Note: This is a beta release of Red Hat Bugzilla 5.0. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Also email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback here.
Bug 156145 - kernel may oops if more than 4k worth of string data returned in /proc/devices
Summary: kernel may oops if more than 4k worth of string data returned in /proc/devices
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 4
Classification: Red Hat
Component: kernel
Version: 4.0
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
: ---
Assignee: Neil Horman
QA Contact: Brian Brock
URL:
Whiteboard:
Depends On:
Blocks: 181409
TreeView+ depends on / blocked
 
Reported: 2005-04-27 20:49 UTC by Chris Williams
Modified: 2007-11-30 22:07 UTC (History)
3 users (show)

Fixed In Version: RHSA-2006-0575
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2006-08-10 21:04:27 UTC


Attachments (Terms of Use)
RHEL4 patch to fix /proc/devices buffer overrun (deleted)
2005-04-29 18:58 UTC, Neil Horman
no flags Details | Diff
backport of latest upstream version of /proc/devices patch (deleted)
2006-04-24 17:31 UTC, Neil Horman
no flags Details | Diff
patch to prevent /proc/devices buffer overflow (deleted)
2006-05-02 20:31 UTC, Neil Horman
no flags Details | Diff


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2006:0575 normal SHIPPED_LIVE Important: Updated kernel packages available for Red Hat Enterprise Linux 4 Update 4 2006-08-10 04:00:00 UTC

Description Chris Williams 2005-04-27 20:49:33 UTC
+++ This bug was initially created as a clone of Bug #156029 +++

Description of problem:
the read routine for /proc/devices is missing a length check routine. 
Consequently, if the number of block and char devices in a system totals more
than 4096 bytes of string data between their names and major/minor numbers, the
read routine will sprintf the data off the end of the page and oops the kernel.
other proc files that are part of proc_misc.c protect against this with a length
check that truncates the file if it goes over a page, but this check is missing
from get_device_list and get_blkdev_list.

Version-Release number of selected component (if applicable):
all

How reproducible:
always

Steps to Reproduce:
1. register sufficient char/block devices in a system to create > 4096 bytes of
string data for /proc/devices
2. cat /proc/devices
3.
  
Actual results:
system will oops on a page fault

Expected results:
system should truncate file to 4096 bytes.

Additional info:

Comment 3 Neil Horman 2005-04-29 18:58:29 UTC
Created attachment 113865 [details]
RHEL4 patch to fix /proc/devices buffer overrun

This is the patch posted to RHKL

Comment 4 Neil Horman 2005-06-20 19:41:39 UTC
This shouldn't block on the 2.1 version of this bug.

Comment 16 Neil Horman 2006-04-24 17:31:13 UTC
Created attachment 128155 [details]
backport of latest upstream version of /proc/devices patch

Comment 17 Jason Baron 2006-04-26 02:03:52 UTC
committed in stream U4 build 34.24. A test kernel with this patch is available
from http://people.redhat.com/~jbaron/rhel4/


Comment 18 Jason Baron 2006-05-01 17:41:58 UTC
patch reverted due to kabi issues.

Comment 20 Neil Horman 2006-05-02 20:31:53 UTC
Created attachment 128516 [details]
patch to prevent /proc/devices buffer overflow

same patch as before, but added __GENKSYMS__ macro around seq_file.h include to
prevent abi breakage.  posted to rhkl

Comment 21 Jason Baron 2006-05-04 17:11:24 UTC
committed in stream U4 build 35.1. A test kernel with this patch is available
from http://people.redhat.com/~jbaron/rhel4/


Comment 25 Red Hat Bugzilla 2006-08-10 21:04:28 UTC
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2006-0575.html



Note You need to log in before you can comment on or make changes to this bug.