Re: [PATCH v2] iio: buffer: Ensure bounce buffer used for unaligned case is zeroed.

["Nuno Sá" <noname.nuno@gmail.com>]

On Mon, 2026-08-03 at 02:22 +0100, Jonathan Cameron wrote:
> From: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
> 
> iio_push_to_buffers_with_ts_unaligned() leaks uninitialized heap memory
> to userspace if the data passed in is not a multiple of 8 bytes and the
> timestamp is enabled. Specify __GFP_ZERO for the devm_krealloc()
> to ensure any extra space is cleared.
> 
> Fixes: 95ec3fdf2b79 ("iio: core: Introduce iio_push_to_buffers_with_ts_unaligned()")
> Reported-by: Sashiko <sashiko-bot@kernel.org>
> Closes: https://sashiko.dev/#/patchset/20260529121005.1470-1-kimjinseob88%40gmail.com
> Signed-off-by: Jonathan Cameron <jonathan.cameron@oss.qualcomm.com>
> ---

Reviewed-by: Nuno Sá <nuno.sa@analog.com>

> 
> v1: https://patchwork.kernel.org/project/linux-iio/patch/20260604084307.640053-1-jic23@kernel.org/
> 
> Drop the memset in favour of __GFP_ZERO.  (Andy)
> Thanks to Nuno who pointed out there is a self test to ensure this
> behaves as expected.
> 
>  drivers/iio/industrialio-buffer.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c
> index 531fc4ccc15d..4960c8377932 100644
> --- a/drivers/iio/industrialio-buffer.c
> +++ b/drivers/iio/industrialio-buffer.c
> @@ -2464,7 +2464,8 @@ int iio_push_to_buffers_with_ts_unaligned(struct iio_dev *indio_dev,
>  
>  		bb = devm_krealloc(&indio_dev->dev,
>  				   iio_dev_opaque->bounce_buffer,
> -				   indio_dev->scan_bytes, GFP_KERNEL);
> +				   indio_dev->scan_bytes,
> +				   GFP_KERNEL | __GFP_ZERO);
>  		if (!bb)
>  			return -ENOMEM;
>  		iio_dev_opaque->bounce_buffer = bb;