https://bugs.kde.org/show_bug.cgi?id=528086
Bug ID: 528086
Summary: prctl(PR_GET_AUXV) returns the tool's auxv instead of
the client's
Classification: Developer tools
Product: valgrind
Version First unspecified
Reported In:
Platform: Ubuntu
OS: Other
Status: REPORTED
Severity: normal
Priority: NOR
Component: general
Assignee: [email protected]
Reporter: [email protected]
Target Milestone: ---
Since Linux 6.4, prctl(PR_GET_AUXV) copies out the auxv the kernel saved at
exec. Valgrind passes the call through, so the client gets the auxv of the tool
executable instead of the one Valgrind built for it and already serves as
/proc/self/auxv. AT_EXECFN, AT_PHDR, AT_ENTRY, AT_RANDOM etc. all describe the
tool.
uutils coreutils 0.8, the default coreutils since Ubuntu 25.10, picks its
applet from AT_EXECFN read this way, so every coreutils command fails under
Valgrind:
$ valgrind -q pwd
... Invalid read of size 1 (strlen, memmove, ...) ...
coreutils: unknown program 'memcheck-amd64-linux'
For the same reason none/tests/nocwd, none/tests/scripts/bug231357 and
none/tests/fdleak_cat fail on such systems.
Kernels before 6.4 are not affected, as readers such as rustix fall back to
/proc/self/auxv there.
Reproducer:
#include <stdio.h>
#include <sys/auxv.h>
#include <sys/prctl.h>
int main(void)
{
unsigned long auxv[128] = { 0 };
prctl(0x41555856 /* PR_GET_AUXV */, auxv, sizeof(auxv), 0UL, 0UL);
for (unsigned long *p = auxv; p[0] != AT_NULL; p += 2)
if (p[0] == AT_EXECFN)
printf("PR_GET_AUXV: %s\n", (char *)p[1]);
printf("getauxval: %s\n", (char *)getauxval(AT_EXECFN));
return 0;
}
Natively both lines print "./execfn". Under Valgrind the PR_GET_AUXV line
prints ".../memcheck-amd64-linux" and memcheck reports invalid reads of that
string.
I reproduced this on:
- Version: git master (492dde29d)
- OS: Linux (amd64; Ubuntu 26.04, kernel 7.0)
--
You are receiving this mail because:
You are watching all bug changes.
