From: Marcus Meissner Date: Thu, 7 Dec 2006 04:36:24 +0000 (-0800) Subject: [PATCH] binfmt_elf: randomize PIE binaries (2nd try) X-Git-Tag: v2.6.20-rc1~15^2~14^2~212 X-Git-Url: http://git.samba.org/samba.git/?p=sfrench%2Fcifs-2.6.git;a=commitdiff_plain;h=59287c0913cc9a6c75712a775f6c1c1ef418ef3b [PATCH] binfmt_elf: randomize PIE binaries (2nd try) Randomizes -pie compiled binaries from 64k (0x10000) up to ELF_ET_DYN_BASE. 0 -> 64k is excluded to allow NULL ptr accesses to fail. Signed-off-by: Marcus Meissner Cc: Ingo Molnar Cc: Dave Jones Cc: Arjan van de Ven Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c index cc72bb43061d..b2efbaead6c3 100644 --- a/fs/binfmt_elf.c +++ b/fs/binfmt_elf.c @@ -856,7 +856,13 @@ static int load_elf_binary(struct linux_binprm *bprm, struct pt_regs *regs) * default mmap base, as well as whatever program they * might try to exec. This is because the brk will * follow the loader, and is not movable. */ - load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr); + if (current->flags & PF_RANDOMIZE) + load_bias = randomize_range(0x10000, + ELF_ET_DYN_BASE, + 0); + else + load_bias = ELF_ET_DYN_BASE; + load_bias = ELF_PAGESTART(load_bias - vaddr); } error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt,