elf: Add elf/tst-dlopenfail-2 [BZ #25396]

Without CET, a jump into a newly loaded object through an overwritten
link map often does not crash, it just executes some random code.
CET detects this in some cases because the function pointer does not
point to the start of a function in the replacement shared object,
so there is no ENDBR instruction.

The new test uses a small shared object and the existing dangling
link map to trigger the bug.

Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>

1 files changed, 59 insertions, 0 deletions

diff --git a/elf/tst-dlopenfail-2.c b/elf/tst-dlopenfail-2.c
new file mode 100644
index 0000000000..35bbde64ab
--- /dev/null
+++ b/elf/tst-dlopenfail-2.c
@@ -0,0 +1,59 @@
+/* Test unrelated dlopen after dlopen failure involving NODELETE.
+   Copyright (C) 2019-2020 Free Software Foundation, Inc.
+   This file is part of the GNU C Library.
+
+   The GNU C Library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 2.1 of the License, or (at your option) any later version.
+
+   The GNU C Library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with the GNU C Library; if not, see
+   <https://www.gnu.org/licenses/>.  */
+
+#include <dlfcn.h>
+#include <errno.h>
+#include <gnu/lib-names.h>
+#include <stddef.h>
+#include <stdio.h>
+#include <string.h>
+#include <support/check.h>
+#include <support/xdlfcn.h>
+
+static int
+do_test (void)
+{
+  /* This test uses libpthread as the canonical NODELETE module.  If
+     libpthread is no longer NODELETE because it has been merged into
+     libc, the test needs to be updated.  */
+  TEST_VERIFY (dlsym (NULL, "pthread_create") == NULL);
+
+  /* This is expected to fail because of the missing dependency.  */
+  puts ("info: attempting to load tst-dlopenfailmod1.so");
+  TEST_VERIFY (dlopen ("tst-dlopenfailmod1.so", RTLD_LAZY) == NULL);
+  const char *message = dlerror ();
+  TEST_COMPARE_STRING (message,
+                       "tst-dlopenfail-missingmod.so:"
+                       " cannot open shared object file:"
+                       " No such file or directory");
+
+  /* Open a small shared object.  With a dangling GL (dl_initfirst)
+     pointer, this is likely to crash because there is no longer any
+     mapped text segment there (bug 25396).  */
+
+  puts ("info: attempting to load tst-dlopenfailmod3.so");
+  xdlclose (xdlopen ("tst-dlopenfailmod3.so", RTLD_NOW));
+
+  return 0;
+}
+
+/* Do not perturb the dangling link map.  With M_PERTURB, the link map
+   appears to have l_init_called set, so there are no constructor
+   calls and no crashes.  */
+#define TEST_NO_MALLOPT
+#include <support/test-driver.c>