DF-4230 — cyapa: cyapa_poll_thread reads uninitialized regs.stat when the device stops responding — garbage byte drives the re-init state machine

Where

sys/dev/smbus/cyapa/cyapa.c

• cyapa.c:1164 — struct cyapa_regs regs; — local, never initialized.
• cyapa.c:1178-1184 — smbus_trans(..., (void *)&regs, sizeof(regs), NULL) only writes regs on success; on bus error/NAK regs keeps its previous contents (uninitialized on the first failing iteration).
• cyapa.c:1191-1193 — the reset decision is evaluated regardless of the smbus error: c if (cyapa_reset || ((regs.stat & CYAPA_STAT_RUNNING) == 0 && (unsigned)(ticks - last_reset) > TIME_TO_RESET)) { → reads the uninitialized regs.stat.
• cyapa.c:1196 — consequence: init_device(sc->dev, NULL, sc->addr, 2) is invoked (bootloader handshake hammering on the SMBus) based on garbage.

Impact

Purely a logic/robustness defect: an uninitialized stack byte decides whether the driver spams the bus with bootloader commands every 3 seconds while the device is dead. No info leak (the byte is never printed), no memory unsafety. Info severity, hardening class.

PoC — model_uninit_regs.c

Exact branch model with an smbus-failure stub and stack poisoning (observed on the audit guest, run.log): - poison byte 0x2d (RUNNING clear) → re-init triggered from garbage; - poison byte 0xcd (RUNNING set) → re-init suppressed by garbage. Both decisions flip solely on the uninitialized byte — 2/2 each.

Fix

Zero regs once before the loop (fix.diff): bzero(&regs, sizeof(regs)); (or memset) at declaration, giving regs.stat = 0 → RUNNING bit clear → deterministic re-init behavior.

Build / run

cc -O0 -Wall -o model_uninit_regs model_uninit_regs.c
./model_uninit_regs 0x2d
./model_uninit_regs 0xcd

DF-4230 — VERDICT

Status: untested (kernel-side run requires the trackpad hardware; the uninitialized-read mechanism and its control over the reset decision are demonstrated deterministically by the exact-branch harness on the guest).

Root cause (line-accurate)

struct cyapa_regs regs;                          /* cyapa.c:1164 uninit */
...
error = smbus_request_bus(bus, sc->dev, SMB_WAIT);
if (error == 0) {
        error = smbus_trans(..., (void *)&regs, sizeof(regs), NULL);
        if (error == 0)
                isidle = cyapa_raw_input(sc, &regs);   /* only success writes regs */
}
if (cyapa_reset ||
    ((regs.stat & CYAPA_STAT_RUNNING) == 0 &&          /* cyapa.c:1192 UNINIT READ */
     (unsigned)(ticks - last_reset) > TIME_TO_RESET)) {
        cyapa_reset = 0;
        last_reset = ticks;
        init_device(sc->dev, NULL, sc->addr, 2);       /* cyapa.c:1196 */
}

regs is only written on a successful transfer. When the device is absent/glitching (first iteration fails), regs.stat is uninitialized stack; after 3 s of failures the garbage bit-7 (CYAPA_STAT_RUNNING) decides whether init_device() bootloader handshakes are re-issued every 3 s. (isidle at cyapa.c:1168 also goes stale on failure — same family.)

Harness result (audit guest, cc 8.3, -O0)

poison 0x2d (RUNNING clear): after 31 failing iterations: reinited=1  <- from garbage
poison 0xcd (RUNNING set)  : after 40 failing iterations: reinited=0  <- from garbage

Both outcomes of the decision flip purely on the uninitialized byte (2/2 runs each) — the driver's bus-recovery behavior is controlled by stale stack data.

Why only Info

• The value never leaves the kernel (no printf of regs on the failure path — cyapa_raw_input, which prints, only runs on success).
• No memory-safety consequence; the worst case is unnecessary SMBus bootloader traffic while the device is dead.

Recommended fix

Initialize regs before the poll loop (fix.diff): bzero(&regs, sizeof(regs)); — then stat=0 ⇒ RUNNING clear ⇒ the existing 3-second backoff governs re-init deterministically.

Fix validation

Hardware-gated (poll thread unreachable in QEMU). fix_status = not_testable; the fix is a one-line initialization.

Fix status (batch validation)

Applied with the 36 sibling fix.diffs of this batch in findings/poc/_batch41/all_fixes.patch; single in-guest make -j6 nativekernel KERNCONF=X86_64_GENERIC completed RC=0 with zero errors under -Werror (full log: findings/poc/_batch41/fix_build8.log). Behavior A/B intentionally skipped for this Info-tier item.