From: Javier Carrasco <javier.carrasco.cruz@xxxxxxxxx>
commit 333be433ee908a53f283beb95585dfc14c8ffb46 upstream.
The 'data' array is allocated via kmalloc() and it is used to push data
to user space from a triggered buffer, but it does not set values for
inactive channels, as it only uses iio_for_each_active_channel()
to assign new values.
Use kzalloc for the memory allocation to avoid pushing uninitialized
information to userspace.
Cc: stable@xxxxxxxxxxxxxxx
Fixes: 415f79244757 ("iio: Move IIO Dummy Driver out of staging")
Signed-off-by: Javier Carrasco <javier.carrasco.cruz@xxxxxxxxx>
Link: https://patch.msgid.link/20241125-iio_memset_scan_holes-v1-9-0cb6e98d895c@xxxxxxxxx
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@xxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
drivers/iio/dummy/iio_simple_dummy_buffer.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/iio/dummy/iio_simple_dummy_buffer.c
+++ b/drivers/iio/dummy/iio_simple_dummy_buffer.c
@@ -48,7 +48,7 @@ static irqreturn_t iio_simple_dummy_trig
int len = 0;
u16 *data;
- data = kmalloc(indio_dev->scan_bytes, GFP_KERNEL);
+ data = kzalloc(indio_dev->scan_bytes, GFP_KERNEL);
if (!data)
goto done;
Patches currently in stable-queue which might be from javier.carrasco.cruz@xxxxxxxxx are
queue-5.4/iio-pressure-zpa2326-fix-information-leak-in-triggered-buffer.patch
queue-5.4/iio-dummy-iio_simply_dummy_buffer-fix-information-leak-in-triggered-buffer.patch
queue-5.4/iio-imu-kmx61-fix-information-leak-in-triggered-buffer.patch
queue-5.4/iio-light-vcnl4035-fix-information-leak-in-triggered-buffer.patch
queue-5.4/iio-adc-ti-ads8688-fix-information-leak-in-triggered-buffer.patch
