Red Hat Bugzilla – Bug 156029
kernel may oops if more than 4k worth of string data returned in /proc/devices
Last modified: 2007-11-30 17:06:54 EST
Description of problem:
the read routine for /proc/devices is missing a length check routine.
Consequently, if the number of block and char devices in a system totals more
than 4096 bytes of string data between their names and major/minor numbers, the
read routine will sprintf the data off the end of the page and oops the kernel.
other proc files that are part of proc_misc.c protect against this with a length
check that truncates the file if it goes over a page, but this check is missing
from get_device_list and get_blkdev_list.
Version-Release number of selected component (if applicable):
Steps to Reproduce:
1. register sufficient char/block devices in a system to create > 4096 bytes of
string data for /proc/devices
2. cat /proc/devices
system will oops on a page fault
system should truncate file to 4096 bytes.
Created attachment 113681 [details]
patch to add missing length check to /proc/devices file
Hi Neil -
This ticket fell off my radar. It looks like the RHEL3 patch applies to 2.1.
Can you attach a test case for this issue?
I don't think I have my old test case laying about any more, but suffice it
to say, all you need to do is write a kernel module that calls register_chrdev
for 256 different major/minor combinations, and give each device a name that is
at least 20 characters long. That will overrun the 4k buffer that is allocated
for /proc/devices and cause an oops. with the patch the file will be truncated
at 4096 bytes.
I'll see if I can throw my old test code back together in a little bit.
Thanks for checking, Neil. Don't worry about re-creating your testcase, I can
bug reproduced using e.70 and fix verified on e.71.
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.