Red Hat Bugzilla – Bug 156029
kernel may oops if more than 4k worth of string data returned in /proc/devices
Last modified: 2007-11-30 17:06:54 EST
Description of problem: the read routine for /proc/devices is missing a length check routine. Consequently, if the number of block and char devices in a system totals more than 4096 bytes of string data between their names and major/minor numbers, the read routine will sprintf the data off the end of the page and oops the kernel. other proc files that are part of proc_misc.c protect against this with a length check that truncates the file if it goes over a page, but this check is missing from get_device_list and get_blkdev_list. Version-Release number of selected component (if applicable): all How reproducible: always Steps to Reproduce: 1. register sufficient char/block devices in a system to create > 4096 bytes of string data for /proc/devices 2. cat /proc/devices 3. Actual results: system will oops on a page fault Expected results: system should truncate file to 4096 bytes. Additional info:
Created attachment 113681 [details] patch to add missing length check to /proc/devices file
Hi Neil - This ticket fell off my radar. It looks like the RHEL3 patch applies to 2.1. Can you attach a test case for this issue?
hey don- I don't think I have my old test case laying about any more, but suffice it to say, all you need to do is write a kernel module that calls register_chrdev for 256 different major/minor combinations, and give each device a name that is at least 20 characters long. That will overrun the 4k buffer that is allocated for /proc/devices and cause an oops. with the patch the file will be truncated at 4096 bytes. I'll see if I can throw my old test code back together in a little bit.
Thanks for checking, Neil. Don't worry about re-creating your testcase, I can do that.
bug reproduced using e.70 and fix verified on e.71.
An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on the solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHSA-2007-0013.html