kern/60913: iic(4): I2C_IOCTL_EXEC can copy out an uninitialised buffer

["trythepostoffice%gmail.com@localhost via gnats" <gnats-admin%NetBSD.org@localhost>]

>Number:         60913
>Category:       kern
>Synopsis:       iic(4): I2C_IOCTL_EXEC can copy out an uninitialised buffer
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Oct 21 03:25:00 +0000 2026
>Originator:     Elias Howell
>Release:        NetBSD 11.0, NetBSD-current 11.99.9 (20261019)
>Organization:
>Environment:
NetBSD armv7 11.0 NetBSD 11.0 (GENERIC) #0: Thu Jul 30 15:23:12 UTC 2026  mkrepro%mkrepro.NetBSD.org@localhost:/usr/src/sys/arch/evbarm/compile/GENERIC evbarm
NetBSD armv7 11.99.9 NetBSD 11.99.9 (GENERIC) #0: Mon Oct 19 09:38:27 UTC 2026  mkrepro%mkrepro.NetBSD.org@localhost:/usr/src/sys/arch/evbarm/compile/GENERIC evbarm

>Description:
iic_ioctl_exec() in sys/dev/i2c/i2c.c gets the read buffer with
kmem_alloc() and copies it out whenever the controller exec returns
0. If driver returns 0 without filling the buffer or only fills
part of it, up to I2C_EXEC_MAX_BUFLEN (4096) bytes of stale kernel
heap go to userland. /dev/iic* is root only by default so tis but a
small leak and not a privilege problem.

ti_iic(4) on AM335x does exactly that (PR port-arm/60912), lots of reads
from an address with nothing on it return 0. On 11.0 I got back 0x00,
0x01, 0x2f, 0x50, 0x60 or 0xf0 depending on the address and the run
with the userland buffer preset to 0xa5.

>How-To-Repeat:
See PR port-arm/60912. A 1 byte I2C_OP_READ_WITH_STOP at empty address
on AM335x iic0 without the ti_iic fix.
>Fix:
Zero the buffer. Tested on the SG-1000, -current b91976112 plus this
and my other patches with the ti_iic fix turned off by a sysctl in
the test kernel so reads still falsely succeed. Those now come back
0x00 every time (55 of 55 in a run of 120 reads at 0x24, 0x28 and
0x70).

--- a/sys/dev/i2c/i2c.c
+++ b/sys/dev/i2c/i2c.c
@@ -955,7 +955,7 @@ iic_ioctl_exec(struct iic_softc *sc, i2c_ioctl_exec_t *iie, int flag)
 	}
 
 	if (iie->iie_buf != NULL) {
-		buf = kmem_alloc(iie->iie_buflen, KM_SLEEP);
+		buf = kmem_zalloc(iie->iie_buflen, KM_SLEEP);
 		if (I2C_OP_WRITE_P(iie->iie_op)) {
 			error = copyin(iie->iie_buf, buf, iie->iie_buflen);
 			if (error)