bug in load_elf_binary [PATCH]

In kernel 2.4.3 and 2.2.18, there is a bug in fs/binfmt_elf.c function load_elf_binary(). An ET_DYN file that asks for a PT_INTERP, and whose first PT_LOAD is not at 0, gets AT_PHDR that is (load_bias + 2 * p_vaddr), instead of the correct (load_bias + p_vaddr). The patch for 2.4.3 is

@@ -632,5 +632,5 @@
                                load_bias += error -
                                             ELF_PAGESTART(load_bias + vaddr);
-                               load_addr += error;
+                               load_addr += load_bias;
                        }
                }

=====
Please cc: me if appropriate; I'm not subscribed.

To demonstrate the problem on i386:
cat >foo.s <<EOF

	.section ".interp"
	.asciz "/tmp/ld-linux.so.2"
	.text

_start: .weak _start
main: .weak main
foo:
jmp foo
EOF

gcc -nostartfiles -o foo.so foo.s
# Now, binary edit foo.so to change Elf32_Ehdr.e_type from ET_EXEC to ET_DYN. # The 'short' at file offset 0x10 goes from 2 to 3.

cp /lib/ld-linux.so.2 /tmp
# Now, binary edit /tmp/ld-linux.so.2 so that it begins with an infinite loop. # "objdump -f" gives the entry address. (short)0xfeeb is an infinite loop.

nice ldd foo.so & # Here is the failure. Start in background at low priority.

cat /proc/<pid_of_foo.so>/maps # I see pid_of_foo.so = 2 + pid_of_nice # output:
# 88048000-88049000 r-xp 00000000 03:07 2207 foo.so # load_bias is 0x80000000 # 88049000-8804a000 rw-p 00000000 03:07 2207 foo.so

gdb foo.so <pid_of_foo.so> # Attach to process, and look at its memory. x/64x $esp # and continue until seeing the AT_* on the stack. I see

# 0xbffffa90:     0xbfffffe8      0x00000000      0x00000003      0x90090034
# 0xbffffaa0:     0x00000004      0x00000020      0x00000005      0x00000005
# 0xbffffab0:     0x00000006      0x00001000      0x00000007      0x40000000
# 0xbffffac0:     0x00000008      0x00000000      0x00000009      0x88048114

# which shows AT_PHDR at 0xbffffa9c of 0x90090034
#                  which is too big by 0x08048000  [p_vaddr of first PT_LOAD]
#         because the correct value is 0x88048034.
# Note that  AT_ENTRY at 0xbffffacc is 0x88048114  which is correct.

John Reiser, [email protected]