Re: [PATCH] iio: buffer: Ensure bounce buffer used for unaligned case is zeroed.

[Sanjay Chitroda <sanjayembeddedse@gmail.com>]

On 31 May 2026 4:46:05 pm IST, Jonathan Cameron <jic23@kernel.org> wrote:
>iio_push_to_buffers_with_ts_unaligned() leaks uninitialized heap memory
>to userspace if the data passed in is not a multiple of 8 bytes and the
>timestamp is enabled.  Use memset() to zero it after resizing.
>
>Fixes: 95ec3fdf2b79 ("iio: core: Introduce iio_push_to_buffers_with_ts_unaligned()")
>Reported-by: Reported-by: Sashiko <sashiko-bot@kernel.org>

Hi Jonathan,

Looks like "Reported-by:" is duplicated.

Thanks, Sanjay

>Closes: https://sashiko.dev/#/patchset/20260529121005.1470-1-kimjinseob88%40gmail.com
>Signed-off-by: Jonathan Cameron <jic23@kernel.org>
>---
>Cc: Jinseob Kim <kimjinseob88@gmail.com>
>
>This is untested as I don't have any devices that use this and long
>ago dropped whatever hacks I used to test it originally.
>
>Jinseob, could you please test this with your OSF driver - at least
>make sure it doesn't stop the data coming out!
>---
> drivers/iio/industrialio-buffer.c | 1 +
> 1 file changed, 1 insertion(+)
>
>diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c
>index 9d66510a1d49..d930e70e12ff 100644
>--- a/drivers/iio/industrialio-buffer.c
>+++ b/drivers/iio/industrialio-buffer.c
>@@ -2466,6 +2466,7 @@ int iio_push_to_buffers_with_ts_unaligned(struct iio_dev *indio_dev,
> 				   indio_dev->scan_bytes, GFP_KERNEL);
> 		if (!bb)
> 			return -ENOMEM;
>+		memset(iio_dev_opaque->bounce_buffer, 0, indio_dev->scan_bytes);
> 		iio_dev_opaque->bounce_buffer = bb;
> 		iio_dev_opaque->bounce_buffer_size = indio_dev->scan_bytes;
> 	}