Description of problem:

  In the lots of continuous processes of mount.nfs4 operation, the failure case will
usually happen, exit with the retval "EINVAL" and the error msg "Segmentation
fault".

Version-Release number of selected component (if applicable):
 kernel

How reproducible:
In the lots of continuous processs of mount.nfs4 operation, the failure case
will usually happen, exit with the retval "EINVAL" and the error msg
"Segmentation fault".

Steps to Reproduce:
1. execute a elf-format excutable file (for example, mount.nfs4) 
2. repeat the step 1 for about 2000~8192 times

Expected results:

I have investigated the problem, and found the cause is the problem with the
binary loader of the kernel when the error "Segmentation fault" happened.

I think that the cause for the "segment fault" is the limitation of the
design in the load_elf_binary and load_elf_interp().

The operation flow of the getting elf_interp map address and judgment is as follows.
(execute mount.nfs4)
sys_execve
   | - do_execve
         |
      | - search_binary_handler  
        |-  linux_binfmt= elf_format

        |-  elf_format->load_elf_binary
                      | -  elf_entry = load_elf_interp()
                      |                    | vaddr = eppnt->p_vaddr;
                      |                    *| kernel_read（..., &eppnt,..）*
                      |                    | *map_addr = elf_map()*
                      |                    |  *if  (BAD_ADDR(map_addr)*
                      |                    |      |-load_addr = map_addr -
ELF_PAGESTART(vaddr);   
                      |                    |return load_addr
                      |
                      |----- if (BAD_ADDR(elf_entry)) 
                      |        |--- elf_entry = elf_entry +
loc->interp_elf_ex.e_entry;
                      |
                      |- if  (BAD_ADDR(elf_entry)) 
                      |  force_sig(SIGSEGV, current);
                      |     retval =-EINVAL;

In the do_execve(), after setuping up some data structure, the do_execve() will
invoke the search_binary_handler() to get the corresponding ELF binary loader
for the mount.nfs4, then read the ELF executable image into memory, for each
segments and sections,include interp segment. In our test, when the "segment
fault" of mount.nfs4 happened, in the procedure of load_elf_binary(), the
address elf_entry of the interp segment read from the load_elf_interp() was
fault, it was judged a BAD_ADDR and afterwards the kernel send a forcible signal
"SIGSEGV" to the process of mount.nfs4, and exit with the retval "EINVAL".
Therefore, the error happended.

In the load_elf_interp(), the eppnt->p_vaddr is the virtual address of
the mapped segment, it is a fixed address, in the mount.nfs4, it is
7503872.
The map_addr is return from the *elf_map(). Because the mount.nfs4 is a
ET_DYN( DYN (Shared object file)) **executable **program, the map_addr
will be a random **mapped address** return by the elf_map().
In normal case, **the map_addr is * beyond the vaddr (the relocation
adjustment address is return by the "map_addr - ELF_PAGESTART(vaddr)").
After the judgment on whether the elf_entry is BAD_ADDR, the elf_entry
will be adjusted to the user virtual address of the current process by
"elf_entry + loc->interp_elf_ex.e_entry". The adjusted elf_entry address
will be used as the pointer of the startup routine of the process.
But unluckily, for the map_addr return from the *elf_map() is **random,
it is possible that the *map_addr will be less than the vaddr, then the
problem is happened..
In the lots of continuous mount operations, the failure case will
usually happen. In the failure case, the map_addr was 7499776 , which
was less then the vaddr 7503872. When the "map_addr -
ELF_PAGESTART(vaddr)" is calculated, for they are all unsigned long
type, the result load_addr was 4294963200, then in the judgment on
whether the elf_entry is BAD_ADDR, the load_addr was considered as a
BAD_ADDR, for the load_addr is larger than the TASK_SIZE at that time.
Before the adjustment to the user virtual address, the SIGSEGV was sent,
and the process was exited.

The bug is the BAD_ADDR judgment before the user virtual address
adjustment "elf_entry + loc->interp_elf_ex.e_entry". In fact, the
address as the pointer of the startup routine is the adjusted virtual
address, the elf_entry returned from the load_elf_interp() is just
relative addrss base the load_base address. The judgment on whether the
elf_entry is BAD_ADDR should only be set after the adjusted virtual
address "elf_entry + loc->interp_elf_ex.e_entry" .

For the problem in binfmt_elf, I have made a patch for the limitation of
design.

I have tested, after the patch is applied, the problem with the "segment
fault " can be resolved.
The attachment is the patch for the kernel of RHEL5Beta2.