From 9f261e5dfe101bbe35043822a89bffa78e080b3b Mon Sep 17 00:00:00 2001 From: "Se Wang (Patrick) Oh" Date: Wed, 2 Sep 2015 21:07:47 -0700 Subject: arm64: Fix out of bound access to compat_hwcap_str As compat_hwcap_str[] doesn't end with 'NULL', c_show() tries to read the next element even after the end of the array. So add 'NULL' at the end of compat_hwcap_str[]. Below is the KASan report for referencing. BUG: KASan: out of bounds access in c_show+0x110/0x248 at addr ffffffc0011f6370 Read of size 8 by task pool-1-thread-1/10526 page:ffffffbac14b39c0 count:1 mapcount:0 mapping: (null) index:0x0 flags: 0x400(reserved) page dumped because: kasan: bad access detected Address belongs to variable compat_hwcap_str+0xb0/0xe0 CPU: 0 PID: 10526 Comm: pool-1-thread-1 Tainted: G B W 3.18.18-ga7b28e9-11552-ge4a827f #1 Hardware name: Qualcomm Technologies, Inc. MSM 8996 v2 + PMI8994 MTP (DT) Call trace: [] dump_backtrace+0x0/0x1c4 [] show_stack+0x10/0x1c [] dump_stack+0x74/0xc8 [] kasan_report_error+0x2b0/0x408 [] kasan_report+0x34/0x40 [] __asan_load8+0x84/0x90 [] c_show+0x10c/0x248 [] traverse+0x1a8/0x320 [] seq_lseek+0x98/0x148 [] proc_reg_llseek+0xa0/0xd8 [] vfs_llseek+0x5c/0x70 [] SyS_lseek+0x48/0x80 [] compat_SyS_lseek+0xc/0x18 Memory state around the buggy address: ffffffc0011f6200: 00 00 fa fa fa fa fa fa 00 03 fa fa fa fa fa fa ffffffc0011f6280: 04 fa fa fa fa fa fa fa 00 00 00 00 00 00 00 00 >ffffffc0011f6300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fa fa ^ ffffffc0011f6380: fa fa fa fa 00 00 00 00 00 00 fa fa fa fa fa fa ffffffc0011f6400: 02 fa fa fa fa fa fa fa 00 00 00 02 fa fa fa fa Change-Id: I5e2098f9a7a676c47a01baf10de3ac1c86265e69 Signed-off-by: Se Wang (Patrick) Oh --- arch/arm64/kernel/setup.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/arch/arm64/kernel/setup.c b/arch/arm64/kernel/setup.c index 58e7c14..1da40ef 100644 --- a/arch/arm64/kernel/setup.c +++ b/arch/arm64/kernel/setup.c @@ -488,7 +488,8 @@ static const char *compat_hwcap_str[] = { "idivt", "vfpd32", "lpae", - "evtstrm" + "evtstrm", + NULL }; static const char *compat_hwcap2_str[] = { -- cgit v1.1