Skip to content

Commit 333be43

Browse files
javiercarrascocruzjic23
authored andcommitted
iio: dummy: iio_simply_dummy_buffer: fix information leak in triggered buffer
The 'data' array is allocated via kmalloc() and it is used to push data to user space from a triggered buffer, but it does not set values for inactive channels, as it only uses iio_for_each_active_channel() to assign new values. Use kzalloc for the memory allocation to avoid pushing uninitialized information to userspace. Cc: stable@vger.kernel.org Fixes: 415f792 ("iio: Move IIO Dummy Driver out of staging") Signed-off-by: Javier Carrasco <javier.carrasco.cruz@gmail.com> Link: https://patch.msgid.link/20241125-iio_memset_scan_holes-v1-9-0cb6e98d895c@gmail.com Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
1 parent fbeba43 commit 333be43

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

drivers/iio/dummy/iio_simple_dummy_buffer.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,7 @@ static irqreturn_t iio_simple_dummy_trigger_h(int irq, void *p)
4848
int i = 0, j;
4949
u16 *data;
5050

51-
data = kmalloc(indio_dev->scan_bytes, GFP_KERNEL);
51+
data = kzalloc(indio_dev->scan_bytes, GFP_KERNEL);
5252
if (!data)
5353
goto done;
5454

0 commit comments

Comments
 (0)