Re: [PATCH] prctl: fix PR_SET_MM_AUXV losing the forced AT_NULL terminator

[Bradley Morgan]

On 10 August 2026 05:50:32 BST, Alexey Dobriyan <adobriyan@xxxxxxxxx>
wrote:
>On Sun, Aug 09, 2026 at 12:29:01AM +0000, Bradley Morgan wrote:
>> prctl_set_auxv() copies the user vector into a stack buffer, forces
>> AT_NULL on the last two entries there, and then copies only len bytes
>> into mm->saved_auxv. Which is fine until the vector is shorter than
>> the buffer, because then the forced terminator sits past the end of
>> the copy and never lands in saved_auxv at all.
>
>> --- a/kernel/sys.c
>> +++ b/kernel/sys.c
>> @@ -2189,7 +2189,7 @@ static int prctl_set_auxv(struct mm_struct *mm,
>unsigned long addr,
>>  	BUILD_BUG_ON(sizeof(user_auxv) != sizeof(mm->saved_auxv));
>>  
>>  	task_lock(current);
>> -	memcpy(mm->saved_auxv, user_auxv, len);
>> +	memcpy(mm->saved_auxv, user_auxv, sizeof(user_auxv));
>>  	task_unlock(current);
>
>You're supposed to use prctl(PR_SET_MM_AUXV) with correct "len", yes.
>
>This is userspace visible, warning could be added for another 14 years
>and then line changed.
>

well, the callers can't regress, so theres simply no point of adding a
warn. best to just fix it


>	PR_ALEXEY
>

Thanks!