[PATCH v4 04/11] HID: steam: Zero-initialize reply in serial lookup
Vicki Pfau <[email protected]> Tue, 28 Jul 2026 18:52:26 -0700
| Newsgroups | org.kernel.vger.linux-input |
|---|---|
| Message-ID | <[email protected]> |
When requesting the serial number from a controller, the function will do some basic bounds checking to make sure the reply is valid, as well as capping off the reply with a null byte before copying. However, the error logging can leak uninitialized memory in some cases. We can simplify and solve this by just zero-initalizing the reply memory eagerly instead. Signed-off-by: Vicki Pfau <[email protected]> --- drivers/hid/hid-steam.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/hid/hid-steam.c b/drivers/hid/hid-steam.c index 983d18d1de4f..8bad79205b57 100644 --- a/drivers/hid/hid-steam.c +++ b/drivers/hid/hid-steam.c @@ -447,7 +447,7 @@ static int steam_get_serial(struct steam_device *steam) */ int ret = 0; u8 cmd[] = {ID_GET_STRING_ATTRIBUTE, sizeof(steam->serial_no), ATTRIB_STR_UNIT_SERIAL}; - u8 reply[3 + STEAM_SERIAL_LEN + 1]; + u8 reply[3 + STEAM_SERIAL_LEN + 1] = {0}; mutex_lock(&steam->report_mutex); ret = steam_send_report(steam, cmd, sizeof(cmd)); @@ -461,7 +461,6 @@ static int steam_get_serial(struct steam_device *steam) ret = -EIO; goto out; } - reply[3 + STEAM_SERIAL_LEN] = 0; strscpy(steam->serial_no, reply + 3, reply[1]); out: mutex_unlock(&steam->report_mutex); -- 2.54.0