[PATCH v2] iio: buffer: Ensure bounce buffer used for unaligned case is zeroed.

[Jonathan Cameron <jic23@kernel.org>]

iio_push_to_buffers_with_ts_unaligned() leaks uninitialized heap memory
to userspace if the data passed in is not a multiple of 8 bytes and the
timestamp is enabled.  Use memset() to zero it after resizing.

Fixes: 95ec3fdf2b79 ("iio: core: Introduce iio_push_to_buffers_with_ts_unaligned()")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260529121005.1470-1-kimjinseob88%40gmail.com
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
---
v2: Zero the new buffer not the old one (which might not exist)
    Drop bonus Reported-by:
---
 drivers/iio/industrialio-buffer.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c
index 5c3df993bea2..157b0415091a 100644
--- a/drivers/iio/industrialio-buffer.c
+++ b/drivers/iio/industrialio-buffer.c
@@ -2445,6 +2445,7 @@ int iio_push_to_buffers_with_ts_unaligned(struct iio_dev *indio_dev,
 				   indio_dev->scan_bytes, GFP_KERNEL);
 		if (!bb)
 			return -ENOMEM;
+		memset(bb, 0, indio_dev->scan_bytes);
 		iio_dev_opaque->bounce_buffer = bb;
 		iio_dev_opaque->bounce_buffer_size = indio_dev->scan_bytes;
 	}
-- 
2.54.0