Re: [PATCH] prctl: fix PR_SET_MM_AUXV kernel stack leak

[Dan Carpenter <dan.carpenter@oracle.com>]

On Sun, Mar 14, 2021 at 11:51:14PM +0300, Alexey Dobriyan wrote:
> 	prctl(PR_SET_MM, PR_SET_MM_AUXV, addr, 1);
> 
> will copy 1 byte from userspace to (quite big) on-stack array
> and then stash everything to mm->saved_auxv.

What?  It won't save everything, only the 1 byte.  What am I not seeing?

kernel/sys.c
  2073  static int prctl_set_auxv(struct mm_struct *mm, unsigned long addr,
  2074                            unsigned long len)
  2075  {
  2076          /*
  2077           * This doesn't move the auxiliary vector itself since it's pinned to
  2078           * mm_struct, but it permits filling the vector with new values.  It's
  2079           * up to the caller to provide sane values here, otherwise userspace
  2080           * tools which use this vector might be unhappy.
  2081           */
  2082          unsigned long user_auxv[AT_VECTOR_SIZE] = {};
  2083  
  2084          if (len > sizeof(user_auxv))
  2085                  return -EINVAL;
  2086  
  2087          if (copy_from_user(user_auxv, (const void __user *)addr, len))
                                   ^^^^^^^^^                             ^^^
Copies one byte from user space.

  2088                  return -EFAULT;
  2089  
  2090          /* Make sure the last entry is always AT_NULL */
  2091          user_auxv[AT_VECTOR_SIZE - 2] = 0;
  2092          user_auxv[AT_VECTOR_SIZE - 1] = 0;
  2093  
  2094          BUILD_BUG_ON(sizeof(user_auxv) != sizeof(mm->saved_auxv));
  2095  
  2096          task_lock(current);
  2097          memcpy(mm->saved_auxv, user_auxv, len);
                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Saves one byte to mm->saved_auxv.

  2098          task_unlock(current);
  2099  
  2100          return 0;
  2101  }

regards,
dan carpenter