Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.
Bug 217621 - kernel may oops if more than 4k worth of string data returned in /proc/devices
kernel may oops if more than 4k worth of string data returned in /proc/devices
Product: Red Hat Enterprise Linux 2.1
Classification: Red Hat
Component: kernel (Show other bugs)
ia64 Linux
medium Severity medium
: ---
: ---
Assigned To: Don Howard
Brian Brock
Depends On:
  Show dependency treegraph
Reported: 2006-11-28 18:38 EST by Don Howard
Modified: 2007-11-30 17:06 EST (History)
1 user (show)

See Also:
Fixed In Version: RHSA-2007-0012
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2007-01-17 05:51:44 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2007:0012 normal SHIPPED_LIVE Moderate: kernel security update 2007-01-17 05:51:04 EST

  None (edit)
Description Don Howard 2006-11-28 18:38:46 EST
+++ This bug was initially created as a clone of Bug #156029 +++

Description of problem:
the read routine for /proc/devices is missing a length check routine. 
Consequently, if the number of block and char devices in a system totals more
than 4096 bytes of string data between their names and major/minor numbers, the
read routine will sprintf the data off the end of the page and oops the kernel.
other proc files that are part of proc_misc.c protect against this with a length
check that truncates the file if it goes over a page, but this check is missing
from get_device_list and get_blkdev_list.

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1. register sufficient char/block devices in a system to create > 4096 bytes of
string data for /proc/devices
2. cat /proc/devices
Actual results:
system will oops on a page fault

Expected results:
system should truncate file to 4096 bytes.

Additional info:
Comment 3 Mike Gahagan 2006-12-19 17:55:28 EST
I was unable to reproduce the problem with the test module from bz 156029,
however I have verified that the fix is being applied in the 2.4.18-e.64 kernel.
Comment 5 Red Hat Bugzilla 2007-01-17 05:51:44 EST
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.


Note You need to log in before you can comment on or make changes to this bug.