BUG: KMSAN: uninit-value in steam_get_serial drivers/hid/hid-steam.c:457 [inline] BUG: KMSAN: uninit-value in steam_register+0xd83/0x10e0 drivers/hid/hid-steam.c:965 steam_get_serial drivers/hid/hid-steam.c:457 [inline] steam_register+0xd83/0x10e0 drivers/hid/hid-steam.c:965 steam_probe+0x6f1/0x19b0 drivers/hid/hid-steam.c:1273 __hid_device_probe drivers/hid/hid-core.c:2822 [inline] hid_device_probe+0x60d/0xb90 drivers/hid/hid-core.c:2859 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x4d5/0xe40 drivers/base/dd.c:709 __driver_probe_device+0x2fb/0x410 drivers/base/dd.c:871 driver_probe_device+0x70/0x8f0 drivers/base/dd.c:901 __device_attach_driver+0x4ee/0x950 drivers/base/dd.c:1029 bus_for_each_drv+0x3e3/0x680 drivers/base/bus.c:500 __device_attach+0x3c5/0x5f0 drivers/base/dd.c:1101 device_initial_probe+0x126/0x170 drivers/base/dd.c:1156 bus_probe_device+0x287/0x530 drivers/base/bus.c:613 device_add+0x12e3/0x1c90 drivers/base/core.c:3706 hid_add_device+0x440/0x5d0 drivers/hid/hid-core.c:3003 usbhid_probe+0x1a25/0x20e0 drivers/hid/usbhid/hid-core.c:1449 usb_probe_interface+0xd51/0x1440 drivers/usb/core/driver.c:396 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x4d5/0xe40 drivers/base/dd.c:709 __driver_probe_device+0x2fb/0x410 drivers/base/dd.c:871 driver_probe_device+0x70/0x8f0 drivers/base/dd.c:901 __device_attach_driver+0x4ee/0x950 drivers/base/dd.c:1029 bus_for_each_drv+0x3e3/0x680 drivers/base/bus.c:500 __device_attach+0x3c5/0x5f0 drivers/base/dd.c:1101 device_initial_probe+0x126/0x170 drivers/base/dd.c:1156 bus_probe_device+0x287/0x530 drivers/base/bus.c:613 device_add+0x12e3/0x1c90 drivers/base/core.c:3706 usb_set_configuration+0x3484/0x3b60 drivers/usb/core/message.c:2268 usb_generic_driver_probe+0xfc/0x290 drivers/usb/core/generic.c:250 usb_probe_device+0x38d/0x690 drivers/usb/core/driver.c:291 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x4d5/0xe40 drivers/base/dd.c:709 __driver_probe_device+0x2fb/0x410 drivers/base/dd.c:871 driver_probe_device+0x70/0x8f0 drivers/base/dd.c:901 __device_attach_driver+0x4ee/0x950 drivers/base/dd.c:1029 bus_for_each_drv+0x3e3/0x680 drivers/base/bus.c:500 __device_attach+0x3c5/0x5f0 drivers/base/dd.c:1101 device_initial_probe+0x126/0x170 drivers/base/dd.c:1156 bus_probe_device+0x287/0x530 drivers/base/bus.c:613 device_add+0x12e3/0x1c90 drivers/base/core.c:3706 usb_new_device+0x106a/0x2120 drivers/usb/core/hub.c:2695 hub_port_connect drivers/usb/core/hub.c:5567 [inline] hub_port_connect_change drivers/usb/core/hub.c:5707 [inline] port_event drivers/usb/core/hub.c:5871 [inline] hub_event+0x5404/0x77c0 drivers/usb/core/hub.c:5953 process_one_work kernel/workqueue.c:3314 [inline] process_scheduled_works+0xb65/0x1e40 kernel/workqueue.c:3397 worker_thread+0xee4/0x1590 kernel/workqueue.c:3478 kthread+0x53a/0x5f0 kernel/kthread.c:436 ret_from_fork+0x20f/0x8d0 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Local variable reply.i created at: steam_get_serial drivers/hid/hid-steam.c:448 [inline] steam_register+0x180/0x10e0 drivers/hid/hid-steam.c:965 steam_probe+0x6f1/0x19b0 drivers/hid/hid-steam.c:1273 CPU: 0 UID: 0 PID: 7403 Comm: kworker/0:6 Tainted: G L syzkaller #0 PREEMPT(lazy) Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 Workqueue: usb_hub_wq hub_event ===================================================== --- This report is generated by a bot. It may contain errors. See https://goo.gl/tpsmEJ for more information about syzbot. syzbot engineers can be reached at syzkaller@googlegroups.com. syzbot will keep track of this issue. See: https://goo.gl/tpsmEJ#status for how to communicate with syzbot. If the report is already addressed, let syzbot know by replying with: #syz fix: exact-commit-title If you want to overwrite report's subsystems, reply with: #syz set subsystems: new-subsystem (See the list of subsystem names on the web dashboard) If the report is a duplicate of another one, reply with: #syz dup: exact-subject-of-another-report If you want to undo deduplication, reply with: #syz undup ^ permalink raw reply [flat|nested] 3+ messages in thread
* [PATCH] HID: hid-steam: fix uninit-value access in steam_get_serial 2026-06-09 8:35 [syzbot] [usb?] [input?] KMSAN: uninit-value in steam_register syzbot @ 2026-06-10 12:01 ` Pei Xiao 2026-06-10 12:17 ` sashiko-bot 0 siblings, 1 reply; 3+ messages in thread From: Pei Xiao @ 2026-06-10 12:01 UTC (permalink / raw) To: jikos, bentiss, linux-input, linux-kernel, syzbot+75f3f9bff8c510602d36 Cc: syzkaller-bugs, Pei Xiao The reply buffer in steam_get_serial() is allocated on the stack without initialization. In cases where steam_recv_report() returns a short read or an error, not all bytes of the buffer are written, leading to subsequent access of uninitialized memory when checking reply[0], reply[1], reply[2]. Zero-initialize the reply array to prevent KMSAN uninit-value warnings. Logs: hid-steam 0003:28DE:1102.0007: unknown main item tag 0x0 hid-steam 0003:28DE:1102.0007: unknown main item tag 0x0 hid-steam 0003:28DE:1102.0007: : USB HID v7f.fd Device [HID 28de:1102] on usb-dummy_hcd.1-1/input0 ===================================================== BUG: KMSAN: uninit-value in steam_get_serial drivers/hid/hid-steam.c:457 [inline] BUG: KMSAN: uninit-value in steam_register+0xd83/0x10e0 drivers/hid/hid-steam.c:965 steam_get_serial drivers/hid/hid-steam.c:457 [inline] steam_register+0xd83/0x10e0 drivers/hid/hid-steam.c:965 steam_probe+0x6f1/0x19b0 drivers/hid/hid-steam.c:1273 __hid_device_probe drivers/hid/hid-core.c:2822 [inline] hid_device_probe+0x60d/0xb90 drivers/hid/hid-core.c:2859 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x4d5/0xe40 drivers/base/dd.c:709 ... Local variable reply.i created at: steam_get_serial drivers/hid/hid-steam.c:448 [inline] steam_register+0x180/0x10e0 drivers/hid/hid-steam.c:965 steam_probe+0x6f1/0x19b0 drivers/hid/hid-steam.c:1273 Reported-by: syzbot+75f3f9bff8c510602d36@syzkaller.appspotmail.com Closes: https://lore.kernel.org/lkml/6a27d055.39669fcc.33b062.008d.GAE@google.com/ Fixes: c164d6abf384 ("HID: add driver for Valve Steam Controller") Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn> --- drivers/hid/hid-steam.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/hid/hid-steam.c b/drivers/hid/hid-steam.c index 197126d6e081..f65ad1a21c01 100644 --- a/drivers/hid/hid-steam.c +++ b/drivers/hid/hid-steam.c @@ -445,7 +445,7 @@ static int steam_get_serial(struct steam_device *steam) */ int ret = 0; u8 cmd[] = {ID_GET_STRING_ATTRIBUTE, sizeof(steam->serial_no), ATTRIB_STR_UNIT_SERIAL}; - u8 reply[3 + STEAM_SERIAL_LEN + 1]; + u8 reply[3 + STEAM_SERIAL_LEN + 1] = { 0 }; mutex_lock(&steam->report_mutex); ret = steam_send_report(steam, cmd, sizeof(cmd)); -- 2.25.1 ^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] HID: hid-steam: fix uninit-value access in steam_get_serial 2026-06-10 12:01 ` [PATCH] HID: hid-steam: fix uninit-value access in steam_get_serial Pei Xiao @ 2026-06-10 12:17 ` sashiko-bot 0 siblings, 0 replies; 3+ messages in thread From: sashiko-bot @ 2026-06-10 12:17 UTC (permalink / raw) To: Pei Xiao; +Cc: dmitry.torokhov, linux-input Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider: Pre-existing issues: - [High] Missing payload length validation in `steam_get_serial()` allows a short report to produce an empty serial number, leading to list corruption (Use-After-Free) during device unregistration. - [High] Probe error path leaves a freed object in the global `steam_devices` list, causing a Use-After-Free. - [Medium] Incorrect size argument passed to `strscpy()` causes truncation of the last character of the device's serial number. -- commit ecebdbfdb0a084297c080f3d3ad65a720d3b9ec6 Author: Pei Xiao <xiaopei01@kylinos.cn> HID: hid-steam: fix uninit-value access in steam_get_serial The reply buffer in steam_get_serial() is zero-initialized to prevent KMSAN uninit-value warnings. These warnings occur when steam_recv_report() returns a short read or an error. Reported-by: syzbot+75f3f9bff8c510602d36@syzkaller.appspotmail.com Closes: https://lore.kernel.org/lkml/6a27d055.39669fcc.33b062.008d.GAE@google.com/ Fixes: c164d6abf384 ("HID: add driver for Valve Steam Controller") Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn> > diff --git a/drivers/hid/hid-steam.c b/drivers/hid/hid-steam.c > index 197126d6e0810..f65ad1a21c018 100644 > --- a/drivers/hid/hid-steam.c > +++ b/drivers/hid/hid-steam.c > @@ -445,7 +445,7 @@ static int steam_get_serial(struct steam_device *steam) > */ > int ret = 0; > u8 cmd[] = {ID_GET_STRING_ATTRIBUTE, sizeof(steam->serial_no), ATTRIB_STR_UNIT_SERIAL}; > - u8 reply[3 + STEAM_SERIAL_LEN + 1]; > + u8 reply[3 + STEAM_SERIAL_LEN + 1] = { 0 }; > > mutex_lock(&steam->report_mutex); > ret = steam_send_report(steam, cmd, sizeof(cmd)); [Severity: High] This is a pre-existing issue, but does steam_get_serial() properly validate the payload length before copying the serial number? If a device returns a short report (e.g., 4 bytes), steam_recv_report() returns 4. The buffer validation checks reply[0] through reply[2], and if they match, execution reaches the copy: drivers/hid/hid-steam.c:steam_get_serial() { ... strscpy(steam->serial_no, reply + 3, reply[1]); ... } If reply[1] is 1, strscpy() will copy 0 characters and write a null terminator at steam->serial_no[0]. steam_get_serial() then returns 4 (success), bypassing the fallback assignment in steam_register(). Later, during device unregistration: drivers/hid/hid-steam.c:steam_unregister() { if (steam->serial_no[0]) { ... list_del_init(&steam->list); ... } } Could this skip list removal because steam->serial_no[0] is null, leaving a freed object on the global steam_devices list and causing a use-after-free? [Severity: Medium] This isn't a bug introduced by this patch, but does the strscpy() call inside steam_get_serial() pass the correct size argument? drivers/hid/hid-steam.c:steam_get_serial() { ... strscpy(steam->serial_no, reply + 3, reply[1]); ... } Since strscpy() reserves one byte for the null terminator, passing the exact string length (reply[1]) as the size will cause it to copy only reply[1] - 1 characters. Will this truncate the last character of a valid serial number if the device specifies its exact length in reply[1]? [Severity: High] This is a pre-existing issue, but does steam_register() properly clean up the global steam_devices list on failure? During registration, the device is added to the global list: drivers/hid/hid-steam.c:steam_register() { ... mutex_lock(&steam_devices_lock); if (list_empty(&steam->list)) list_add(&steam->list, &steam_devices); mutex_unlock(&steam_devices_lock); ... ret = steam_input_register(steam); if (ret != 0) goto steam_register_input_fail; ... steam_register_input_fail: return ret; } If steam_input_register() fails, steam_register() returns an error without removing the object from the steam_devices list. In the probe function: drivers/hid/hid-steam.c:steam_probe() { ... ret = steam_register(steam); if (ret) { hid_err(hdev, "%s:steam_register failed with error %d\n", __func__, ret); goto err_hw_close; } ... } If steam_register() fails, the driver core will free the devres-managed steam_device struct. Could this leave a dangling pointer in the global steam_devices list and lead to a use-after-free upon later list traversal? -- Sashiko AI review · https://sashiko.dev/#/patchset/0c5f5bcd3d01776615a97d7f23b5c1bff6a2acce.1781092734.git.xiaopei01@kylinos.cn?part=1 ^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-06-10 12:17 UTC | newest] Thread overview: 3+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2026-06-09 8:35 [syzbot] [usb?] [input?] KMSAN: uninit-value in steam_register syzbot 2026-06-10 12:01 ` [PATCH] HID: hid-steam: fix uninit-value access in steam_get_serial Pei Xiao 2026-06-10 12:17 ` sashiko-bot
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox