474f8928d5
adis16550_trigger_handler() declares the scan data array on the stack
without initializing it. The memcpy() at the bottom fills only the
first 28 bytes (TEMP + 6 channels of GYRO/ACCEL data), and
iio_push_to_buffers_with_timestamp() writes the s64 timestamp at the
8-byte-aligned offset 32. Bytes 28-31 remain uninitialized stack data
which leaks to userspace on ever trigger.
Fix this all by just zero-initializing the structure on the stack.
Cc: Lars-Peter Clausen <lars@metafoo.de>
Cc: Michael Hennerich <Michael.Hennerich@analog.com>
Cc: Jonathan Cameron <jic23@kernel.org>
Cc: David Lechner <dlechner@baylibre.com>
Cc: "Nuno Sá" <nuno.sa@analog.com>
Cc: Andy Shevchenko <andy@kernel.org>
Fixes:
|
||
|---|---|---|
| .. | ||
| bmi160 | ||
| bmi270 | ||
| bmi323 | ||
| bno055 | ||
| inv_icm42600 | ||
| inv_icm45600 | ||
| inv_mpu6050 | ||
| smi330 | ||
| st_lsm6dsx | ||
| st_lsm9ds0 | ||
| adis.c | ||
| adis16400.c | ||
| adis16460.c | ||
| adis16475.c | ||
| adis16480.c | ||
| adis16550.c | ||
| adis_buffer.c | ||
| adis_trigger.c | ||
| fxos8700.h | ||
| fxos8700_core.c | ||
| fxos8700_i2c.c | ||
| fxos8700_spi.c | ||
| Kconfig | ||
| kmx61.c | ||
| Makefile | ||
| smi240.c | ||