Note: This is a beta release of Red Hat Bugzilla 5.0. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Also email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback here.
Bug 156142 - kernel may oops if more than 4k worth of string data returned in /proc/devices
Summary: kernel may oops if more than 4k worth of string data returned in /proc/devices
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 3
Classification: Red Hat
Component: kernel
Version: 3.0
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Neil Horman
QA Contact: Brian Brock
URL:
Whiteboard:
Depends On:
Blocks: 156320
TreeView+ depends on / blocked
 
Reported: 2005-04-27 20:44 UTC by Chris Williams
Modified: 2007-11-30 22:07 UTC (History)
6 users (show)

Fixed In Version: RHSA-2005-663
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2005-09-28 15:00:19 UTC


Attachments (Terms of Use)
rhkl patch accepted to fix this problem (deleted)
2005-05-17 11:11 UTC, Neil Horman
no flags Details | Diff
rhkl patch accepted to fix this problem (deleted)
2005-05-17 11:11 UTC, Neil Horman
no flags Details | Diff


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2005:663 qe-ready SHIPPED_LIVE Important: Updated kernel packages available for Red Hat Enterprise Linux 3 Update 6 2005-09-28 04:00:00 UTC

Description Chris Williams 2005-04-27 20:44:43 UTC
+++ This bug was initially created as a clone of Bug #156029 +++

Description of problem:
the read routine for /proc/devices is missing a length check routine. 
Consequently, if the number of block and char devices in a system totals more
than 4096 bytes of string data between their names and major/minor numbers, the
read routine will sprintf the data off the end of the page and oops the kernel.
other proc files that are part of proc_misc.c protect against this with a length
check that truncates the file if it goes over a page, but this check is missing
from get_device_list and get_blkdev_list.

Version-Release number of selected component (if applicable):
all

How reproducible:
always

Steps to Reproduce:
1. register sufficient char/block devices in a system to create > 4096 bytes of
string data for /proc/devices
2. cat /proc/devices
3.
  
Actual results:
system will oops on a page fault

Expected results:
system should truncate file to 4096 bytes.

Additional info:

Comment 3 Ernie Petrides 2005-05-05 00:40:36 UTC
A fix for this problem has just been committed to the RHEL3 U6
patch pool this evening (in kernel version 2.4.21-32.3.EL).


Comment 6 Neil Horman 2005-05-17 00:48:02 UTC
I wrote a module to register dummy character devices and block devices to fill
up the page in /proc/devices.  Pretty straightforward.  Do you want it?

Comment 8 Neil Horman 2005-05-17 11:11:16 UTC
Created attachment 114458 [details]
rhkl patch accepted to fix this problem

Sorry, arjan, I thought it was already added here.  This is what was accepted
on rhkl. Its pretty unobtrusive.

Comment 9 Neil Horman 2005-05-17 11:11:40 UTC
Created attachment 114459 [details]
rhkl patch accepted to fix this problem

Sorry, arjan, I thought it was already added here.  This is what was accepted
on rhkl. Its pretty unobtrusive.  I'll dig out my test code (need to remember
where I put it), and post it here shortly

Comment 18 Red Hat Bugzilla 2005-09-28 15:00:20 UTC
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2005-663.html



Note You need to log in before you can comment on or make changes to this bug.