Ian Abbott 673ee92bd2 comedi: Fix initialization of data for instructions that write to subdevice ... commit 46d8c74413 upstream. Some Comedi subdevice instruction handlers are known to access instruction data elements beyond the first `insn->n` elements in some cases. The `do_insn_ioctl()` and `do_insnlist_ioctl()` functions allocate at least `MIN_SAMPLES` (16) data elements to deal with this, but they do not initialize all of that. For Comedi instruction codes that write to the subdevice, the first `insn->n` data elements are copied from user-space, but the remaining elements are left uninitialized. That could be a problem if the subdevice instruction handler reads the uninitialized data. Ensure that the first `MIN_SAMPLES` elements are initialized before calling these instruction handlers, filling the uncopied elements with 0. For `do_insnlist_ioctl()`, the same data buffer elements are used for handling a list of instructions, so ensure the first `MIN_SAMPLES` elements are initialized for each instruction that writes to the subdevice. Fixes: ed9eccbe89 ("Staging: add comedi core") Cc: stable@vger.kernel.org # 5.13+ Signed-off-by: Ian Abbott <abbotti@mev.co.uk> Link: https://lore.kernel.org/r/20250707161439.88385-1-abbotti@mev.co.uk Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2025-07-24 08:53:16 +02:00
..
drivers	comedi: das6402: Fix bit shift out of bounds	2025-07-24 08:53:16 +02:00
kcomedilib
comedi_buf.c
comedi_fops.c	comedi: Fix initialization of data for instructions that write to subdevice	2025-07-24 08:53:16 +02:00
comedi_internal.h
comedi_pci.c
comedi_pcmcia.c
comedi_usb.c
drivers.c	comedi: Fix use of uninitialized data in insn_rw_emulate_bits()	2025-07-24 08:53:16 +02:00
Kconfig
Makefile
proc.c
range.c
TODO