create_elf_fdpic_tables() does not correctly account the space for the
AUX vector when an architecture has ELF_HWCAP2 defined. Prior to the
commit 10e29251be0e ("binfmt_elf_fdpic: fix /proc/<pid>/auxv") it
resulted in the last entry of the AUX vector being set to zero, but with
that change it results in a kernel BUG.

Fix that by adding one to the number of AUXV entries (nitems) when
ELF_HWCAP2 is defined.

Fixes: 10e29251be0e ("binfmt_elf_fdpic: fix /proc/<pid>/auxv")
Cc: stable@vger.kernel.org
Reported-by: Greg Ungerer <gregungerer@westnet.com.au>
Closes: https://lore.kernel.org/lkml/5b51975f-6d0b-413c-8b38-39a6a45e8821@westnet.com.au/
Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
---
 fs/binfmt_elf_fdpic.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/binfmt_elf_fdpic.c b/fs/binfmt_elf_fdpic.c
index c11289e1301b..a5cb45cb30c8 100644
--- a/fs/binfmt_elf_fdpic.c
+++ b/fs/binfmt_elf_fdpic.c
@@ -594,6 +594,9 @@ static int create_elf_fdpic_tables(struct linux_binprm *bprm,
 
 	if (bprm->have_execfd)
 		nitems++;
+#ifdef ELF_HWCAP2
+	nitems++;
+#endif
 
 	csp = sp;
 	sp -= nitems * 2 * sizeof(unsigned long);
-- 
2.39.2

On Sun, 25 Aug 2024 20:27:45 -0700, Max Filippov wrote:
> create_elf_fdpic_tables() does not correctly account the space for the
> AUX vector when an architecture has ELF_HWCAP2 defined. Prior to the
> commit 10e29251be0e ("binfmt_elf_fdpic: fix /proc/<pid>/auxv") it
> resulted in the last entry of the AUX vector being set to zero, but with
> that change it results in a kernel BUG.
> 
> Fix that by adding one to the number of AUXV entries (nitems) when
> ELF_HWCAP2 is defined.
> 
> [...]

Applied to for-linus/execve, thanks!

[1/1] binfmt_elf_fdpic: fix AUXV size calculation when ELF_HWCAP2 is defined
      https://git.kernel.org/kees/c/c6a09e342f8e

Take care,

-- 
Kees Cook

Hi Max,

On 26/8/24 13:27, Max Filippov wrote:
> create_elf_fdpic_tables() does not correctly account the space for the
> AUX vector when an architecture has ELF_HWCAP2 defined. Prior to the
> commit 10e29251be0e ("binfmt_elf_fdpic: fix /proc/<pid>/auxv") it
> resulted in the last entry of the AUX vector being set to zero, but with
> that change it results in a kernel BUG.
> 
> Fix that by adding one to the number of AUXV entries (nitems) when
> ELF_HWCAP2 is defined.
> 
> Fixes: 10e29251be0e ("binfmt_elf_fdpic: fix /proc/<pid>/auxv")
> Cc: stable@vger.kernel.org
> Reported-by: Greg Ungerer <gregungerer@westnet.com.au>

Feel free to use my gerg@kernel.org email for this.


> Closes: https://lore.kernel.org/lkml/5b51975f-6d0b-413c-8b38-39a6a45e8821@westnet.com.au/
> Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>

Certainly fixes it for all my failing test cases, so:

Tested-by: Greg Ungerer <gerg@kernel.org>

Thanks for looking into it and the fix.

Regards
Greg


> ---
>   fs/binfmt_elf_fdpic.c | 3 +++
>   1 file changed, 3 insertions(+)
> 
> diff --git a/fs/binfmt_elf_fdpic.c b/fs/binfmt_elf_fdpic.c
> index c11289e1301b..a5cb45cb30c8 100644
> --- a/fs/binfmt_elf_fdpic.c
> +++ b/fs/binfmt_elf_fdpic.c
> @@ -594,6 +594,9 @@ static int create_elf_fdpic_tables(struct linux_binprm *bprm,
>   
>   	if (bprm->have_execfd)
>   		nitems++;
> +#ifdef ELF_HWCAP2
> +	nitems++;
> +#endif
>   
>   	csp = sp;
>   	sp -= nitems * 2 * sizeof(unsigned long);