Skip to content

Commit 47b43e5

Browse files
javiercarrascocruzjic23
authored andcommitted
iio: light: vcnl4035: fix information leak in triggered buffer
The 'buffer' local array is used to push data to userspace from a triggered buffer, but it does not set an initial value for the single data element, which is an u16 aligned to 8 bytes. That leaves at least 4 bytes uninitialized even after writing an integer value with regmap_read(). Initialize the array to zero before using it to avoid pushing uninitialized information to userspace. Cc: stable@vger.kernel.org Fixes: ec90b52 ("iio: light: vcnl4035: Fix buffer alignment in iio_push_to_buffers_with_timestamp()") Signed-off-by: Javier Carrasco <javier.carrasco.cruz@gmail.com> Link: https://patch.msgid.link/20241125-iio_memset_scan_holes-v1-6-0cb6e98d895c@gmail.com Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
1 parent b62fbe3 commit 47b43e5

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

drivers/iio/light/vcnl4035.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -105,7 +105,7 @@ static irqreturn_t vcnl4035_trigger_consumer_handler(int irq, void *p)
105105
struct iio_dev *indio_dev = pf->indio_dev;
106106
struct vcnl4035_data *data = iio_priv(indio_dev);
107107
/* Ensure naturally aligned timestamp */
108-
u8 buffer[ALIGN(sizeof(u16), sizeof(s64)) + sizeof(s64)] __aligned(8);
108+
u8 buffer[ALIGN(sizeof(u16), sizeof(s64)) + sizeof(s64)] __aligned(8) = { };
109109
int ret;
110110

111111
ret = regmap_read(data->regmap, VCNL4035_ALS_DATA, (int *)buffer);

0 commit comments

Comments
 (0)