[PATCH] iio: buffer: Ensure bounce buffer used for unaligned case is zeroed.

[Jonathan Cameron <jic23@kernel.org>]

iio_push_to_buffers_with_ts_unaligned() leaks uninitialized heap memory
to userspace if the data passed in is not a multiple of 8 bytes and the
timestamp is enabled.  Use memset() to zero it after resizing.

Fixes: 95ec3fdf2b79 ("iio: core: Introduce iio_push_to_buffers_with_ts_unaligned()")
Reported-by: Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://sashiko.dev/#/patchset/20260529121005.1470-1-kimjinseob88%40gmail.com
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
---
Cc: Jinseob Kim <kimjinseob88@gmail.com>

This is untested as I don't have any devices that use this and long
ago dropped whatever hacks I used to test it originally.

Jinseob, could you please test this with your OSF driver - at least
make sure it doesn't stop the data coming out!
---
 drivers/iio/industrialio-buffer.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c
index 9d66510a1d49..d930e70e12ff 100644
--- a/drivers/iio/industrialio-buffer.c
+++ b/drivers/iio/industrialio-buffer.c
@@ -2466,6 +2466,7 @@ int iio_push_to_buffers_with_ts_unaligned(struct iio_dev *indio_dev,
 				   indio_dev->scan_bytes, GFP_KERNEL);
 		if (!bb)
 			return -ENOMEM;
+		memset(iio_dev_opaque->bounce_buffer, 0, indio_dev->scan_bytes);
 		iio_dev_opaque->bounce_buffer = bb;
 		iio_dev_opaque->bounce_buffer_size = indio_dev->scan_bytes;
 	}
-- 
2.54.0