linux-kernel - Re: [PATCH] iio: accel: sca3300: fix uninitialized iio scan data

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20250724112114.47865250@jic23-huawei>
Date: Thu, 24 Jul 2025 11:21:14 +0100
From: Jonathan Cameron <jic23@...nel.org>
To: David Lechner <dlechner@...libre.com>
Cc: Nuno Sá <nuno.sa@...log.com>, Andy Shevchenko
 <andy@...nel.org>, Jonathan Cameron <Jonathan.Cameron@...wei.com>,
 linux-iio@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] iio: accel: sca3300: fix uninitialized iio scan data

On Wed, 23 Jul 2025 10:29:12 -0500
David Lechner <dlechner@...libre.com> wrote:

> Fix potential leak of uninitialized stack data to userspace by ensuring
> that the `channels` array is zeroed before use.
> 
> Fixes: edeb67fbbf4b ("iio: accel: sca3300: use IIO_DECLARE_BUFFER_WITH_TS")
> Signed-off-by: David Lechner <dlechner@...libre.com>
Applied to a temporary fixes-togreg-for-6.17 branch.

Will sort this out after the merge window.

J
> ---
>  drivers/iio/accel/sca3300.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/iio/accel/sca3300.c b/drivers/iio/accel/sca3300.c
> index bda370c0f660b2a603d7d70dbe5e088bf96eca7a..8380b237831cec8e7520335dd9f78a2f30531448 100644
> --- a/drivers/iio/accel/sca3300.c
> +++ b/drivers/iio/accel/sca3300.c
> @@ -477,7 +477,7 @@ static irqreturn_t sca3300_trigger_handler(int irq, void *p)
>  	struct iio_dev *indio_dev = pf->indio_dev;
>  	struct sca3300_data *data = iio_priv(indio_dev);
>  	int bit, ret, val, i = 0;
> -	IIO_DECLARE_BUFFER_WITH_TS(s16, channels, SCA3300_SCAN_MAX);
> +	IIO_DECLARE_BUFFER_WITH_TS(s16, channels, SCA3300_SCAN_MAX) = { };
>  
>  	iio_for_each_active_channel(indio_dev, bit) {
>  		ret = sca3300_read_reg(data, indio_dev->channels[bit].address, &val);
> 
> ---
> base-commit: cd2731444ee4e35db76f4fb587f12d327eec5446
> change-id: 20250723-iio-accel-sca3300-fix-uninitialized-iio-scan-data-c31f13b4b520
> 
> Best regards,