[kernel/f15] Add patch to fix PIE execution with ASLR disabled (rhbz 708563)
Josh Boyer
jwboyer at fedoraproject.org
Mon Oct 3 18:47:28 UTC 2011
commit e0adc28e6310d1393f535777d3930b885d03698e
Author: Josh Boyer <jwboyer at redhat.com>
Date: Mon Oct 3 14:46:45 2011 -0400
Add patch to fix PIE execution with ASLR disabled (rhbz 708563)
...lf-fix-PIE-execution-with-random-disabled.patch | 87 ++++++++++++++++++++
kernel.spec | 9 ++
2 files changed, 96 insertions(+), 0 deletions(-)
---
diff --git a/binfmt_elf-fix-PIE-execution-with-random-disabled.patch b/binfmt_elf-fix-PIE-execution-with-random-disabled.patch
new file mode 100644
index 0000000..b376c88
--- /dev/null
+++ b/binfmt_elf-fix-PIE-execution-with-random-disabled.patch
@@ -0,0 +1,87 @@
+On Mon, 3 Oct 2011, Josh Boyer wrote:
+
+> > > Perhaps another check here for randomize? Something like:
+> > >
+> > > #if defined(CONFIG_X86) || defined(CONFIG_ARM)
+> > > if (current->flags & PF_RANDOMIZE)
+> > > load_bias = 0;
+> > > else if (vaddr)
+> > > load_bias = 0;
+> > > else
+> > > load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE);
+> > > #else
+> > > load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
+> > > #endif
+> > >
+> > > If that's stupid, then feel free to tell me. I won't pretend like I
+> > > understand what is going on here yet, but based on the explanation you
+> > > provided that might work.
+> >
+> > I have just verified my hunch that the original patch from H.J. / Josh
+> > breaks ASLR completely, so Andrew, please drop it for now.
+>
+> Yes, please drop the original.
+
+Thanks.
+
+> > I am now looking into how to fix things properly.
+> >
+> > Josh, looking at what you are proposing -- do you see any reason to make
+> > the behavior different in #else branch and in !(current->flags &
+> > PF_RANDOMIZE) case?
+>
+> I was mostly just trying to adapt H.J.'s patch to account for the
+> PF_RANDOMIZE case. Looking at it a bit more, I'm not sure why they
+> would need to be different. H.J., do you recall why you made that
+> change originally?
+
+How about the patch below instead? It survives my testing, and I believe
+it handles both cases properly.
+
+Confirmation from the original bug reporter would obviously be a nice
+bonus too :)
+
+
+
+
+From: Jiri Kosina <jkosina at suse.cz>
+Subject: [PATCH] binfmt_elf: fix PIE execution with randomization disabled
+
+The case of address space randomization being disabled in runtime through
+randomize_va_space sysctl is not treated properly in load_elf_binary(),
+resulting in SIGKILL coming at exec() time for certain PIE-linked binaries
+in case the randomization has been disabled at runtime prior to calling
+exec().
+
+Handle the randomize_va_space == 0 case the same way as if we were not
+supporting .text randomization at all.
+
+Based on original patch by H.J. Lu <hongjiu.lu at intel.com> and
+Josh Boyer <jwboyer at redhat.com>
+
+Cc: Ingo Molnar <mingo at elte.hu>
+Cc: Jiri Kosina <jkosina at suse.cz>
+Cc: Nicolas Pitre <nicolas.pitre at linaro.org>
+Cc: Russell King <rmk at arm.linux.org.uk>
+Signed-off-by: Jiri Kosina <jkosina at suse.cz>
+---
+ fs/binfmt_elf.c | 5 ++++-
+ 1 files changed, 4 insertions(+), 1 deletions(-)
+
+diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
+index dd0fdfc..bb11fe4 100644
+--- a/fs/binfmt_elf.c
++++ b/fs/binfmt_elf.c
+@@ -795,7 +795,10 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
+ * might try to exec. This is because the brk will
+ * follow the loader, and is not movable. */
+ #if defined(CONFIG_X86) || defined(CONFIG_ARM)
+- load_bias = 0;
++ if (current->flags & PF_RANDOMIZE)
++ load_bias = 0;
++ else
++ load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
+ #else
+ load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
+ #endif
+
diff --git a/kernel.spec b/kernel.spec
index 57843e0..2ba7d58 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -709,6 +709,9 @@ Patch21014: block-Free-queue-resources-at-blk_release_queue.patch
Patch21015: x86-Save-stack-pointer-in-perf-live-regs-savings.patch
Patch21016: x86-Fetch-stack-from-regs-when-possible-in-dump_trac.patch
+#rhbz #708563
+Patch21017: binfmt_elf-fix-PIE-execution-with-random-disabled.patch
+
%endif
BuildRoot: %{_tmppath}/kernel-%{KVERREL}-root
@@ -1287,6 +1290,9 @@ ApplyPatch block-Free-queue-resources-at-blk_release_queue.patch
ApplyPatch x86-Save-stack-pointer-in-perf-live-regs-savings.patch
ApplyPatch x86-Fetch-stack-from-regs-when-possible-in-dump_trac.patch
+#rhbz #708563
+ApplyPatch binfmt_elf-fix-PIE-execution-with-random-disabled.patch
+
# END OF PATCH APPLICATIONS
%endif
@@ -1907,6 +1913,9 @@ fi
# and build.
%changelog
+* Mon Oct 04 2011 Josh Boyer <jwboyer at redhat.com> 2.6.40.4-6
+- Add patch to fix PIE execution when ASLR is disabled at runtime (rhbz 708563)
+
* Thu Sep 29 2011 Josh Boyer <jwboyer at redhat.com>
- Backport two upstream patches to fix rhbz 700718
More information about the scm-commits
mailing list