Re: [PATCH v2] iio: buffer: Ensure bounce buffer used for unaligned case is zeroed.

[Jonathan Cameron <jic23@kernel.org>]

On Thu, 4 Jun 2026 12:10:42 +0300
Andy Shevchenko <andriy.shevchenko@intel.com> wrote:

> On Thu, Jun 04, 2026 at 09:43:07AM +0100, Jonathan Cameron wrote:
> > iio_push_to_buffers_with_ts_unaligned() leaks uninitialized heap memory
> > to userspace if the data passed in is not a multiple of 8 bytes and the
> > timestamp is enabled.  Use memset() to zero it after resizing.  
> 
> ...
> 
> >  				   indio_dev->scan_bytes, GFP_KERNEL);
> >  		if (!bb)
> >  			return -ENOMEM;
> > +		memset(bb, 0, indio_dev->scan_bytes);  
> 
> May I suggest different approach, id est use __GFP_ZERO instead of hunting
> correct pointers?

That's a weird beast when combined with a krealloc so I was a bit
nervous about readability (and less so whether it was correct).
It should be fine in that we will either get stale data or zeros
because we always use this path to allocate the buffer so if you
think it is obviously fine then I don't mind.

The oddities are that if an object grows within a slab but doesn't need
a new one we are relying on those bits happening to be zero based on the
original allocation doing __GFP_ZERO as well (as it's the same call)

I'm nervous though as that region off the end is sometimes used for
debug objects and I really don't understand that bit of slab well enough.
If it actually does this, then seems like we'd end up with a lot of
nasty corner cases so I assume it doesn't.  However, I couldn't convince
myself enough not to just force a memset of the whole thing.

> 
> With Best Regards,
> Andy Shevchenko
> 
> 
>