From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mgamail.intel.com (mgamail.intel.com [192.198.163.7]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F0DA43C8C65; Fri, 15 May 2026 09:50:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=192.198.163.7 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778838637; cv=none; b=T3AVKQy+o5H2wdNlJIedXNtwp12aLL7yzSNzYtUToijbX4Q7AqTAP63shnPJ8WXIfBOjDbCLvNGFzwIXs7IezJMyviSkG1ZxUK7MNH4+Oxx1u7hRtQilLL5FZqYong3J/VVgcijYuiVHB7PIdP+qiZC5PJKiIaMuQVg1nHEqch4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778838637; c=relaxed/simple; bh=JdWqPrFuCYRw7pfqkRXLJdxKgObVBq7GjJajWDEOmcg=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=OVe0D8XGDguYQq4G8h4FsyzqWTF4UGXm05b9fyXgDF9GFnAyqOiZdnMWwXXnWoyLm2YjTLInPrv54VJl/Z2PlN4q/s6ZDhM1l2NIkIOZ0zB3Zg5K6qRCRmmqQX//nI7ahX6s4Wxp+CgWFfl17/NHz80CLW6QyRtKJv1w9JYUxjI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com; spf=pass smtp.mailfrom=intel.com; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b=jZzWPytA; arc=none smtp.client-ip=192.198.163.7 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=intel.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=intel.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=intel.com header.i=@intel.com header.b="jZzWPytA" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=intel.com; i=@intel.com; q=dns/txt; s=Intel; t=1778838636; x=1810374636; h=date:from:to:cc:subject:message-id:references: mime-version:in-reply-to; bh=JdWqPrFuCYRw7pfqkRXLJdxKgObVBq7GjJajWDEOmcg=; b=jZzWPytAJKV/SmvypItRhz9tWFsot55lDVOimgLTvFq7eluq8Xb3aiEL wmSfZI3X9Zt9z+N8j1iVKPv1S4M9OPMnIRfFUXbz5lKRaKU2d5JGS178K vmH04lcNsQ/2rwuUfmVVt/+9fe5ytbLEDyGe4whqTYt4A/lsBAYVqGO4E 47Kb0iaul1pcgap63n7e6eBIlvDsimka3QCgUhKtkfMZmUdLD8dF4E+Ww j71YFOvhptW9H6Wn9CLGRqHy6N6aBygOQL22Jka03OmB1Xv/leYYiLE/o dz0Ht6JCxhuyL8dyHIslf0h6lA5d9Q1TeWXOhUw5P309IqdpemGXzs0z5 g==; X-CSE-ConnectionGUID: PtQFSLm3TNewbij8a4mxdw== X-CSE-MsgGUID: MsvGYj/0R/apw6Zz8mP0PQ== X-IronPort-AV: E=McAfee;i="6800,10657,11786"; a="105250210" X-IronPort-AV: E=Sophos;i="6.23,236,1770624000"; d="scan'208";a="105250210" Received: from fmviesa009.fm.intel.com ([10.60.135.149]) by fmvoesa101.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 15 May 2026 02:50:35 -0700 X-CSE-ConnectionGUID: qjRCK1zYTBKhk3DMGEdhjw== X-CSE-MsgGUID: W0HK/LpOR/mxphhtsgKiHA== X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="6.23,236,1770624000"; d="scan'208";a="232253769" Received: from vpanait-mobl.ger.corp.intel.com (HELO localhost) ([10.245.245.33]) by fmviesa009-auth.fm.intel.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 15 May 2026 02:50:33 -0700 Date: Fri, 15 May 2026 12:50:30 +0300 From: Andy Shevchenko To: joshua.crofts1@gmail.com Cc: Jonathan Cameron , David Lechner , Nuno =?iso-8859-1?Q?S=E1?= , Andy Shevchenko , Gregor Boirie , linux-iio@vger.kernel.org, linux-kernel@vger.kernel.org, Sashiko , stable@vger.kernel.org Subject: Re: [PATCH] iio: magnetometer: ak8975: fix potential kernel stack memory leak Message-ID: References: <20260514-magnetometer-kernel-mem-leak-v1-1-35b48d699faf@gmail.com> Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20260514-magnetometer-kernel-mem-leak-v1-1-35b48d699faf@gmail.com> Organization: Intel Finland Oy - BIC 0357606-4 - c/o Alberga Business Park, 6 krs, Bertel Jungin Aukio 5, 02600 Espoo On Thu, May 14, 2026 at 01:38:17PM +0200, Joshua Crofts via B4 Relay wrote: > Currently in the AK8975 driver there are two instances where potential > uninitialized kernel stack memory leaks can occur. If > i2c_smbus_read_i2c_block_data_or_emulated() returns a value less than > the size of the buffer, uninitialized bytes are retained in the buffer > and later the buffer is passed on to IIO buffers, potentially leaking > memory to userspace. > > Fix this by adding checks whether the return value of the function is > equal to the size of the buffer and subsequently if the value is > lesser than zero to distinguish from a returned error code. ... > - if (ret < 0) > + if (ret != sizeof(rval)) { > + if (ret >= 0) > + ret = -EIO; > goto exit; > + } Still better to not mix the two if (ret < 0) goto exit; if (ret != sizeof(rval)) { ret = -EIO; goto exit; } ... Ditto for the second case. -- With Best Regards, Andy Shevchenko