Skip to content
Open
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 18 additions & 0 deletions src/execve/aoxp.c
Original file line number Diff line number Diff line change
Expand Up @@ -356,7 +356,9 @@ int push_array_of_xpointers(ArrayOfXPointers *array, Reg reg)
struct iovec *local;
size_t local_count;
size_t total_size;
size_t padding_size;
word_t *pod_array;
word_t stack_pointer;
word_t tracee_ptr;
int status;
size_t i;
Expand Down Expand Up @@ -411,6 +413,22 @@ int push_array_of_xpointers(ArrayOfXPointers *array, Reg reg)
return 0;
assert(local_count < array->length + 1);

/* Keep the base address of the pushed pointer table aligned.
* Without this padding, AArch64 shebang execve can place argv[] at an
* odd stack address (for example 0x...989), and the kernel then rejects
* execve with EFAULT even though argv[], envp[], and the strings are all
* readable. The padding stays above the copied data, so the offsets that
* were computed for each pointee remain valid and only the allocation base
* moves downward. */
stack_pointer = peek_reg(tracee, CURRENT, STACK_POINTER);
padding_size = (stack_pointer - total_size)
#ifdef ARCH_ARM64
% 16;
#else
% sizeof_word(tracee);
#endif
total_size += padding_size;
Comment thread
Ebola-Chan-bot marked this conversation as resolved.

/* Modified pointees and the pod array are stored in a tracee's
* memory block. */
tracee_ptr = alloc_mem(tracee, total_size);
Expand Down
Loading