Re: [PATCH 02/11] iio: adc: ti-ads1119: fix information leak in triggered buffer

From: Francesco Dolcini
Date: Tue Nov 26 2024 - 04:00:17 EST


On Mon, Nov 25, 2024 at 10:16:10PM +0100, Javier Carrasco wrote:
> The 'scan' local struct is used to push data to user space from a
> triggered buffer, but it has a hole between the sample (unsigned int)
> and the timestamp. This hole is never initialized.
>
> Initialize the struct to zero before using it to avoid pushing
> uninitialized information to userspace.
>
> Cc: stable@xxxxxxxxxxxxxxx
> Fixes: a9306887eba4 ("iio: adc: ti-ads1119: Add driver")
> Signed-off-by: Javier Carrasco <javier.carrasco.cruz@xxxxxxxxx>
> ---
> drivers/iio/adc/ti-ads1119.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/drivers/iio/adc/ti-ads1119.c b/drivers/iio/adc/ti-ads1119.c
> index e9d9d4d46d38..2615a275acb3 100644
> --- a/drivers/iio/adc/ti-ads1119.c
> +++ b/drivers/iio/adc/ti-ads1119.c
> @@ -506,6 +506,8 @@ static irqreturn_t ads1119_trigger_handler(int irq, void *private)
> unsigned int index;
> int ret;
>
> + memset(&scan, 0, sizeof(scan));

Did you consider adding a reserved field after sample and just
initializing that one to zero?

It seems a trivial optimization not adding much value, but I thought about
it, so I'd like to be sure you considered it.

In any case, the change is fine.

Reviewed-by: Francesco Dolcini <francesco.dolcini@xxxxxxxxxxx>

Thanks,
Francesco