Re: [PATCH 3/4] HID: amd_sfh: Add HPD support for new AMD SOC

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Kernel stack memory is leaked to userspace due to uninitialized stack variables being copied to the HID input report buffer.
--

commit fbf2d0c98746dffa45a715c975a05e57c0b3b3fb
Author: Basavaraj Natikar <Basavaraj.Natikar@amd.com>

HID: amd_sfh: Add HPD support for new AMD SOC

This commit adds Human Presence Detection (HPD) support for new AMD SOCs.
It updates the driver to use HPD data from DRAM instead of reading from the
C2P4 register path on newer hardware versions.

> diff --git a/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_desc.c b/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_desc.c
> index c8916afefa626..b81a97dbb1b01 100644
> --- a/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_desc.c
> +++ b/drivers/hid/amd-sfh-hid/sfh1_1/amd_sfh_desc.c
> @@ -187,6 +187,7 @@ static u8 get_input_rep(u8 current_index, int sensor_idx, int report_id,
>  	struct sfh_gyro_data gyro_data;
>  	struct sfh_mag_data mag_data;
>  	struct sfh_als_data als_data;
> +	struct sfh_hpd_data hpd_data;
>  	struct hpd_status hpdstatus;
>  	struct sfh_base_info binfo;
>  	void __iomem *sensoraddr;

[Severity: High]
This is a pre-existing issue, but do these struct definitions leave
uninitialized stack memory that gets leaked to userspace?

In get_input_rep(), structures like acc_input and als_input are allocated on
the kernel stack without explicit initialization.

For ACCEL_IDX, the in_accel_shake_detection field in acc_input appears to
never be initialized before copying it to the report buffer:

	case ACCEL_IDX:
		...
		acc_input.in_accel_z_value = amd_sfh_float_to_int(accel_data.acceldata.z) / 100;
		memcpy(input_report, &acc_input, sizeof(acc_input));

Similarly for ALS_IDX, light_color_temp, chromaticity_x_value, and
chromaticity_y_value are only initialized conditionally, which can leave
those bytes uninitialized before being copied:

	case ALS_IDX:
		...
		if (binfo.sbase.s_prop[ALS_IDX].sf.feat & 0x2) {
			als_input.light_color_temp = als_data.light_color_temp;
			als_input.chromaticity_x_value =
				amd_sfh_float_to_int(als_data.chromaticity_x);
			als_input.chromaticity_y_value =
				amd_sfh_float_to_int(als_data.chromaticity_y);
		}

		report_size = sizeof(als_input);
		memcpy(input_report, &als_input, sizeof(als_input));

Since input_report is subsequently sent to userspace by the HID core, does
this expose uninitialized kernel stack memory?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260902134431.3146117-1-Basavaraj.Natikar@amd.com?part=3