Re: [PATCH RFC v3 6/6] iio: osf: register IIO devices from capabilities

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Uninitialized kernel heap memory is leaked to userspace through IIO buffer padding.
--

commit 9319c55b6b77ef9ce1f7e526e5ce9463c217bc27
Author: Jinseob Kim <kimjinseob88@gmail.com>

iio: osf: register IIO devices from capabilities
    
This commit updates the Open Sensor Fusion (OSF) driver to parse the first
capability report and create corresponding IIO devices. It also adds logic
to cache the latest samples and push enabled buffers directly to userspace.

> diff --git a/drivers/iio/opensensorfusion/osf_iio.c b/drivers/iio/opensensorfusion/osf_iio.c
> new file mode 100644
> index 0000000000000..5e509987876d7
> --- /dev/null
> +++ b/drivers/iio/opensensorfusion/osf_iio.c
[ ... ]
> +int osf_iio_push_sample(struct iio_dev *indio_dev, const s32 *values,
> +			unsigned int channel_count)
> +{
> +	struct osf_iio_state *state = iio_priv(indio_dev);
> +	s32 scan[OSF_MAX_SAMPLE_CHANNELS] = { };
> +	s64 timestamp;
> +
> +	if (channel_count != state->spec->channel_count)
> +		return -EPROTO;
> +
> +	memcpy(scan, values, channel_count * sizeof(*values));
> +
> +	/* Buffer state can change here; IIO rechecks it during the push path. */
> +	if (!iio_buffer_enabled(indio_dev))
> +		return 0;
> +
> +	timestamp = iio_get_time_ns(indio_dev);
> +
> +	return iio_push_to_buffers_with_ts_unaligned(indio_dev, scan,
> +						     channel_count * sizeof(*scan),
> +						     timestamp);

[Severity: High]
Does this leak uninitialized kernel heap memory to userspace?

The driver passes channel_count * sizeof(*scan) as the data_sz, which
is 12 bytes for a 3-axis sensor or 4 bytes for temperature.

However, the IIO core calculates the buffer's scan_bytes to include padding
to 8-byte align the 64-bit timestamp. This results in a scan size of 24
bytes for a 3-axis sensor, or 16 bytes for temperature.

Looking at iio_push_to_buffers_with_ts_unaligned(), the bounce buffer is
allocated without zeroing the memory:

drivers/iio/industrialio-buffer.c:iio_push_to_buffers_with_ts_unaligned() {
	...
	if (iio_dev_opaque->bounce_buffer_size !=  indio_dev->scan_bytes) {
		void *bb;

		bb = devm_krealloc(&indio_dev->dev,
				   iio_dev_opaque->bounce_buffer,
				   indio_dev->scan_bytes, GFP_KERNEL);
		...
	}
	memcpy(iio_dev_opaque->bounce_buffer, data, data_sz);
	return iio_push_to_buffers_with_timestamp(indio_dev, ...);
}

It only copies data_sz bytes into the bounce buffer and then appends the
8-byte timestamp, leaving the intermediate padding bytes uninitialized.
When this buffer is pushed to the kfifo, the uninitialized kernel memory is
exposed to userspace.

Could we pass a correctly padded and zero-initialized structure, or provide
the exact size including padding up to the timestamp, to avoid leaking
these bytes?

> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260529121005.1470-1-kimjinseob88@gmail.com?part=6