Bug 156029 - kernel may oops if more than 4k worth of string data returned in /proc/devices
kernel may oops if more than 4k worth of string data returned in /proc/devices
Product: Red Hat Enterprise Linux 2.1
Classification: Red Hat
Component: kernel (Show other bugs)
All Linux
medium Severity medium
: ---
: ---
Assigned To: Don Howard
Brian Brock
Depends On:
Blocks: 143573
  Show dependency treegraph
Reported: 2005-04-26 15:00 EDT by Neil Horman
Modified: 2007-11-30 17:06 EST (History)
1 user (show)

See Also:
Fixed In Version: RHSA-2007-0013
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2007-01-17 05:14:35 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
patch to add missing length check to /proc/devices file (1.58 KB, patch)
2005-04-26 15:00 EDT, Neil Horman
no flags Details | Diff

External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2007:0013 normal SHIPPED_LIVE Moderate: kernel security update 2007-01-17 05:13:36 EST

  None (edit)
Description Neil Horman 2005-04-26 15:00:40 EDT
Description of problem:
the read routine for /proc/devices is missing a length check routine. 
Consequently, if the number of block and char devices in a system totals more
than 4096 bytes of string data between their names and major/minor numbers, the
read routine will sprintf the data off the end of the page and oops the kernel.
other proc files that are part of proc_misc.c protect against this with a length
check that truncates the file if it goes over a page, but this check is missing
from get_device_list and get_blkdev_list.

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1. register sufficient char/block devices in a system to create > 4096 bytes of
string data for /proc/devices
2. cat /proc/devices
Actual results:
system will oops on a page fault

Expected results:
system should truncate file to 4096 bytes.

Additional info:
Comment 1 Neil Horman 2005-04-26 15:00:40 EDT
Created attachment 113681 [details]
patch to add missing length check to /proc/devices file
Comment 5 Don Howard 2006-09-14 14:14:33 EDT
Hi Neil -

This ticket fell off my radar.  It looks like the RHEL3 patch applies to 2.1. 
Can you attach a test case for this issue?
Comment 6 Neil Horman 2006-09-14 15:14:30 EDT
hey don-
   I don't think I have my old test case laying about any more, but suffice it
to say, all you need to do is write a kernel module that calls register_chrdev
for 256 different major/minor combinations, and give each device a name that is
at least 20 characters long.  That will overrun the 4k buffer that is allocated
for /proc/devices and cause an oops.  with the patch the file will be truncated
at 4096 bytes.  

I'll see if I can throw my old test code back together in a little bit.
Comment 7 Don Howard 2006-09-14 15:30:09 EDT
Thanks for checking, Neil.  Don't worry about re-creating your testcase, I can
do that.  
Comment 11 Mike Gahagan 2006-12-19 15:15:38 EST
bug reproduced using e.70 and fix verified on e.71.

Comment 13 Red Hat Bugzilla 2007-01-17 05:14:35 EST
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.


Note You need to log in before you can comment on or make changes to this bug.