Re: [PATCH] prctl: fix PR_SET_MM_AUXV losing the forced AT_NULL terminator

[Alexey Dobriyan]

On Sun, Aug 09, 2026 at 12:29:01AM +0000, Bradley Morgan wrote:
> prctl_set_auxv() copies the user vector into a stack buffer, forces
> AT_NULL on the last two entries there, and then copies only len bytes
> into mm->saved_auxv. Which is fine until the vector is shorter than
> the buffer, because then the forced terminator sits past the end of
> the copy and never lands in saved_auxv at all.

> --- a/kernel/sys.c
> +++ b/kernel/sys.c
> @@ -2189,7 +2189,7 @@ static int prctl_set_auxv(struct mm_struct *mm, unsigned long addr,
>  	BUILD_BUG_ON(sizeof(user_auxv) != sizeof(mm->saved_auxv));
>  
>  	task_lock(current);
> -	memcpy(mm->saved_auxv, user_auxv, len);
> +	memcpy(mm->saved_auxv, user_auxv, sizeof(user_auxv));
>  	task_unlock(current);

You're supposed to use prctl(PR_SET_MM_AUXV) with correct "len", yes.

This is userspace visible, warning could be added for another 14 years
and then line changed.

	PR_ALEXEY