Linux HID-steam short read vulnerability fix and hardening details

Summary of Key Vulnerability Information Vulnerability Overview Vulnerability Name: HID: steam: Reject short reads Vulnerability Type: Defect in the handling of short reads for the Steam controller in the HID driver Problem Description: reports the message size, but the driver did not verify whether the number of bytes actually read matched the expected size, which could cause issues when a short read occurs. Fix Commit: commit Reporter: Related report by syzbot+HID_FEATURE_REPORT (syzbot+HID_FEATURE_REPORT@systemtap.com) Related References: - Report link: https://syzkaller.appspot.com/bug?id=75f3f90f1c510602a36 - Class link: https://syzkaller.appspot.com/bug?id=75f3f90f1c510602a36 Scope of Impact Affected File: Affected Function: Affected Component: Steam controller driver (hid-steam) within the Linux kernel HID subsystem Affected Versions: Linux kernel stable branch (linux.git) Fix Details Fix Method: Added validation and handling logic for short reads in the function Core Changes: 1. Validate whether the number of bytes read ( ) is less than the expected value (e.g., ) 2. Return an error code for short read cases (e.g., ) 3. Use to limit the copy length to avoid out-of-bounds access 4. Return an error for abnormal cases such as or POC / Fix Code (extracted from diff) ```c --- a/drivers/hid/hid-steam.c +++ b/drivers/hid/hid-steam.c @@ -356,6 +356,13 @@ static int steam_recv_report(struct steam_device steam, u8 buf) { / All reports start with a two byte header. We must read at least two bytes to get a sensible output. */ if (size hdev->report_enum[HID_FEATURE_REPORT].report_id_hash[0]; if (!r) { hid_err(steam->hdev, "No HID_FEATURE_REPORT submitted - nothing to read\n"); buf, hid_err(steam->hdev, "No HID_FEATURE_REPORT submitted - nothing to read\n"); buf, hid_err(steam->hdev, "No HID_FEATURE_REPORT submitted - nothing to read\n"); buf, hid_err(steam->hdev, "No HID_FEATURE_REPORT submitted - nothing to read\n"); buf, hid_err(steam->hdev, "No HID_FEATURE_REPORT submitted - nothing to read\n"); buf, hid_err(steam->hdev, "No HID_FEATURE_REPORT submitted - nothing to read\n"); buf, hid_err(steam->hdev, "No HID_FEATURE_REPORT submitted - nothing to read\n"); buf, hid_err(steam->hdev, "No HID_FEATURE_REPORT submitted - nothing to read\n"); buf, hid_err(steam->hdev, "No HID_FEATURE_REPORT submitted - nothing to read\n"); buf, hid_err(steam->hdev, "No HID_FEATURE_REPORT submitted - nothing to read\n"); buf, hid_err(steam->hdev, "No HID_FEATURE_REPORT submitted - nothing to read\n"); buf, hid_err(steam->hdev, "No HID_FEATURE_REPORT submitted - nothing to read\n"); buf, hid_err(steam->hdev, "No HID_FEATURE_REPORT submitted - nothing to read\n"); buf, hid_err(steam->hdev, "No HID_FEATURE_REPORT submitted - nothing to read\n"); buf, hid_err(steam->hdev, "No HID_FEATURE_REPORT submitted - nothing to read\n"); buf, hid_err(steam->hdev, "No HID_FEATURE_REPORT submitted - nothing to read\n"); buf, hid_err(steam->hdev, "No HID_FEATURE_REPORT submitted - nothing to read\n"); buf, hid_err(steam->hdev, "No HID_FEATURE_REPORT submitted - nothing to read\n"); buf, hid_err(steam->hdev, "No HID_FEATURE_REPORT submitted - nothing to read\n"); buf, hid_err(steam->hdev, "No HID_FEATURE_REPORT submitted - nothing to read\n"); buf, hid_err(steam->hdev, "No HID_FEATURE_REPORT submitted - nothing to read\n"); buf, hid_err(steam->hdev, "No HID_FEATURE_REPORT submitted - nothing to read\n"); buf, hid_err(steam->hdev, "No HID_FEATURE_REPORT submitted - nothing to read\n"); buf, hid_err(steam->hdev, "No HID_FEATURE_REPORT submitted - nothing to read\n"); buf, hid_err(steam->hdev, "No HID_FEATURE_REPORT submitted - nothing to read\n"); buf, hid_err(steam->hdev, "No HID_FEATURE_REPORT submitted - nothing to read\n"); buf, hid_err(steam->hdev, "No HID_FEATURE_REPORT submitted - nothing to read\n"); buf, hid_err(steam->hdev, "No HID_FEATURE_REPORT submitted - nothing to read\n"); buf, hid_err(steam->hdev, "No HID_FEATURE_REPORT submitted - nothing to read\n"); buf, hid_err(steam->hdev, "No HID_FEATURE_REPORT submitted - nothing to read\n"); buf, hid_err(steam->hdev, "No HID_FEATURE_REPORT submitted - nothing to read\n"); buf, hid_err(steam->hdev, "No HID_FEATURE_REPORT submitted - nothing to read\n"); buf, hid_err(steam->hdev, "No HID_FEATURE_REPORT submitted - nothing to read\n"); buf, hid_err(steam->hdev, "No HID_FEATURE_REPORT submitted - nothing to read\n"); buf, hid_err(steam->hdev, "No HID_FEATURE_REPORT submitted - nothing to read\n"); buf, hid_err(steam->hdev, "No HID_FEATURE_REPORT submitted - nothing to read\n"); buf, hid_err(steam->hdev, "No HID_FEATURE_REPORT submitted - nothing to read\n"); buf, hid_err(steam->hdev, "No HID_FEATURE_REPORT submitted - nothing to read\n"); buf, hid_err(steam->hdev, "No HID_FEATURE_REPORT submitted - nothing to read\n"); buf, hid_err(steam->hdev, "No HID_FEATURE_REPORT submitted - nothing to read\n"); buf, hid_err(steam->hdev, "No HID_FEATURE_REPORT submitted - nothing to read\n"); buf, hid_err(steam-

Goal Reached Thanks to every supporter — we hit 100%!

Linux HID-steam short read vulnerability fix and hardening details