Bug 643290

Summary:	sysctl: bad user of proc_doulongvec_minmax() can oops the kernel
Product:	Red Hat Enterprise Linux 6	Reporter:	Cong Wang <amwang>
Component:	kernel	Assignee:	Cong Wang <amwang>
Status:	CLOSED ERRATA	QA Contact:	Caspar Zhang <czhang>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	6.0	CC:	mzywusko, qcai, rkhan, snagar
Target Milestone:	rc
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	kernel-2.6.32-83.el6	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2011-05-19 12:28:23 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Cong Wang 2010-10-15 07:38:19 UTC

Description of problem:
When proc_doulongvec_minmax() is used with an array of longs, and no
min/max check requested (.extra1 or .extra2 being NULL), we dereference a
NULL pointer for the second element of the array.


Additional info:

We need to backport the following two patches:

commit 27b3d80a7b6adcf069b5e869e4efcc3a79f88a91
Author: Eric Dumazet <eric.dumazet>
Date:   Thu Oct 7 12:59:29 2010 -0700

and this one:

http://www.spinics.net/lists/netdev/msg143210.html

Comment 1 RHEL Program Management 2010-10-15 07:48:33 UTC

Thank you for your bug report. This issue was evaluated for inclusion
in the current release of Red Hat Enterprise Linux. Unfortunately, we
are unable to address this request in the current release. Because we
are in the final stage of Red Hat Enterprise Linux 6 development, only
significant, release-blocking issues involving serious regressions and
data corruption can be considered.

If you believe this issue meets the release blocking criteria as
defined and communicated to you by your Red Hat Support representative,
please ask your representative to file this issue as a blocker for the
current release. Otherwise, ask that it be evaluated for inclusion in
the next minor release of Red Hat Enterprise Linux.

Comment 3 Aristeu Rozanski 2010-11-17 19:46:35 UTC

Patch(es) available on kernel-2.6.32-83.el6

Comment 10 errata-xmlrpc 2011-05-19 12:28:23 UTC

An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2011-0542.html