[kernel/f15] Add patch to fix PIE execution with ASLR disabled (rhbz 708563)

[Josh Boyer]

commit e0adc28e6310d1393f535777d3930b885d03698e
Author: Josh Boyer <jwboyer at redhat.com>
Date:   Mon Oct 3 14:46:45 2011 -0400

    Add patch to fix PIE execution with ASLR disabled (rhbz 708563)

 ...lf-fix-PIE-execution-with-random-disabled.patch |   87 ++++++++++++++++++++
 kernel.spec                                        |    9 ++
 2 files changed, 96 insertions(+), 0 deletions(-)
---
diff --git a/binfmt_elf-fix-PIE-execution-with-random-disabled.patch b/binfmt_elf-fix-PIE-execution-with-random-disabled.patch
new file mode 100644
index 0000000..b376c88
--- /dev/null
+++ b/binfmt_elf-fix-PIE-execution-with-random-disabled.patch
@@ -0,0 +1,87 @@
+On Mon, 3 Oct 2011, Josh Boyer wrote:
+
+> > > Perhaps another check here for randomize?  Something like:
+> > > 
+> > > #if defined(CONFIG_X86) || defined(CONFIG_ARM)
+> > > 		if (current->flags & PF_RANDOMIZE)
+> > > 			load_bias = 0;
+> > > 		else if (vaddr)
+> > > 			load_bias = 0;
+> > > 		else
+> > > 			load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE);
+> > > #else
+> > > 		load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
+> > > #endif
+> > > 
+> > > If that's stupid, then feel free to tell me.  I won't pretend like I
+> > > understand what is going on here yet, but based on the explanation you
+> > > provided that might work.
+> > 
+> > I have just verified my hunch that the original patch from H.J. / Josh 
+> > breaks ASLR completely, so Andrew, please drop it for now.
+> 
+> Yes, please drop the original.
+
+Thanks.
+
+> > I am now looking into how to fix things properly.
+> > 
+> > Josh, looking at what you are proposing -- do you see any reason to make 
+> > the behavior different in #else branch and in !(current->flags & 
+> > PF_RANDOMIZE) case?
+> 
+> I was mostly just trying to adapt H.J.'s patch to account for the
+> PF_RANDOMIZE case.  Looking at it a bit more, I'm not sure why they
+> would need to be different.  H.J., do you recall why you made that
+> change originally?
+
+How about the patch below instead? It survives my testing, and I believe 
+it handles both cases properly.
+
+Confirmation from the original bug reporter would obviously be a nice 
+bonus too :)
+
+
+
+
+From: Jiri Kosina <jkosina at suse.cz>
+Subject: [PATCH] binfmt_elf: fix PIE execution with randomization disabled
+
+The case of address space randomization being disabled in runtime through
+randomize_va_space sysctl is not treated properly in load_elf_binary(),
+resulting in SIGKILL coming at exec() time for certain PIE-linked binaries
+in case the randomization has been disabled at runtime prior to calling
+exec().
+
+Handle the randomize_va_space == 0 case the same way as if we were not
+supporting .text randomization at all.
+
+Based on original patch by H.J. Lu <hongjiu.lu at intel.com> and
+Josh Boyer <jwboyer at redhat.com>
+
+Cc: Ingo Molnar <mingo at elte.hu>
+Cc: Jiri Kosina <jkosina at suse.cz>
+Cc: Nicolas Pitre <nicolas.pitre at linaro.org>
+Cc: Russell King <rmk at arm.linux.org.uk>
+Signed-off-by: Jiri Kosina <jkosina at suse.cz>
+---
+ fs/binfmt_elf.c |    5 ++++-
+ 1 files changed, 4 insertions(+), 1 deletions(-)
+
+diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
+index dd0fdfc..bb11fe4 100644
+--- a/fs/binfmt_elf.c
++++ b/fs/binfmt_elf.c
+@@ -795,7 +795,10 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs)
+ 			 * might try to exec.  This is because the brk will
+ 			 * follow the loader, and is not movable.  */
+ #if defined(CONFIG_X86) || defined(CONFIG_ARM)
+-			load_bias = 0;
++			if (current->flags & PF_RANDOMIZE)
++				load_bias = 0;
++			else
++				load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
+ #else
+ 			load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
+ #endif
+
diff --git a/kernel.spec b/kernel.spec
index 57843e0..2ba7d58 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -709,6 +709,9 @@ Patch21014: block-Free-queue-resources-at-blk_release_queue.patch
 Patch21015: x86-Save-stack-pointer-in-perf-live-regs-savings.patch
 Patch21016: x86-Fetch-stack-from-regs-when-possible-in-dump_trac.patch
 
+#rhbz #708563
+Patch21017: binfmt_elf-fix-PIE-execution-with-random-disabled.patch
+
 %endif
 
 BuildRoot: %{_tmppath}/kernel-%{KVERREL}-root
@@ -1287,6 +1290,9 @@ ApplyPatch block-Free-queue-resources-at-blk_release_queue.patch
 ApplyPatch x86-Save-stack-pointer-in-perf-live-regs-savings.patch
 ApplyPatch x86-Fetch-stack-from-regs-when-possible-in-dump_trac.patch
 
+#rhbz #708563
+ApplyPatch binfmt_elf-fix-PIE-execution-with-random-disabled.patch
+
 # END OF PATCH APPLICATIONS
 
 %endif
@@ -1907,6 +1913,9 @@ fi
 # and build.
 
 %changelog
+* Mon Oct 04 2011 Josh Boyer <jwboyer at redhat.com> 2.6.40.4-6
+- Add patch to fix PIE execution when ASLR is disabled at runtime (rhbz 708563)
+
 * Thu Sep 29 2011 Josh Boyer <jwboyer at redhat.com>
 - Backport two upstream patches to fix rhbz 700718