KMSAN: uninit-value in steam_register

Status: upstream: reported on 2026/06/09 08:35
Subsystems: input usb
Labels: prio:high
[Documentation on labels]
Reported-by: syzbot+75f3f9bff8c510602d36@syzkaller.appspotmail.com
Fix commit: HID: steam: Reject short reads
Patched on: [ci-upstream-linux-next-kasan-gce-root], missing on: [ci-qemu-gce-upstream-auto ci-qemu-native-arm64-kvm ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-qemu2-riscv64 ci-snapshot-upstream-root ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-arm64 ci-upstream-gce-leak ci-upstream-kasan-badwrites-root ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce-386-root ci-upstream-kmsan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci-upstream-rust-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce ci2-upstream-usb]
First crash: 67d, last: 65d
▶ ▼ ✨ AI Jobs (1)
ID Workflow Result Correct Bug Created Started Finished Revision
30c5f3ed assessment-security DenialOfService: ❌ Exploitable: ❌ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ✅ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ✅ ❓ KMSAN: uninit-value in steam_register 2026/06/09 13:31 2026/06/09 13:31 2026/06/09 14:15 c36c07f6
▶ ▼ Discussions (3)
Title Replies (including bot) Last reply
[PATCH] HID: hid-steam: fix uninit-value access in steam_get_serial 6 (6) 2026/08/04 01:41
[PATCH] HID: steam: reject short serial number reports 3 (3) 2026/06/28 16:23
[syzbot] [usb?] [input?] KMSAN: uninit-value in steam_register 0 (1) 2026/06/09 08:35

Sample crash report:
hid-steam 0003:28DE:1102.0007: unknown main item tag 0x0
hid-steam 0003:28DE:1102.0007: unknown main item tag 0x0
hid-steam 0003:28DE:1102.0007: : USB HID v7f.fd Device [HID 28de:1102] on usb-dummy_hcd.1-1/input0
=====================================================
BUG: KMSAN: uninit-value in steam_get_serial drivers/hid/hid-steam.c:457 [inline]
BUG: KMSAN: uninit-value in steam_register+0xd83/0x10e0 drivers/hid/hid-steam.c:965
 steam_get_serial drivers/hid/hid-steam.c:457 [inline]
 steam_register+0xd83/0x10e0 drivers/hid/hid-steam.c:965
 steam_probe+0x6f1/0x19b0 drivers/hid/hid-steam.c:1273
 __hid_device_probe drivers/hid/hid-core.c:2822 [inline]
 hid_device_probe+0x60d/0xb90 drivers/hid/hid-core.c:2859
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x4d5/0xe40 drivers/base/dd.c:709
 __driver_probe_device+0x2fb/0x410 drivers/base/dd.c:871
 driver_probe_device+0x70/0x8f0 drivers/base/dd.c:901
 __device_attach_driver+0x4ee/0x950 drivers/base/dd.c:1029
 bus_for_each_drv+0x3e3/0x680 drivers/base/bus.c:500
 __device_attach+0x3c5/0x5f0 drivers/base/dd.c:1101
 device_initial_probe+0x126/0x170 drivers/base/dd.c:1156
 bus_probe_device+0x287/0x530 drivers/base/bus.c:613
 device_add+0x12e3/0x1c90 drivers/base/core.c:3706
 hid_add_device+0x440/0x5d0 drivers/hid/hid-core.c:3003
 usbhid_probe+0x1a25/0x20e0 drivers/hid/usbhid/hid-core.c:1449
 usb_probe_interface+0xd51/0x1440 drivers/usb/core/driver.c:396
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x4d5/0xe40 drivers/base/dd.c:709
 __driver_probe_device+0x2fb/0x410 drivers/base/dd.c:871
 driver_probe_device+0x70/0x8f0 drivers/base/dd.c:901
 __device_attach_driver+0x4ee/0x950 drivers/base/dd.c:1029
 bus_for_each_drv+0x3e3/0x680 drivers/base/bus.c:500
 __device_attach+0x3c5/0x5f0 drivers/base/dd.c:1101
 device_initial_probe+0x126/0x170 drivers/base/dd.c:1156
 bus_probe_device+0x287/0x530 drivers/base/bus.c:613
 device_add+0x12e3/0x1c90 drivers/base/core.c:3706
 usb_set_configuration+0x3484/0x3b60 drivers/usb/core/message.c:2268
 usb_generic_driver_probe+0xfc/0x290 drivers/usb/core/generic.c:250
 usb_probe_device+0x38d/0x690 drivers/usb/core/driver.c:291
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x4d5/0xe40 drivers/base/dd.c:709
 __driver_probe_device+0x2fb/0x410 drivers/base/dd.c:871
 driver_probe_device+0x70/0x8f0 drivers/base/dd.c:901
 __device_attach_driver+0x4ee/0x950 drivers/base/dd.c:1029
 bus_for_each_drv+0x3e3/0x680 drivers/base/bus.c:500
 __device_attach+0x3c5/0x5f0 drivers/base/dd.c:1101
 device_initial_probe+0x126/0x170 drivers/base/dd.c:1156
 bus_probe_device+0x287/0x530 drivers/base/bus.c:613
 device_add+0x12e3/0x1c90 drivers/base/core.c:3706
 usb_new_device+0x106a/0x2120 drivers/usb/core/hub.c:2695
 hub_port_connect drivers/usb/core/hub.c:5567 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]
 port_event drivers/usb/core/hub.c:5871 [inline]
 hub_event+0x5404/0x77c0 drivers/usb/core/hub.c:5953
 process_one_work kernel/workqueue.c:3314 [inline]
 process_scheduled_works+0xb65/0x1e40 kernel/workqueue.c:3397
 worker_thread+0xee4/0x1590 kernel/workqueue.c:3478
 kthread+0x53a/0x5f0 kernel/kthread.c:436
 ret_from_fork+0x20f/0x8d0 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

Local variable reply.i created at:
 steam_get_serial drivers/hid/hid-steam.c:448 [inline]
 steam_register+0x180/0x10e0 drivers/hid/hid-steam.c:965
 steam_probe+0x6f1/0x19b0 drivers/hid/hid-steam.c:1273

CPU: 0 UID: 0 PID: 7403 Comm: kworker/0:6 Tainted: G             L      syzkaller #0 PREEMPT(lazy) 
Tainted: [L]=SOFTLOCKUP
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026
Workqueue: usb_hub_wq hub_event
=====================================================

Crashes (3):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/06/07 01:24 upstream 8e65320d91cd cc095639 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in steam_register
2026/06/05 08:26 upstream 9154c4af7829 197909be .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in steam_register
2026/06/05 08:25 upstream 9154c4af7829 197909be .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kmsan-gce-root KMSAN: uninit-value in steam_register
* Struck through repros no longer work on HEAD.