From patchwork Mon Aug 29 16:11:31 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Dave Jones X-Patchwork-Id: 9304129 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 3A28D60756 for ; Mon, 29 Aug 2016 16:12:32 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 2C5F0286A3 for ; Mon, 29 Aug 2016 16:12:32 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 213BB286B6; Mon, 29 Aug 2016 16:12:32 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 1DDC5286A4 for ; Mon, 29 Aug 2016 16:12:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752417AbcH2QM3 (ORCPT ); Mon, 29 Aug 2016 12:12:29 -0400 Received: from arcturus.aphlor.org ([188.246.204.175]:40868 "EHLO arcturus.aphlor.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751882AbcH2QM2 (ORCPT ); Mon, 29 Aug 2016 12:12:28 -0400 Received: from c-65-96-118-216.hsd1.ma.comcast.net ([65.96.118.216] helo=wopr.kernelslacker.org) by arcturus.aphlor.org with esmtpsa (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.87) (envelope-from ) id 1beP9p-0001N6-8B; Mon, 29 Aug 2016 17:11:33 +0100 Received: by wopr.kernelslacker.org (Postfix, from userid 1000) id A392997; Mon, 29 Aug 2016 12:11:31 -0400 (EDT) Date: Mon, 29 Aug 2016 12:11:31 -0400 From: Dave Jones To: linux-kernel@vger.kernel.org Cc: Jean Delvare , Guenter Roeck , linux-hwmon@vger.kernel.org Subject: it87: NULL terminate attribute list. Message-ID: <20160829161131.zelpth64i6z4tdl2@codemonkey.org.uk> Mail-Followup-To: Dave Jones , linux-kernel@vger.kernel.org, Jean Delvare , Guenter Roeck , linux-hwmon@vger.kernel.org MIME-Version: 1.0 Content-Disposition: inline User-Agent: Mutt/1.6.2-neo (2016-08-08) Sender: linux-hwmon-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-hwmon@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Without the termination, we walk off the end of the list, which is usually harmless, but KASAN spews this.. BUG: KASAN: global-out-of-bounds in internal_create_group+0x75b/0x970 at addr ffffffffae2d59c8 Read of size 8 by task swapper/0/1 Address belongs to variable it87_attributes_in+0x168/0x1a0 CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.8.0-rc4-firewall+ #1 ffffffffae2d59c8 ffff8801d352f4f0 ffffffffac90ee56 ffff8801d352f588 ffffffffae2d59c8 ffff8801d352f578 ffffffffac442ccd 0000000000001000 ffffffffae2d93c0 ffffffffadab6d20 0000000000000297 ffffffffac59b19c Call Trace: [] dump_stack+0x68/0x92 [] kasan_report_error+0x4dd/0x500 [] ? __kernfs_create_file+0x1dc/0x280 [] __asan_report_load8_noabort+0x44/0x50 [] ? internal_create_group+0x75b/0x970 [] internal_create_group+0x75b/0x970 [] sysfs_create_groups+0x91/0x120 [] device_add+0xe56/0x13e0 [] ? device_private_init+0x1a0/0x1a0 [] ? __init_waitqueue_head+0x41/0xa0 [] ? pm_runtime_init+0x35f/0x450 [] device_register+0x1a/0x20 [] hwmon_device_register_with_groups.part.4+0x1cf/0x2b0 [] hwmon_device_register_with_groups+0x84/0xa0 [] devm_hwmon_device_register_with_groups+0x6c/0xd0 [] it87_probe+0x154d/0x2aa0 [] ? debug_smp_processor_id+0x17/0x20 [] ? get_lock_stats+0x1e/0xa0 [] ? show_vid_reg+0xd0/0xd0 [] ? devices_kset_move_last+0x79/0x90 [] ? acpi_dev_pm_attach+0x45/0x179 [] platform_drv_probe+0x83/0x170 [] ? devices_kset_move_last+0x79/0x90 [] driver_probe_device+0x1f2/0x730 [] __device_attach_driver+0x183/0x240 [] ? __driver_attach+0x1a0/0x1a0 [] bus_for_each_drv+0x11f/0x1c0 [] ? subsys_find_device_by_id+0x330/0x330 [] ? _raw_spin_unlock_irqrestore+0x43/0x70 [] __device_attach+0x1cc/0x2a0 [] ? device_bind_driver+0xc0/0xc0 [] ? kobject_uevent_env+0x22c/0xb40 [] device_initial_probe+0x13/0x20 [] bus_probe_device+0x1c4/0x270 [] device_add+0x8b7/0x13e0 [] ? device_private_init+0x1a0/0x1a0 [] ? preempt_count_sub+0x10b/0x1e0 [] ? _raw_write_unlock+0x31/0x50 [] platform_device_add+0x27c/0x5f0 [] sm_it87_init+0xabe/0xba9 [] ? coretemp_init+0x465/0x465 [] ? ktime_get+0xee/0x2a0 [] ? coretemp_init+0x465/0x465 [] ? coretemp_init+0x465/0x465 [] do_one_initcall+0xf5/0x1e5 [] ? start_kernel+0x594/0x594 [] ? parse_args+0x42e/0x850 [] ? __usermodehelper_set_disable_depth+0x42/0x50 [] kernel_init_freeable+0x422/0x4b3 [] kernel_init+0x14/0x120 [] ret_from_fork+0x1f/0x40 [] ? rest_init+0x160/0x160 Memory state around the buggy address: ffffffffae2d5880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffffffffae2d5900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffffffffae2d5980: 00 00 00 00 00 00 00 00 00 fa fa fa fa fa fa fa ^ ffffffffae2d5a00: 00 00 00 00 00 00 00 fa fa fa fa fa 00 00 00 00 ffffffffae2d5a80: 00 00 00 fa fa fa fa fa 00 00 00 00 00 00 00 fa --- To unsubscribe from this list: send the line "unsubscribe linux-hwmon" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html ================================================================== Signed-off-by; Dave Jones diff --git a/drivers/hwmon/it87.c b/drivers/hwmon/it87.c index d0203a115eff..89685845abaa 100644 --- a/drivers/hwmon/it87.c +++ b/drivers/hwmon/it87.c @@ -2015,6 +2015,7 @@ static struct attribute *it87_attributes_in[] = { &sensor_dev_attr_in10_input.dev_attr.attr, /* 41 */ &sensor_dev_attr_in11_input.dev_attr.attr, /* 41 */ &sensor_dev_attr_in12_input.dev_attr.attr, /* 41 */ + NULL, }; static const struct attribute_group it87_group_in = {