Note: This is a beta release of Red Hat Bugzilla 5.0. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Also email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback here.
Bug 156029 - kernel may oops if more than 4k worth of string data returned in /proc/devices
Summary: kernel may oops if more than 4k worth of string data returned in /proc/devices
Alias: None
Product: Red Hat Enterprise Linux 2.1
Classification: Red Hat
Component: kernel
Version: 2.1
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Don Howard
QA Contact: Brian Brock
Depends On:
Blocks: 143573
TreeView+ depends on / blocked
Reported: 2005-04-26 19:00 UTC by Neil Horman
Modified: 2007-11-30 22:06 UTC (History)
1 user (show)

Fixed In Version: RHSA-2007-0013
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2007-01-17 10:14:35 UTC
Target Upstream Version:

Attachments (Terms of Use)
patch to add missing length check to /proc/devices file (deleted)
2005-04-26 19:00 UTC, Neil Horman
no flags Details | Diff

System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2007:0013 normal SHIPPED_LIVE Moderate: kernel security update 2007-01-17 10:13:36 UTC

Description Neil Horman 2005-04-26 19:00:40 UTC
Description of problem:
the read routine for /proc/devices is missing a length check routine. 
Consequently, if the number of block and char devices in a system totals more
than 4096 bytes of string data between their names and major/minor numbers, the
read routine will sprintf the data off the end of the page and oops the kernel.
other proc files that are part of proc_misc.c protect against this with a length
check that truncates the file if it goes over a page, but this check is missing
from get_device_list and get_blkdev_list.

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1. register sufficient char/block devices in a system to create > 4096 bytes of
string data for /proc/devices
2. cat /proc/devices
Actual results:
system will oops on a page fault

Expected results:
system should truncate file to 4096 bytes.

Additional info:

Comment 1 Neil Horman 2005-04-26 19:00:40 UTC
Created attachment 113681 [details]
patch to add missing length check to /proc/devices file

Comment 5 Don Howard 2006-09-14 18:14:33 UTC
Hi Neil -

This ticket fell off my radar.  It looks like the RHEL3 patch applies to 2.1. 
Can you attach a test case for this issue?

Comment 6 Neil Horman 2006-09-14 19:14:30 UTC
hey don-
   I don't think I have my old test case laying about any more, but suffice it
to say, all you need to do is write a kernel module that calls register_chrdev
for 256 different major/minor combinations, and give each device a name that is
at least 20 characters long.  That will overrun the 4k buffer that is allocated
for /proc/devices and cause an oops.  with the patch the file will be truncated
at 4096 bytes.  

I'll see if I can throw my old test code back together in a little bit.

Comment 7 Don Howard 2006-09-14 19:30:09 UTC
Thanks for checking, Neil.  Don't worry about re-creating your testcase, I can
do that.  

Comment 11 Mike Gahagan 2006-12-19 20:15:38 UTC
bug reproduced using e.70 and fix verified on e.71.

Comment 13 Red Hat Bugzilla 2007-01-17 10:14:35 UTC
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

Note You need to log in before you can comment on or make changes to this bug.