Re: [PATCH] prctl: fix PR_SET_MM_AUXV kernel stack leak

[Oleg Nesterov]

On 03/14, Alexey Dobriyan wrote:
>
> 	prctl(PR_SET_MM, PR_SET_MM_AUXV, addr, 1);
>
> will copy 1 byte from userspace to (quite big) on-stack array
> and then stash everything to mm->saved_auxv.

I too don't understand, memcpy(mm->saved_auxv, user_auxv, len) will
copy 1 byte...

And why task_lock(current) ? What does it try to protect?

Oleg.