From: David Lechner Date: Wed, 23 Jul 2025 15:29:12 +0000 (-0500) Subject: iio: accel: sca3300: fix uninitialized iio scan data X-Git-Tag: v6.16.4~162 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=c88c04adb8611e436e1e773fd5db3f8d7397d089;p=thirdparty%2Fkernel%2Fstable.git iio: accel: sca3300: fix uninitialized iio scan data commit 4e5b705cc6147f0b9173c6219079f41416bdd3c0 upstream. Fix potential leak of uninitialized stack data to userspace by ensuring that the `channels` array is zeroed before use. Fixes: edeb67fbbf4b ("iio: accel: sca3300: use IIO_DECLARE_BUFFER_WITH_TS") Signed-off-by: David Lechner Link: https://patch.msgid.link/20250723-iio-accel-sca3300-fix-uninitialized-iio-scan-data-v1-1-12dbfb3307b7@baylibre.com Signed-off-by: Jonathan Cameron Signed-off-by: Greg Kroah-Hartman --- diff --git a/drivers/iio/accel/sca3300.c b/drivers/iio/accel/sca3300.c index 67416a406e2f4..d5e9fa58d0ba3 100644 --- a/drivers/iio/accel/sca3300.c +++ b/drivers/iio/accel/sca3300.c @@ -479,7 +479,7 @@ static irqreturn_t sca3300_trigger_handler(int irq, void *p) struct iio_dev *indio_dev = pf->indio_dev; struct sca3300_data *data = iio_priv(indio_dev); int bit, ret, val, i = 0; - IIO_DECLARE_BUFFER_WITH_TS(s16, channels, SCA3300_SCAN_MAX); + IIO_DECLARE_BUFFER_WITH_TS(s16, channels, SCA3300_SCAN_MAX) = { }; iio_for_each_active_channel(indio_dev, bit) { ret = sca3300_read_reg(data, indio_dev->channels[bit].address, &val);