From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f47.google.com (mail-wm1-f47.google.com [209.85.128.47]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1606A81AA8 for ; Sun, 28 Jun 2026 00:41:18 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.47 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782607281; cv=none; b=lEkr1tSjY2hD1S/Jndf41dNj4sCUIf1t/bKGICVhB0c9URfKe53iFcEZFyCvVftrm9rGOZ9584mEgQxZ9s7mzr5tHRA4QuOHWYBVXMQWx8lWKzHTa0ijtay51TT9j+NaGzjY1L8sJd9bO20sC2i7SwJi20SLVmHEWdeNkj/MCOo= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782607281; c=relaxed/simple; bh=rWjqEsg8y8fWOyDjFJ9raEp1vcQ0MX+Lr9ujI9x9ac0=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=faB2XohskQCa1WWivCa492O6uP/URMtgyNge1IZytAq4lsjKrDTOEuGwpYcIIppkRbDmmT6KoGDt3duZcB+pTD0QWFno7J59XLHsCQeNknve0p3dV2CGF7ypDdj3ON1s1sqFiSdOXWPHtBGEKqnzQ5o7oYuttJCD8iPWNwHdhEo= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=TuXv5j2U; arc=none smtp.client-ip=209.85.128.47 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="TuXv5j2U" Received: by mail-wm1-f47.google.com with SMTP id 5b1f17b1804b1-49241dbf9c1so19774935e9.2 for ; Sat, 27 Jun 2026 17:41:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1782607277; x=1783212077; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=7pGgA6WV0tEq+UyEYEyNRruqDa18VnUsaxpJDdI4WVw=; b=TuXv5j2UVtuyPRzLIHokGWG9fFK8tS5oXbkZG8Yi3oauUZPsOzO/x30ru3ZE/cLul1 m2w1/oCsoNnD5Ny6oe2K8QzUrOE0TtUuW+pBwi7F39Psosp47v2A5CeHYghjYlyyVCNm Sow7JeUF1GicCASowHeUaIRNrkMs+g9hj35oCl6UDZHmCzhRhLZmBN9Js+HT1d/12S5W ulO+Udq319UZE/Il42O/laeO6C7slOyQblcgmCHkgG3WlwfzzuxjSAT9QUpwYim/QXJF U0pGjV7H27TnZaTIIyja2pL0jrZTU7lRUT/pR4EXR71CAvPPesMpxk6hcReerv6+ytGt X7BQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782607277; x=1783212077; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=7pGgA6WV0tEq+UyEYEyNRruqDa18VnUsaxpJDdI4WVw=; b=pBXN3/I4mhtXfJxAcpWsKQ+agMogvYe0CZ9wSj93curJtYiBshkgs6cfD+UNghO7SN Ya4Ux0V2Fqz57j5Q3zqul88OaFt6XcBmlU627X2a+SB9Rdlq5k8tQMBH5dJEVur2nzzm jaBviEQwvVnH8qQ773RzdcMRbLOB5AAnhGi12l6XXx7kQc4I3nuo4fw9mhbFAVx+EOed P1EKFGhVNQOtD127RBUFcOFfFOi1jG+eq7D87JTxoyxmk700Y1o3qlDDtkmTzp47QI0/ mrvD14gesQFrnIRsj3/fjHlmGVNgLwqisNPBgOWgwqVzsiBmYNIu9f2BzJkcADunb/V3 lqnQ== X-Forwarded-Encrypted: i=1; AFNElJ8/Zm3frFskxTgkzXHCWW6lc8O1/6HDfuW/8KzWhYbanHar3pOI2NGtTuFzAD66XP9n46STUGFvKRKQA14=@vger.kernel.org X-Gm-Message-State: AOJu0Yxd0HFm8z2WY4vTcaWnR/UvAPIv74fADVVpnHn+Aq0xkiRCFOfL WtXCCnY0AKxlR+wc6iGWYHlKVtCgT1GWGRr1iJ92sLAZW8c0Q8235ThkD9cOpiAdn5Y= X-Gm-Gg: AfdE7ckCQ3W8cOvmFz/E+0i1taJv1dqacb7E9XTRSIOP75UJS1fOOnO5mRt4saFJ6Ti D3rs4sxXhFC/acQkMD4ByACPcJVsRSD1Xr4ok1oTeNUdYxQvhlqgCGyw5e7NOBmBIFK/qieJLuW u9RJhvqWItlygbS0QjaUBFlSJHoVtX1Hs2TyZ+oNWOFnuO+5299ynyFecx4TYb6v0JAf3/TDaTf VIw/HAoPOpnXAhOlTmt+75ZUfrS7teaeocxh/9pKA2jJtlS9nP3sDUZCeX30UJV6hU21iUvcVXs /ODMIuTdnFY0y1WBBTociLYxxul+LjrJWZxZc06H1kW7PyT7idPi48fIGW4Vutw/aUTcRNo8BBW wuXWZMzWHRbSObdcYvJBBTz9yijJBsoH4vIqSE37xQQjm0IZuPUkHtpBOGJi3Q1FjPLEF81E7L0 zov8RzixeGTk4EgdIb1OFBys2x3A== X-Received: by 2002:a05:600c:4e4c:b0:492:3773:a230 with SMTP id 5b1f17b1804b1-49266893338mr175946575e9.27.1782607277184; Sat, 27 Jun 2026 17:41:17 -0700 (PDT) Received: from Dev-Null-MSI ([2a0d:3344:52ac:a808:98a4:4381:be45:536f]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-49268fde98csm208373005e9.6.2026.06.27.17.41.14 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 27 Jun 2026 17:41:15 -0700 (PDT) From: Yousef Alhouseen To: Jiri Kosina , Benjamin Tissoires Cc: linux-input@vger.kernel.org, linux-kernel@vger.kernel.org, Vicki Pfau , stable@vger.kernel.org, syzbot+75f3f9bff8c510602d36@syzkaller.appspotmail.com, Yousef Alhouseen Subject: [PATCH] HID: steam: reject short serial number reports Date: Sun, 28 Jun 2026 02:41:06 +0200 Message-ID: <20260628004106.26920-1-alhouseenyousef@gmail.com> X-Mailer: git-send-email 2.54.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit steam_recv_report() may return a short positive response and copies only the bytes actually received. steam_get_serial() nevertheless reads the full three-byte header and trusts its length without checking that the serial payload was returned. A malformed USB device can therefore make the driver read uninitialized stack bytes. With a complete-looking short header, those bytes can also be copied into steam->serial_no and printed. Account for the stripped report ID in the return value and reject replies that do not contain both the header and its declared payload. Fixes: c164d6abf384 ("HID: add driver for Valve Steam Controller") Reported-by: syzbot+75f3f9bff8c510602d36@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=75f3f9bff8c510602d36 Cc: stable@vger.kernel.org Signed-off-by: Yousef Alhouseen --- drivers/hid/hid-steam.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/drivers/hid/hid-steam.c b/drivers/hid/hid-steam.c index 197126d6e081..8c8bfb10e8b8 100644 --- a/drivers/hid/hid-steam.c +++ b/drivers/hid/hid-steam.c @@ -454,11 +454,20 @@ static int steam_get_serial(struct steam_device *steam) ret = steam_recv_report(steam, reply, sizeof(reply)); if (ret < 0) goto out; + /* hid_hw_raw_request() counts the stripped report ID byte. */ + if (ret < 4) { + ret = -EIO; + goto out; + } if (reply[0] != ID_GET_STRING_ATTRIBUTE || reply[1] < 1 || reply[1] > sizeof(steam->serial_no) || reply[2] != ATTRIB_STR_UNIT_SERIAL) { ret = -EIO; goto out; } + if (ret - 1 < 3 + reply[1]) { + ret = -EIO; + goto out; + } reply[3 + STEAM_SERIAL_LEN] = 0; strscpy(steam->serial_no, reply + 3, reply[1]); out: -- 2.54.0