From: Max Filippov <jcmvbkbc@xxxxxxxxx>
commit c6a09e342f8e6d3cac7f7c5c14085236aca284b9 upstream.
create_elf_fdpic_tables() does not correctly account the space for the
AUX vector when an architecture has ELF_HWCAP2 defined. Prior to the
commit 10e29251be0e ("binfmt_elf_fdpic: fix /proc/<pid>/auxv") it
resulted in the last entry of the AUX vector being set to zero, but with
that change it results in a kernel BUG.
Fix that by adding one to the number of AUXV entries (nitems) when
ELF_HWCAP2 is defined.
Fixes: 10e29251be0e ("binfmt_elf_fdpic: fix /proc/<pid>/auxv")
Cc: stable@xxxxxxxxxxxxxxx
Reported-by: Greg Ungerer <gerg@xxxxxxxxxx>
Closes: https://lore.kernel.org/lkml/5b51975f-6d0b-413c-8b38-39a6a45e8821@xxxxxxxxxxxxxx/
Signed-off-by: Max Filippov <jcmvbkbc@xxxxxxxxx>
Tested-by: Greg Ungerer <gerg@xxxxxxxxxx>
Link: https://lore.kernel.org/r/20240826032745.3423812-1-jcmvbkbc@xxxxxxxxx
Signed-off-by: Kees Cook <kees@xxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
fs/binfmt_elf_fdpic.c | 3 +++
1 file changed, 3 insertions(+)
--- a/fs/binfmt_elf_fdpic.c
+++ b/fs/binfmt_elf_fdpic.c
@@ -592,6 +592,9 @@ static int create_elf_fdpic_tables(struc
if (bprm->have_execfd)
nitems++;
+#ifdef ELF_HWCAP2
+ nitems++;
+#endif
csp = sp;
sp -= nitems * 2 * sizeof(unsigned long);
Patches currently in stable-queue which might be from jcmvbkbc@xxxxxxxxx are
queue-6.10/binfmt_elf_fdpic-fix-auxv-size-calculation-when-elf_hwcap2-is-defined.patch
