Re: [PATCH v2] iio: buffer: Ensure bounce buffer used for unaligned case is zeroed.

On Mon, 2026-08-03 at 02:22 +0100, Jonathan Cameron wrote:
> From: Jonathan Cameron <[email protected]>
>=20
> iio_push_to_buffers_with_ts_unaligned() leaks uninitialized heap memory
> to userspace if the data passed in is not a multiple of 8 bytes and the
> timestamp is enabled. Specify __GFP_ZERO for the devm_krealloc()
> to ensure any extra space is cleared.
>=20
> Fixes: 95ec3fdf2b79 ("iio: core: Introduce iio_push_to_buffers_with_ts_un=
aligned()")
> Reported-by: Sashiko <[email protected]>
> Closes: https://sashiko.dev/#/patchset/20260529121005.1470-1-kimjinseob88=
%40gmail.com
> Signed-off-by: Jonathan Cameron <[email protected]>
> ---

Reviewed-by: Nuno S=C3=A1 <[email protected]>

>=20
> v1: https://patchwork.kernel.org/project/linux-iio/patch/20260604084307.6=
[email protected]/
>=20
> Drop the memset in favour of __GFP_ZERO.=C2=A0 (Andy)
> Thanks to Nuno who pointed out there is a self test to ensure this
> behaves as expected.
>=20
> =C2=A0drivers/iio/industrialio-buffer.c | 3 ++-
> =C2=A01 file changed, 2 insertions(+), 1 deletion(-)
>=20
> diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio=
-buffer.c
> index 531fc4ccc15d..4960c8377932 100644
> --- a/drivers/iio/industrialio-buffer.c
> +++ b/drivers/iio/industrialio-buffer.c
> @@ -2464,7 +2464,8 @@ int iio_push_to_buffers_with_ts_unaligned(struct ii=
o_dev *indio_dev,
> =C2=A0
> =C2=A0		bb =3D devm_krealloc(&indio_dev->dev,
> =C2=A0				=C2=A0=C2=A0 iio_dev_opaque->bounce_buffer,
> -				=C2=A0=C2=A0 indio_dev->scan_bytes, GFP_KERNEL);
> +				=C2=A0=C2=A0 indio_dev->scan_bytes,
> +				=C2=A0=C2=A0 GFP_KERNEL | __GFP_ZERO);
> =C2=A0		if (!bb)
> =C2=A0			return -ENOMEM;
> =C2=A0		iio_dev_opaque->bounce_buffer =3D bb;