about summary refs log tree commit diff
path: root/elf/dl-load.c
Commit message (Collapse)AuthorAgeFilesLines
* nptl: Move changing of stack permissions into ld.soFlorian Weimer2021-05-101-0/+4
| | | | | | | | | All the stack lists are now in _rtld_global, so it is possible to change stack permissions directly from there, instead of calling into libpthread to do the change. Tested-by: Carlos O'Donell <carlos@redhat.com> Reviewed-by: Carlos O'Donell <carlos@redhat.com>
* elf: Fix data race in _dl_name_match_p [BZ #21349]Maninder Singh2021-04-061-1/+17
| | | | | | | | | | | | | | | | | | | dlopen updates libname_list by writing to lastp->next, but concurrent reads in _dl_name_match_p were not synchronized when it was called without holding GL(dl_load_lock), which can happen during lazy symbol resolution. This patch fixes the race between _dl_name_match_p reading lastp->next and add_name_to_object writing to it. This could cause segfault on targets with weak memory order when lastp->next->name is read, which was observed on an arm system. Fixes bug 21349. (Code is from Maninder Singh, comments and description is from Szabolcs Nagy.) Co-authored-by: Vaneet Narang <v.narang@samsung.com> Co-authored-by: Szabolcs Nagy <szabolcs.nagy@arm.com> Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
* elf: ld.so --help calls _dl_init_paths without a main map [BZ #27577]Florian Weimer2021-03-151-1/+7
| | | | | | | | | | | In this case, use the link map of the dynamic loader itself as a replacement. This is more than just a hack: if we ever support DT_RUNPATH/DT_RPATH for the dynamic loader, reporting it for ld.so --help (without further command line arguments) would be the right thing to do. Fixes commit 332421312576bd7095e70589154af99b124dd2d1 ("elf: Always set l in _dl_init_paths (bug 23462)").
* elf: Always set l in _dl_init_paths (bug 23462)Carlos O'Donell2021-03-121-34/+29
| | | | | | | | | | | | | | | After d1d5471579eb0426671bf94f2d71e61dfb204c30 ("Remove dead DL_DST_REQ_STATIC code.") we always setup the link map l to make the static and shared cases the same. The bug is that in elf/dl-load.c (_dl_init_paths) we conditionally set l only in the #ifdef SHARED case, but unconditionally use it later. The simple solution is to remove the #ifdef SHARED conditional, because it's no longer needed, and unconditionally setup l for both the static and shared cases. A regression test is added to run a static binary with LD_LIBRARY_PATH='$ORIGIN' which crashes before the fix and runs after the fix. Co-Authored-By: Florian Weimer <fweimer@redhat.com>
* Update copyright dates with scripts/update-copyrightsPaul Eggert2021-01-021-1/+1
| | | | | | | | | | | | | | | | I used these shell commands: ../glibc/scripts/update-copyrights $PWD/../gnulib/build-aux/update-copyright (cd ../glibc && git commit -am"[this commit message]") and then ignored the output, which consisted lines saying "FOO: warning: copyright statement not found" for each of 6694 files FOO. I then removed trailing white space from benchtests/bench-pthread-locks.c and iconvdata/tst-iconv-big5-hkscs-to-2ucs4.c, to work around this diagnostic from Savannah: remote: *** pre-commit check failed ... remote: *** error: lines with trailing whitespace found remote: error: hook declined to update refs/heads/master
* elf: Fix failure handling in _dl_map_object_from_fdSzabolcs Nagy2020-12-151-10/+15
| | | | | | | | | | | | | | The failure paths in _dl_map_object_from_fd did not clean every potentially allocated resource up. Handle l_phdr, l_libname and mapped segments in the common failure handling code. There are various bits that may not be cleaned properly on failure (e.g. executable stack, incomplete dl_map_segments) fixing those need further changes. Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
* elf: inline lose for error handlingSzabolcs Nagy2020-12-151-48/+39
| | | | | | | | | | | | | | | | _dl_map_object_from_fd has complex error handling with cleanups. It was managed by a separate function to avoid code bloat at every failure case, but since the code was changed to use gotos there is no longer such code bloat from inlining. Maintaining a separate error handling function is harder as it needs to access local state which has to be passed down. And the same lose function was used in open_verify which is error prone. The goto labels are changed since there is no longer a call. The new code generates slightly smaller binary. Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
* elf: Fix dl-load.cSzabolcs Nagy2020-12-111-15/+0
| | | | | Rebasing broke commit 38a3836011f3fe3290a94ab136dcb5f3c5c9f4e2 it was supposed to move code.
* elf: Pass the fd to note processingSzabolcs Nagy2020-12-111-5/+7
| | | | | | | | | | | | | | To handle GNU property notes on aarch64 some segments need to be mmaped again, so the fd of the loaded ELF module is needed. When the fd is not available (kernel loaded modules), then -1 is passed. The fd is passed to both _dl_process_pt_gnu_property and _dl_process_pt_note for consistency. Target specific note processing functions are updated accordingly. Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
* elf: Move note processing after l_phdr is updatedSzabolcs Nagy2020-12-111-0/+15
| | | | | | | | | | | | | Program headers are processed in two pass: after the first pass load segments are mmapped so in the second pass target specific note processing logic can access the notes. The second pass is moved later so various link_map fields are set up that may be useful for note processing such as l_phdr. The second pass should be before the fd is closed so that is available. Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
* elf: Add glibc-hwcaps support for LD_LIBRARY_PATHFlorian Weimer2020-12-041-2/+5
| | | | | | | | | | | | | | | | | | | | This hacks non-power-set processing into _dl_important_hwcaps. Once the legacy hwcaps handling goes away, the subdirectory handling needs to be reworked, but it is premature to do this while both approaches are still supported. ld.so supports two new arguments, --glibc-hwcaps-prepend and --glibc-hwcaps-mask. Each accepts a colon-separated list of glibc-hwcaps subdirectory names. The prepend option adds additional subdirectories that are searched first, in the specified order. The mask option restricts the automatically selected subdirectories to those listed in the option argument. For example, on systems where /usr/lib64 is on the library search path, --glibc-hwcaps-prepend=valgrind:debug causes the dynamic loader to search the directories /usr/lib64/glibc-hwcaps/valgrind and /usr/lib64/glibc-hwcaps/debug just before /usr/lib64 is searched. Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
* elf: Do not pass GLRO(dl_platform), GLRO(dl_platformlen) to _dl_important_hwcapsFlorian Weimer2020-10-091-2/+1
| | | | | | | In the current code, the function can easily obtain the information on its own. Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
* elf: Make __rtld_env_path_list and __rtld_search_dirs global variablesFlorian Weimer2020-10-081-26/+27
| | | | | | | | | They have been renamed from env_path_list and rtld_search_dirs to avoid linknamespace issues. This change will allow future use these variables in diagnostics. Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
* elf: Record whether paths come from LD_LIBRARY_PATH or --library-pathFlorian Weimer2020-10-081-2/+2
| | | | | | This allows more precise LD_DEBUG diagnostics. Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
* elf: Do not search HWCAP subdirectories in statically linked binariesFlorian Weimer2020-10-071-0/+14
| | | | | | | | | This functionality does not seem to be useful since static dlopen is mostly used for iconv/character set conversion and NSS support. gconv modules are loaded with full paths anyway, so that the HWCAP subdirectory logic does not apply. Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
* Remove internal usage of extensible stat functionsAdhemerval Zanella2020-09-111-2/+2
| | | | | | | | | | | | It replaces the internal usage of __{f,l}xstat{at}{64} with the __{f,l}stat{at}{64}. It should not change the generate code since sys/stat.h explicit defines redirections to internal calls back to xstat* symbols. Checked with a build for all affected ABIs. I also check on x86_64-linux-gnu and i686-linux-gnu. Reviewed-by: Lukasz Majewski <lukma@denx.de>
* rtld: Clean up PT_NOTE and add PT_GNU_PROPERTY handlingSzabolcs Nagy2020-07-081-8/+86
| | | | | | | | | | | | | | | | | | | | | | Add generic code to handle PT_GNU_PROPERTY notes. Invalid content is ignored, _dl_process_pt_gnu_property is always called after PT_LOAD segments are mapped and it has no failure modes. Currently only one NT_GNU_PROPERTY_TYPE_0 note is handled, which contains target specific properties: the _dl_process_gnu_property hook is called for each property. The old _dl_process_pt_note and _rtld_process_pt_note differ in how the program header is read. The old _dl_process_pt_note is called before PT_LOAD segments are mapped and _rtld_process_pt_note is called after PT_LOAD segments are mapped. The old _rtld_process_pt_note is removed and _dl_process_pt_note is always called after PT_LOAD segments are mapped and now it has no failure modes. The program headers are scanned backwards so that PT_NOTE can be skipped if PT_GNU_PROPERTY exists. Co-Authored-By: H.J. Lu <hjl.tools@gmail.com> Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
* elf: Implement __libc_early_initFlorian Weimer2020-04-241-0/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This function is defined in libc.so, and the dynamic loader calls right after relocation has been finished, before any ELF constructors or the preinit function is invoked. It is also used in the static build for initializing parts of the static libc. To locate __libc_early_init, a direct symbol lookup function is used, _dl_lookup_direct. It does not search the entire symbol scope and consults merely a single link map. This function could also be used to implement lookups in the vDSO (as an optimization). A per-namespace variable (libc_map) is added for locating libc.so, to avoid repeated traversals of the search scope. It is similar to GL(dl_initfirst). An alternative would have been to thread a context argument from _dl_open down to _dl_map_object_from_fd (where libc.so is identified). This could have avoided the global variable, but the change would be larger as a result. It would not have been possible to use this to replace GL(dl_initfirst) because that global variable is used to pass the function pointer past the stack switch from dl_main to the main program. Replacing that requires adding a new argument to _dl_init, which in turn needs changes to the architecture-specific libc.so startup code written in assembler. __libc_early_init should not be used to replace _dl_var_init (as it exists today on some architectures). Instead, _dl_lookup_direct should be used to look up a new variable symbol in libc.so, and that should then be initialized from the dynamic loader, immediately after the object has been loaded in _dl_map_object_from_fd (before relocation is run). This way, more IFUNC resolvers which depend on these variables will work. Reviewed-by: Carlos O'Donell <carlos@redhat.com>
* Update copyright dates with scripts/update-copyrights.Joseph Myers2020-01-011-1/+1
|
* Introduce link_map_audit_state accessor functionFlorian Weimer2019-11-151-9/+9
| | | | | | | | | | | | To improve GCC 10 compatibility, it is necessary to remove the l_audit zero-length array from the end of struct link_map. In preparation of that, this commit introduces an accessor function for the audit state, so that it is possible to change the representation of the audit state without adjusting the code that accesses it. Tested on x86_64-linux-gnu. Built on i686-gnu. Change-Id: Id815673c29950fc011ae5301d7cde12624f658df
* elf: Use nocancel pread64() instead of lseek()+read()Leandro Pereira2019-10-181-7/+6
| | | | | | | | | | | | | | | | | | | | | | | | | Transforms this, when linking in a shared object: openat(AT_FDCWD, "/lib64/libc.so.6", O_RDONLY|O_CLOEXEC) = 3 read(3, "\177ELF\2\1\1\3"..., 832) = 832 lseek(3, 792, SEEK_SET) = 792 read(3, "\4\0\0\0\24\0\0\0"..., 68) = 68 fstat(3, {st_mode=S_IFREG|0755, st_size=6699224, ...}) = 0 lseek(3, 792, SEEK_SET) = 792 read(3, "\4\0\0\0\24\0\0\0"..., 68) = 68 lseek(3, 864, SEEK_SET) = 864 read(3, "\4\0\0\0\20\0\0\0"..., 32) = 32 Into this: openat(AT_FDCWD, "/lib64/libc.so.6", O_RDONLY|O_CLOEXEC) = 3 read(3, "\177ELF\2\1\1\3"..., 832) = 832 pread(3, "\4\0\0\0\24\0\0\0"..., 68, 792) = 68 fstat(3, {st_mode=S_IFREG|0755, st_size=6699224, ...}) = 0 pread(3, "\4\0\0\0\24\0\0\0"..., 68, 792) = 68 pread(3, "\4\0\0\0\20\0\0\0"..., 32, 864) = 32 Reviewed-by: Carlos O'Donell <carlos@redhat.com>
* Simplify note processingAndreas Schwab2019-10-101-14/+3
| | | | This removes dead code during note processing.
* elf: Assign TLS modid later during dlopen [BZ #24930]Florian Weimer2019-10-041-28/+23
| | | | | | | | | | | | | | Commit a42faf59d6d9f82e5293a9ebcc26d9c9e562b12b ("Fix BZ #16634.") attempted to fix a TLS modid consistency issue by adding additional checks to the open_verify function. However, this is fragile because open_verify cannot reliably predict whether _dl_map_object_from_fd will later fail in the more complex cases (such as memory allocation failures). Therefore, this commit assigns the TLS modid as late as possible. At that point, the link map pointer will eventually be passed to _dl_close, which will undo the TLS modid assignment. Reviewed-by: Gabriel F. T. Gomes <gabrielftg@linux.ibm.com>
* elf: Never use the file ID of the main executable [BZ #24900]Florian Weimer2019-10-041-21/+31
| | | | | | | | | | | | | | If the loader is invoked explicitly and loads the main executable, it stores the file ID of the main executable in l_file_id. This information is not available if the main excutable is loaded by the kernel, so this is another case where the two cases differ. This enhances commit 23d2e5faf0bca6d9b31bef4aa162b95ee64cbfc6 ("elf: Self-dlopen failure with explict loader invocation [BZ #24900]"). Reviewed-by: Carlos O'Donell <carlos@redhat.com> Reviewed-by: Gabriel F. T. Gomes <gabrielftg@linux.ibm.com>
* Prefer https to http for gnu.org and fsf.org URLsPaul Eggert2019-09-071-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Also, change sources.redhat.com to sourceware.org. This patch was automatically generated by running the following shell script, which uses GNU sed, and which avoids modifying files imported from upstream: sed -ri ' s,(http|ftp)(://(.*\.)?(gnu|fsf|sourceware)\.org($|[^.]|\.[^a-z])),https\2,g s,(http|ftp)(://(.*\.)?)sources\.redhat\.com($|[^.]|\.[^a-z]),https\2sourceware.org\4,g ' \ $(find $(git ls-files) -prune -type f \ ! -name '*.po' \ ! -name 'ChangeLog*' \ ! -path COPYING ! -path COPYING.LIB \ ! -path manual/fdl-1.3.texi ! -path manual/lgpl-2.1.texi \ ! -path manual/texinfo.tex ! -path scripts/config.guess \ ! -path scripts/config.sub ! -path scripts/install-sh \ ! -path scripts/mkinstalldirs ! -path scripts/move-if-change \ ! -path INSTALL ! -path locale/programs/charmap-kw.h \ ! -path po/libc.pot ! -path sysdeps/gnu/errlist.c \ ! '(' -name configure \ -execdir test -f configure.ac -o -f configure.in ';' ')' \ ! '(' -name preconfigure \ -execdir test -f preconfigure.ac ';' ')' \ -print) and then by running 'make dist-prepare' to regenerate files built from the altered files, and then executing the following to cleanup: chmod a+x sysdeps/unix/sysv/linux/riscv/configure # Omit irrelevant whitespace and comment-only changes, # perhaps from a slightly-different Autoconf version. git checkout -f \ sysdeps/csky/configure \ sysdeps/hppa/configure \ sysdeps/riscv/configure \ sysdeps/unix/sysv/linux/csky/configure # Omit changes that caused a pre-commit check to fail like this: # remote: *** error: sysdeps/powerpc/powerpc64/ppc-mcount.S: trailing lines git checkout -f \ sysdeps/powerpc/powerpc64/ppc-mcount.S \ sysdeps/unix/sysv/linux/s390/s390-64/syscall.S # Omit change that caused a pre-commit check to fail like this: # remote: *** error: sysdeps/sparc/sparc64/multiarch/memcpy-ultra3.S: last line does not end in newline git checkout -f sysdeps/sparc/sparc64/multiarch/memcpy-ultra3.S
* elf: Refuse to dlopen PIE objects [BZ #24323]Florian Weimer2019-06-181-4/+14
| | | | | Another executable has already been mapped, so the dynamic linker cannot perform relocations correctly for the second executable.
* elf: Remove remnants of MAP_ANON emulationFlorian Weimer2019-03-041-15/+0
| | | | | | Most of the code was removed in commit 20739e5454c12acbc0479387fe795c5b19a4166f ("* elf/dl-load.c: Remove support for systems without MAP_ANON.").
* Break some lines before not after operators.Joseph Myers2019-02-221-8/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The GNU Coding Standards specify that line breaks in expressions should go before an operator, not after one. This patch fixes various code to do this. It only changes code that appears to be mostly following GNU style anyway, not files and directories with substantially different formatting. It is not exhaustive even for files using GNU style (for example, changes to sysdeps files are deferred for subsequent cleanups). Some files changed are shared with gnulib, but most are specific to glibc. Changes were made manually, with places to change found by grep (so some cases, e.g. where the operator was followed by a comment at end of line, are particularly liable to have been missed by grep, but I did include cases where the operator was followed by backslash-newline). This patch generally does not attempt to address other coding style issues in the expressions changed (for example, missing spaces before '(', or lack of parentheses to ensure indentation of continuation lines properly reflects operator precedence). Tested for x86_64, and with build-many-glibcs.py. * benchtests/bench-memmem.c (simple_memmem): Break lines before rather than after operators. * benchtests/bench-skeleton.c (TIMESPEC_AFTER): Likewise. * crypt/md5.c (md5_finish_ctx): Likewise. * crypt/sha256.c (__sha256_finish_ctx): Likewise. * crypt/sha512.c (__sha512_finish_ctx): Likewise. * elf/cache.c (load_aux_cache): Likewise. * elf/dl-load.c (open_verify): Likewise. * elf/get-dynamic-info.h (elf_get_dynamic_info): Likewise. * elf/readelflib.c (process_elf_file): Likewise. * elf/rtld.c (dl_main): Likewise. * elf/sprof.c (generate_call_graph): Likewise. * hurd/ctty-input.c (_hurd_ctty_input): Likewise. * hurd/ctty-output.c (_hurd_ctty_output): Likewise. * hurd/dtable.c (reauth_dtable): Likewise. * hurd/getdport.c (__getdport): Likewise. * hurd/hurd/signal.h (_hurd_interrupted_rpc_timeout): Likewise. * hurd/hurd/sigpreempt.h (HURD_PREEMPT_SIGNAL_P): Likewise. * hurd/hurdfault.c (_hurdsig_fault_catch_exception_raise): Likewise. * hurd/hurdioctl.c (fioctl): Likewise. * hurd/hurdselect.c (_hurd_select): Likewise. * hurd/hurdsig.c (_hurdsig_abort_rpcs): Likewise. (STOPSIGS): Likewise. * hurd/hurdstartup.c (_hurd_startup): Likewise. * hurd/intr-msg.c (_hurd_intr_rpc_mach_msg): Likewise. * hurd/lookup-retry.c (__hurd_file_name_lookup_retry): Likewise. * hurd/msgportdemux.c (msgport_server): Likewise. * hurd/setauth.c (_hurd_setauth): Likewise. * include/features.h (__GLIBC_USE_DEPRECATED_SCANF): Likewise. * libio/libioP.h [IO_DEBUG] (CHECK_FILE): Likewise. * locale/programs/ld-ctype.c (set_class_defaults): Likewise. * localedata/tests-mbwc/tst_swscanf.c (tst_swscanf): Likewise. * login/tst-utmp.c (do_check): Likewise. (simulate_login): Likewise. * mach/lowlevellock.h (lll_lock): Likewise. (lll_trylock): Likewise. * math/test-fenv.c (ALL_EXC): Likewise. * math/test-fenvinline.c (ALL_EXC): Likewise. * misc/sys/cdefs.h (__attribute_deprecated_msg__): Likewise. * nis/nis_call.c (__do_niscall3): Likewise. * nis/nis_callback.c (cb_prog_1): Likewise. * nis/nis_defaults.c (searchaccess): Likewise. * nis/nis_findserv.c (__nis_findfastest_with_timeout): Likewise. * nis/nis_ismember.c (internal_ismember): Likewise. * nis/nis_local_names.c (nis_local_principal): Likewise. * nis/nss_nis/nis-rpc.c (_nss_nis_getrpcbyname_r): Likewise. * nis/nss_nisplus/nisplus-netgrp.c (_nss_nisplus_getnetgrent_r): Likewise. * nis/ypclnt.c (yp_match): Likewise. (yp_first): Likewise. (yp_next): Likewise. (yp_master): Likewise. (yp_order): Likewise. * nscd/hstcache.c (cache_addhst): Likewise. * nscd/initgrcache.c (addinitgroupsX): Likewise. * nss/nss_compat/compat-pwd.c (copy_pwd_changes): Likewise. (internal_getpwuid_r): Likewise. * nss/nss_compat/compat-spwd.c (copy_spwd_changes): Likewise. * posix/glob.h (__GLOB_FLAGS): Likewise. * posix/regcomp.c (peek_token): Likewise. (peek_token_bracket): Likewise. (parse_expression): Likewise. * posix/regexec.c (sift_states_iter_mb): Likewise. (check_node_accept_bytes): Likewise. * posix/tst-spawn3.c (do_test): Likewise. * posix/wordexp-test.c (testit): Likewise. * posix/wordexp.c (parse_tilde): Likewise. (exec_comm): Likewise. * posix/wordexp.h (__WRDE_FLAGS): Likewise. * resource/vtimes.c (TIMEVAL_TO_VTIMES): Likewise. * setjmp/sigjmp.c (__sigjmp_save): Likewise. * stdio-common/printf_fp.c (__printf_fp_l): Likewise. * stdio-common/tst-fileno.c (do_test): Likewise. * stdio-common/vfprintf-internal.c (vfprintf): Likewise. * stdlib/strfmon_l.c (__vstrfmon_l_internal): Likewise. * stdlib/strtod_l.c (round_and_return): Likewise. (____STRTOF_INTERNAL): Likewise. * stdlib/tst-strfrom.h (TEST_STRFROM): Likewise. * string/strcspn.c (STRCSPN): Likewise. * string/test-memmem.c (simple_memmem): Likewise. * termios/tcsetattr.c (tcsetattr): Likewise. * time/alt_digit.c (_nl_parse_alt_digit): Likewise. * time/asctime.c (asctime_internal): Likewise. * time/strptime_l.c (__strptime_internal): Likewise. * time/sys/time.h (timercmp): Likewise. * time/tzfile.c (__tzfile_compute): Likewise.
* Update copyright dates with scripts/update-copyrights.Joseph Myers2019-01-011-1/+1
| | | | | | | * All files with FSF copyright notices: Update copyright dates using scripts/update-copyrights. * locale/programs/charmap-kw.h: Regenerated. * locale/programs/locfile-kw.h: Likewise.
* x86: Support IBT and SHSTK in Intel CET [BZ #21598]H.J. Lu2018-07-161-25/+35
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Intel Control-flow Enforcement Technology (CET) instructions: https://software.intel.com/sites/default/files/managed/4d/2a/control-flow-en forcement-technology-preview.pdf includes Indirect Branch Tracking (IBT) and Shadow Stack (SHSTK). GNU_PROPERTY_X86_FEATURE_1_IBT is added to GNU program property to indicate that all executable sections are compatible with IBT when ENDBR instruction starts each valid target where an indirect branch instruction can land. Linker sets GNU_PROPERTY_X86_FEATURE_1_IBT on output only if it is set on all relocatable inputs. On an IBT capable processor, the following steps should be taken: 1. When loading an executable without an interpreter, enable IBT and lock IBT if GNU_PROPERTY_X86_FEATURE_1_IBT is set on the executable. 2. When loading an executable with an interpreter, enable IBT if GNU_PROPERTY_X86_FEATURE_1_IBT is set on the interpreter. a. If GNU_PROPERTY_X86_FEATURE_1_IBT isn't set on the executable, disable IBT. b. Lock IBT. 3. If IBT is enabled, when loading a shared object without GNU_PROPERTY_X86_FEATURE_1_IBT: a. If legacy interwork is allowed, then mark all pages in executable PT_LOAD segments in legacy code page bitmap. Failure of legacy code page bitmap allocation causes an error. b. If legacy interwork isn't allowed, it causes an error. GNU_PROPERTY_X86_FEATURE_1_SHSTK is added to GNU program property to indicate that all executable sections are compatible with SHSTK where return address popped from shadow stack always matches return address popped from normal stack. Linker sets GNU_PROPERTY_X86_FEATURE_1_SHSTK on output only if it is set on all relocatable inputs. On a SHSTK capable processor, the following steps should be taken: 1. When loading an executable without an interpreter, enable SHSTK if GNU_PROPERTY_X86_FEATURE_1_SHSTK is set on the executable. 2. When loading an executable with an interpreter, enable SHSTK if GNU_PROPERTY_X86_FEATURE_1_SHSTK is set on interpreter. a. If GNU_PROPERTY_X86_FEATURE_1_SHSTK isn't set on the executable or any shared objects loaded via the DT_NEEDED tag, disable SHSTK. b. Otherwise lock SHSTK. 3. After SHSTK is enabled, it is an error to load a shared object without GNU_PROPERTY_X86_FEATURE_1_SHSTK. To enable CET support in glibc, --enable-cet is required to configure glibc. When CET is enabled, both compiler and assembler must support CET. Otherwise, it is a configure-time error. To support CET run-time control, 1. _dl_x86_feature_1 is added to the writable ld.so namespace to indicate if IBT or SHSTK are enabled at run-time. It should be initialized by init_cpu_features. 2. For dynamic executables: a. A l_cet field is added to struct link_map to indicate if IBT or SHSTK is enabled in an ELF module. _dl_process_pt_note or _rtld_process_pt_note is called to process PT_NOTE segment for GNU program property and set l_cet. b. _dl_open_check is added to check IBT and SHSTK compatibilty when dlopening a shared object. 3. Replace i386 _dl_runtime_resolve and _dl_runtime_profile with _dl_runtime_resolve_shstk and _dl_runtime_profile_shstk, respectively if SHSTK is enabled. CET run-time control can be changed via GLIBC_TUNABLES with $ export GLIBC_TUNABLES=glibc.tune.x86_shstk=[permissive|on|off] $ export GLIBC_TUNABLES=glibc.tune.x86_ibt=[permissive|on|off] 1. permissive: SHSTK is disabled when dlopening a legacy ELF module. 2. on: IBT or SHSTK are always enabled, regardless if there are IBT or SHSTK bits in GNU program property. 3. off: IBT or SHSTK are always disabled, regardless if there are IBT or SHSTK bits in GNU program property. <cet.h> from CET-enabled GCC is automatically included by assembly codes to add GNU_PROPERTY_X86_FEATURE_1_IBT and GNU_PROPERTY_X86_FEATURE_1_SHSTK to GNU program property. _CET_ENDBR is added at the entrance of all assembly functions whose address may be taken. _CET_NOTRACK is used to insert NOTRACK prefix with indirect jump table to support IBT. It is defined as notrack when _CET_NOTRACK is defined in <cet.h>. [BZ #21598] * configure.ac: Add --enable-cet. * configure: Regenerated. * elf/Makefille (all-built-dso): Add a comment. * elf/dl-load.c (filebuf): Moved before "dynamic-link.h". Include <dl-prop.h>. (_dl_map_object_from_fd): Call _dl_process_pt_note on PT_NOTE segment. * elf/dl-open.c: Include <dl-prop.h>. (dl_open_worker): Call _dl_open_check. * elf/rtld.c: Include <dl-prop.h>. (dl_main): Call _rtld_process_pt_note on PT_NOTE segment. Call _rtld_main_check. * sysdeps/generic/dl-prop.h: New file. * sysdeps/i386/dl-cet.c: Likewise. * sysdeps/unix/sysv/linux/x86/cpu-features.c: Likewise. * sysdeps/unix/sysv/linux/x86/dl-cet.h: Likewise. * sysdeps/x86/cet-tunables.h: Likewise. * sysdeps/x86/check-cet.awk: Likewise. * sysdeps/x86/configure: Likewise. * sysdeps/x86/configure.ac: Likewise. * sysdeps/x86/dl-cet.c: Likewise. * sysdeps/x86/dl-procruntime.c: Likewise. * sysdeps/x86/dl-prop.h: Likewise. * sysdeps/x86/libc-start.h: Likewise. * sysdeps/x86/link_map.h: Likewise. * sysdeps/i386/dl-trampoline.S (_dl_runtime_resolve): Add _CET_ENDBR. (_dl_runtime_profile): Likewise. (_dl_runtime_resolve_shstk): New. (_dl_runtime_profile_shstk): Likewise. * sysdeps/linux/x86/Makefile (sysdep-dl-routines): Add dl-cet if CET is enabled. (CFLAGS-.o): Add -fcf-protection if CET is enabled. (CFLAGS-.os): Likewise. (CFLAGS-.op): Likewise. (CFLAGS-.oS): Likewise. (asm-CPPFLAGS): Add -fcf-protection -include cet.h if CET is enabled. (tests-special): Add $(objpfx)check-cet.out. (cet-built-dso): New. (+$(cet-built-dso:=.note)): Likewise. (common-generated): Add $(cet-built-dso:$(common-objpfx)%=%.note). ($(objpfx)check-cet.out): New. (generated): Add check-cet.out. * sysdeps/x86/cpu-features.c: Include <dl-cet.h> and <cet-tunables.h>. (TUNABLE_CALLBACK (set_x86_ibt)): New prototype. (TUNABLE_CALLBACK (set_x86_shstk)): Likewise. (init_cpu_features): Call get_cet_status to check CET status and update dl_x86_feature_1 with CET status. Call TUNABLE_CALLBACK (set_x86_ibt) and TUNABLE_CALLBACK (set_x86_shstk). Disable and lock CET in libc.a. * sysdeps/x86/cpu-tunables.c: Include <cet-tunables.h>. (TUNABLE_CALLBACK (set_x86_ibt)): New function. (TUNABLE_CALLBACK (set_x86_shstk)): Likewise. * sysdeps/x86/sysdep.h (_CET_NOTRACK): New. (_CET_ENDBR): Define if not defined. (ENTRY): Add _CET_ENDBR. * sysdeps/x86/dl-tunables.list (glibc.tune): Add x86_ibt and x86_shstk. * sysdeps/x86_64/dl-trampoline.h (_dl_runtime_resolve): Add _CET_ENDBR. (_dl_runtime_profile): Likewise.
* Fix comments in _dl_dst_count and _dl_dst_substitute.Carlos O'Donell2018-06-121-6/+8
| | | | | | | | | The comments in _dl_dst_count is adjusted to match what the code does which is count DSTs from the start of the string. With the removal of DL_DST_COUNT we no longer accept an input that starts at the first $. In _dl_dst_substitute we adjust the comment to indicate that both conditions must be true for the SUID/SGID $ORIGIN exception.
* Improve DST handling (Bug 23102, Bug 21942, Bug 18018, Bug 23259).Carlos O'Donell2018-06-121-79/+134
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This commit improves DST handling significantly in the following ways: firstly is_dst () is overhauled to correctly process DST sequences that would be accepted given the ELF gABI. This means that we actually now accept slightly more sequences than before. Now we accept $ORIGIN$ORIGIN, but in the past we accepted only $ORIGIN\0 or $ORIGIN/..., but this kind of behaviour results in unexpected and uninterpreted DST sequences being used as literal search paths leading to security defects. Therefore the first step in correcting this defect is making is_dst () properly account for all DSTs and making the function context free in the sense that it counts DSTs without knowledge of path, or AT_SECURE. Next, _dl_dst_count () is also simplified to count all DSTs regardless of context. Then in _dl_dst_substitute () we reintroduce context-dependent processing for such things as AT_SECURE handling. At the level of _dl_dst_substitute we can have access to things like the true start of the string sequence to validate $ORIGIN-based paths rooted in trusted directories. Lastly, we tighten up the accepted sequences in AT_SECURE, and avoid leaving known unexpanded DSTs, this is noted in the NEWS entry. Verified with a sequence of 68 tests on x86_64 that cover non-AT_SECURE and AT_SECURE testing using a sysroot (requires root to run). The tests cover cases for bug 23102, bug 21942, bug 18018, and bug 23259. These tests are not yet appropriate for the glibc regression testsuite, but with the upcoming test-in-container testing framework it should be possible to include these tests upstream soon. See the mailing list for the tests: https://www.sourceware.org/ml/libc-alpha/2018-06/msg00251.html
* Avoid cancellable I/O primitives in ld.so.Zack Weinberg2018-06-121-17/+18
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Neither the <dlfcn.h> entry points, nor lazy symbol resolution, nor initial shared library load-up, are cancellation points, so ld.so should exclusively use I/O primitives that are not cancellable. We currently achieve this by having the cancellation hooks compile as no-ops when IS_IN(rtld); this patch changes to using exclusively _nocancel primitives in the source code instead, which makes the intent clearer and significantly reduces the amount of code compiled under IS_IN(rtld) as well as IS_IN(libc) -- in particular, elf/Makefile no longer thinks we require a copy of unwind.c in rtld-libc.a. (The older mechanism is preserved as a backstop.) The bulk of the change is splitting up the files that define the _nocancel I/O functions, so they don't also define the variants that *are* cancellation points; after which, the existing logic for picking out the bits of libc that need to be recompiled as part of ld.so Just Works. I did this for all of the _nocancel functions, not just the ones used by ld.so, for consistency. fcntl was a little tricky because it's only a cancellation point for certain opcodes (F_SETLKW(64), which can block), and the existing __fcntl_nocancel wasn't applying the FCNTL_ADJUST_CMD hook, which strikes me as asking for trouble, especially as the only nontrivial definition of FCNTL_ADJUST_CMD (for powerpc64) changes F_*LK* opcodes. To fix this, fcntl_common moves to fcntl_nocancel.c along with __fcntl_nocancel, and changes its name to the extern (but hidden) symbol __fcntl_nocancel_adjusted, so that regular fcntl can continue calling it. __fcntl_nocancel now applies FCNTL_ADJUST_CMD; so that both both fcntl.c and fcntl_nocancel.c can see it, the only nontrivial definition moves from sysdeps/u/s/l/powerpc/powerpc64/fcntl.c to .../powerpc64/sysdep.h and becomes entirely a macro, instead of a macro that calls an inline function. The nptl version of libpthread also changes a little, because its "compat-routines" formerly included files that defined all the _nocancel functions it uses; instead of continuing to duplicate them, I exported the relevant ones from libc.so as GLIBC_PRIVATE. Since the Linux fcntl.c calls a function defined by fcntl_nocancel.c, it can no longer be used from libpthread.so; instead, introduce a custom forwarder, pt-fcntl.c, and export __libc_fcntl from libc.so as GLIBC_PRIVATE. The nios2-linux ABI doesn't include a copy of vfork() in libpthread, and it was handling that by manipulating libpthread-routines in .../linux/nios2/Makefile; it is cleaner to do what other such ports do, and have a pt-vfork.S that defines no symbols. Right now, it appears that Hurd does not implement _nocancel I/O, so sysdeps/generic/not-cancel.h will forward everything back to the regular functions. This changed the names of some of the functions that sysdeps/mach/hurd/dl-sysdep.c needs to interpose. * elf/dl-load.c, elf/dl-misc.c, elf/dl-profile.c, elf/rtld.c * sysdeps/unix/sysv/linux/dl-sysdep.c Include not-cancel.h. Use __close_nocancel instead of __close, __open64_nocancel instead of __open, __read_nocancel instead of __libc_read, and __write_nocancel instead of __libc_write. * csu/check_fds.c (check_one_fd) * sysdeps/posix/fdopendir.c (__fdopendir) * sysdeps/posix/opendir.c (__alloc_dir): Use __fcntl_nocancel instead of __fcntl and/or __libc_fcntl. * sysdeps/unix/sysv/linux/pthread_setname.c (pthread_setname_np) * sysdeps/unix/sysv/linux/pthread_getname.c (pthread_getname_np) * sysdeps/unix/sysv/linux/i386/smp.h (is_smp_system): Use __open64_nocancel instead of __open_nocancel. * sysdeps/unix/sysv/linux/not-cancel.h: Move all of the hidden_proto declarations to the end and issue them if either IS_IN(libc) or IS_IN(rtld). * sysdeps/unix/sysv/linux/Makefile [subdir=io] (sysdep_routines): Add close_nocancel, fcntl_nocancel, nanosleep_nocancel, open_nocancel, open64_nocancel, openat_nocancel, pause_nocancel, read_nocancel, waitpid_nocancel, write_nocancel. * io/Versions [GLIBC_PRIVATE]: Add __libc_fcntl, __fcntl_nocancel, __open64_nocancel, __write_nocancel. * posix/Versions: Add __nanosleep_nocancel, __pause_nocancel. * nptl/pt-fcntl.c: New file. * nptl/Makefile (pthread-compat-wrappers): Remove fcntl. (libpthread-routines): Add pt-fcntl. * include/fcntl.h (__fcntl_nocancel_adjusted): New function. (__libc_fcntl): Remove attribute_hidden. * sysdeps/unix/sysv/linux/fcntl.c (__libc_fcntl): Call __fcntl_nocancel_adjusted, not fcntl_common. (__fcntl_nocancel): Move to new file fcntl_nocancel.c. (fcntl_common): Rename to __fcntl_nocancel_adjusted; also move to fcntl_nocancel.c. * sysdeps/unix/sysv/linux/fcntl_nocancel.c: New file. * sysdeps/unix/sysv/linux/powerpc/powerpc64/fcntl.c: Remove file. * sysdeps/unix/sysv/linux/powerpc/powerpc64/sysdep.h: Define FCNTL_ADJUST_CMD here, as a self-contained macro. * sysdeps/unix/sysv/linux/close.c: Move __close_nocancel to... * sysdeps/unix/sysv/linux/close_nocancel.c: ...this new file. * sysdeps/unix/sysv/linux/nanosleep.c: Move __nanosleep_nocancel to... * sysdeps/unix/sysv/linux/nanosleep_nocancel.c: ...this new file. * sysdeps/unix/sysv/linux/open.c: Move __open_nocancel to... * sysdeps/unix/sysv/linux/open_nocancel.c: ...this new file. * sysdeps/unix/sysv/linux/open64.c: Move __open64_nocancel to... * sysdeps/unix/sysv/linux/open64_nocancel.c: ...this new file. * sysdeps/unix/sysv/linux/openat.c: Move __openat_nocancel to... * sysdeps/unix/sysv/linux/openat_nocancel.c: ...this new file. * sysdeps/unix/sysv/linux/openat64.c: Move __openat64_nocancel to... * sysdeps/unix/sysv/linux/openat64_nocancel.c: ...this new file. * sysdeps/unix/sysv/linux/pause.c: Move __pause_nocancel to... * sysdeps/unix/sysv/linux/pause_nocancel.c: ...this new file. * sysdeps/unix/sysv/linux/read.c: Move __read_nocancel to... * sysdeps/unix/sysv/linux/read_nocancel.c: ...this new file. * sysdeps/unix/sysv/linux/waitpid.c: Move __waitpid_nocancel to... * sysdeps/unix/sysv/linux/waitpid_nocancel.c: ...this new file. * sysdeps/unix/sysv/linux/write.c: Move __write_nocancel to... * sysdeps/unix/sysv/linux/write_nocancel.c: ...this new file. * sysdeps/unix/sysv/linux/nios2/Makefile: Don't override libpthread-routines. * sysdeps/unix/sysv/linux/nios2/pt-vfork.S: New file which defines nothing. * sysdeps/mach/hurd/dl-sysdep.c: Define __read instead of __libc_read, and __write instead of __libc_write. Define __open64 in addition to __open.
* Fix BZ 20419. A PT_NOTE in a binary could be arbitratily large, so usingPaul Pluzhnikov2018-05-051-2/+19
| | | | | | | | | | | | | alloca for it may cause stack overflow. If the note is larger than __MAX_ALLOCA_CUTOFF, use dynamically allocated memory to read it in. 2018-05-05 Paul Pluzhnikov <ppluzhnikov@google.com> [BZ #20419] * elf/dl-load.c (open_verify): Fix stack overflow. * elf/Makefile (tst-big-note): New test. * elf/tst-big-note-lib.S: New. * elf/tst-big-note.c: New.
* elf: Remove ad-hoc restrictions on dlopen callers [BZ #22787]Florian Weimer2018-02-211-7/+0
| | | | | | | | | | | | | | | | | | | | | | This looks like a post-exploitation hardening measure: If an attacker is able to redirect execution flow, they could use that to load a DSO which contains additional code (or perhaps make the stack executable). However, the checks are not in the correct place to be effective: If they are performed before the critical operation, an attacker with sufficient control over execution flow could simply jump directly to the code which performs the operation, bypassing the check. The check would have to be executed unconditionally after the operation and terminate the process in case a caller violation was detected. Furthermore, in _dl_check_caller, there was a fallback reading global writable data (GL(dl_rtld_map).l_map_start and GL(dl_rtld_map).l_text_end), which could conceivably be targeted by an attacker to disable the check, too. Other critical functions (such as system) remain completely unprotected, so the value of these additional checks does not appear that large. Therefore this commit removes this functionality.
* elf: check for rpath emptiness before making a copy of itDmitry V. Levin2018-01-011-10/+8
| | | | | * elf/dl-load.c (decompose_rpath): Check for rpath emptiness before making a copy of it.
* Update copyright dates with scripts/update-copyrights.Joseph Myers2018-01-011-1/+1
| | | | | | | * All files with FSF copyright notices: Update copyright dates using scripts/update-copyrights. * locale/programs/charmap-kw.h: Regenerated. * locale/programs/locfile-kw.h: Likewise.
* elf: Check for empty tokens before dynamic string token expansion [BZ #22625]Aurelien Jarno2017-12-301-16/+33
| | | | | | | | | | | | | | | | | | | | | | | | | The fillin_rpath function in elf/dl-load.c loops over each RPATH or RUNPATH tokens and interprets empty tokens as the current directory ("./"). In practice the check for empty token is done *after* the dynamic string token expansion. The expansion process can return an empty string for the $ORIGIN token if __libc_enable_secure is set or if the path of the binary can not be determined (/proc not mounted). Fix that by moving the check for empty tokens before the dynamic string token expansion. In addition, check for NULL pointer or empty strings return by expand_dynamic_string_token. The above changes highlighted a bug in decompose_rpath, an empty array is represented by the first element being NULL at the fillin_rpath level, but by using a -1 pointer in decompose_rpath and other functions. Changelog: [BZ #22625] * elf/dl-load.c (fillin_rpath): Check for empty tokens before dynamic string token expansion. Check for NULL pointer or empty string possibly returned by expand_dynamic_string_token. (decompose_rpath): Check for empty path after dynamic string token expansion.
* elf: remove redundant is_path argumentDmitry V. Levin2017-12-271-18/+14
| | | | | | | | | | | is_path argument is no longer used and could be safely removed. * elf/dl-dst.h (DL_DST_COUNT): Remove is_path argument, all callers updated. * elf/dl-load.c (is_dst, _dl_dst_count, _dl_dst_substitute, expand_dynamic_string_token): Likewise. * sysdeps/generic/ldsodefs.h (_dl_dst_count, _dl_dst_substitute): Remove is_path argument.
* elf: remove redundant code from is_dstDmitry V. Levin2017-12-271-5/+3
| | | | | | | | | | | | | | | | | is_dst is called either by _dl_dst_count or by _dl_dst_substitute. _dl_dst_count is called by DL_DST_COUNT only. DL_DST_COUNT is called either by expand_dst with is_path == 0 or by expand_dynamic_string_token. _dl_dst_substitute is called either from expand_dst with is_path == 0 or from expand_dynamic_string_token. The latter function is called either from _dl_map_object with is_path == 0 or from fillin_rpath with is_path == 1 and name containing no ':'. In any case (is_path && name[i] == ':') is always false and all code depending on it can be safely removed. * elf/dl-load.c (is_dst): Remove checks that is_path is set and name contains ':', and all code depending on these checks.
* elf: remove redundant code from _dl_dst_substituteDmitry V. Levin2017-12-271-20/+1
| | | | | | | | | | | | | | There are just two users of _dl_dst_substitute: one is expand_dst that sets is_path argument to 0, another one is expand_dynamic_string_token. The latter function also has just two users: one is _dl_map_object that sets is_path argument to 0, another one is fillin_rpath that sets is_path argument to 1 and name argument contains no ':'. In any case (is_path && name[i] == ':') is always false and all code depending on it can be safely removed. * elf/dl-load.c (_dl_dst_substitute): Remove checks that is_path is set and name contains ':', and all code depending on these checks.
* elf: remove redundant __libc_enable_secure check from fillin_rpathDmitry V. Levin2017-12-191-30/+3
| | | | | | | | | | | | | | | | There are just two users of fillin_rpath: one is decompose_rpath that sets check_trusted argument to 0, another one is _dl_init_paths that sets check_trusted argument to __libc_enable_secure and invokes fillin_rpath only when LD_LIBRARY_PATH is non-empty. Starting with commit glibc-2.25.90-512-gf6110a8fee2ca36f8e2d2abecf3cba9fa7b8ea7d, LD_LIBRARY_PATH is ignored for __libc_enable_secure executables, so check_trusted argument of fillin_rpath is always zero. * elf/dl-load.c (is_trusted_path): Remove. (fillin_rpath): Remove check_trusted argument and its use, all callers changed.
* elf: do not substitute dst in $LD_LIBRARY_PATH twice [BZ #22627]Dmitry V. Levin2017-12-181-19/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | Starting with commit glibc-2.18.90-470-g2a939a7e6d81f109d49306bc2e10b4ac9ceed8f9 that introduced substitution of dynamic string tokens in fillin_rpath, _dl_init_paths invokes _dl_dst_substitute for $LD_LIBRARY_PATH twice: the first time it's called directly, the second time the result is passed on to fillin_rpath which calls expand_dynamic_string_token which in turn calls _dl_dst_substitute, leading to the following behaviour: $ mkdir -p /tmp/'$ORIGIN' && cd /tmp/'$ORIGIN' && echo 'int main(){}' |gcc -xc - && strace -qq -E LD_LIBRARY_PATH='$ORIGIN' -e /open ./a.out open("/tmp//tmp/$ORIGIN/tls/x86_64/libc.so.6", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) open("/tmp//tmp/$ORIGIN/tls/libc.so.6", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) open("/tmp//tmp/$ORIGIN/x86_64/libc.so.6", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) open("/tmp//tmp/$ORIGIN/libc.so.6", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) open("/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3 open("/lib64/libc.so.6", O_RDONLY|O_CLOEXEC) = 3 Fix this by removing the direct _dl_dst_substitute invocation. * elf/dl-load.c (_dl_init_paths): Remove _dl_dst_substitute preparatory code and invocation.
* elf: Count components of the expanded path in _dl_init_path [BZ #22607]Florian Weimer2017-12-141-9/+4
|
* elf: Compute correct array size in _dl_init_paths [BZ #22606]Florian Weimer2017-12-141-7/+7
|
* Properly compute offsets of note descriptor and next note [BZ #22370]H.J. Lu2017-11-281-4/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | A note header has 3 4-bytes fields, followed by note name and note descriptor. According to gABI, in a note entry, the note name field, not note name size, is padded for the note descriptor. And the note descriptor field, not note descriptor size, is padded for the next note entry. Notes are aligned to 4 bytes in 32-bit objects and 8 bytes in 64-bit objects. For all GNU notes, the name is "GNU" which is 4 bytes. They have the same format in the first 16 bytes in both 32-bit and 64-bit objects. They differ by note descriptor size and note type. So far, .note.ABI-tag and .note.gnu.build-id notes are always aligned to 4 bytes. The exsting codes compute the note size by aligning the note name size and note descriptor size to 4 bytes. It happens to produce the same value as the actual note size by luck since the name size is 4 and offset of the note descriptor is 16. But it will produce the wrong size when note alignment is 8 bytes in 64-bit objects. This patch defines ELF_NOTE_DESC_OFFSET and ELF_NOTE_NEXT_OFFSET to properly compute offsets of note descriptor and next note. It uses alignment of PT_NOTE segment to support both 4-byte and 8-byte note alignments in 64-bit objects. To handle PT_NOTE segments with incorrect alignment, which may lead to an infinite loop, if segment alignment is less than 4, we treate alignment as 4 bytes since some note segments have 0 or 1 byte alignment. [BZ #22370] * elf/dl-hwcaps.c (ROUND): Removed. (_dl_important_hwcaps): Replace ROUND with ELF_NOTE_DESC_OFFSET and ELF_NOTE_NEXT_OFFSET. * elf/dl-load.c (ROUND): Removed. (open_verify): Replace ROUND with ELF_NOTE_NEXT_OFFSET. * elf/readelflib.c (ROUND): Removed. (process_elf_file): Replace ROUND with ELF_NOTE_NEXT_OFFSET. * include/elf.h [!_ISOMAC]: Include <libc-pointer-arith.h>. [!_ISOMAC] (ELF_NOTE_DESC_OFFSET): New. [!_ISOMAC] (ELF_NOTE_NEXT_OFFSET): Likewise.
* Skip PT_DYNAMIC segment with p_filesz == 0 [BZ #22101]H.J. Lu2017-09-261-2/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | ELF objects generated with "objcopy --only-keep-debug" have Type Offset VirtAddr PhysAddr FileSiz MemSiz Flg Align DYNAMIC 0x0+e28 0x0+200e40 0x0+200e40 0x0+ 0x0+1a0 RW 0x8 with 0 file size. ld.so should skip such PT_DYNAMIC segments. Without a PT_DYNAMIC segment the loading of the shared object will fail, and therefore ldd on such objects will also fail instead of crashing. This provides better diagnostics for tooling that is attempting to inspect the invalid shared objects which may just contain debug information. [BZ #22101] * elf/Makefile (tests): Add tst-debug1. ($(objpfx)tst-debug1): New. ($(objpfx)tst-debug1.out): Likewise. ($(objpfx)tst-debug1mod1.so): Likewise. * elf/dl-load.c (_dl_map_object_from_fd): Skip PT_DYNAMIC segment with p_filesz == 0. * elf/tst-debug1.c: New file. Reviewed-by: Carlos O'Donell <carlos@redhat.com>
* elf: Remove internal_function attributeFlorian Weimer2017-08-311-5/+0
|
* Narrowing the visibility of libc-internal.h even further.Zack Weinberg2017-03-011-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | posix/wordexp-test.c used libc-internal.h for PTR_ALIGN_DOWN; similar to what was done with libc-diag.h, I have split the definitions of cast_to_integer, ALIGN_UP, ALIGN_DOWN, PTR_ALIGN_UP, and PTR_ALIGN_DOWN to a new header, libc-pointer-arith.h. It then occurred to me that the remaining declarations in libc-internal.h are mostly to do with early initialization, and probably most of the files including it, even in the core code, don't need it anymore. Indeed, only 19 files actually need what remains of libc-internal.h. 23 others need libc-diag.h instead, and 12 need libc-pointer-arith.h instead. No file needs more than one of them, and 16 don't need any of them! So, with this patch, libc-internal.h stops including libc-diag.h as well as losing the pointer arithmetic macros, and all including files are adjusted. * include/libc-pointer-arith.h: New file. Define cast_to_integer, ALIGN_UP, ALIGN_DOWN, PTR_ALIGN_UP, and PTR_ALIGN_DOWN here. * include/libc-internal.h: Definitions of above macros moved from here. Don't include libc-diag.h anymore either. * posix/wordexp-test.c: Include stdint.h and libc-pointer-arith.h. Don't include libc-internal.h. * debug/pcprofile.c, elf/dl-tunables.c, elf/soinit.c, io/openat.c * io/openat64.c, misc/ptrace.c, nptl/pthread_clock_gettime.c * nptl/pthread_clock_settime.c, nptl/pthread_cond_common.c * string/strcoll_l.c, sysdeps/nacl/brk.c * sysdeps/unix/clock_settime.c * sysdeps/unix/sysv/linux/i386/get_clockfreq.c * sysdeps/unix/sysv/linux/ia64/get_clockfreq.c * sysdeps/unix/sysv/linux/powerpc/get_clockfreq.c * sysdeps/unix/sysv/linux/sparc/sparc64/get_clockfreq.c: Don't include libc-internal.h. * elf/get-dynamic-info.h, iconv/loop.c * iconvdata/iso-2022-cn-ext.c, locale/weight.h, locale/weightwc.h * misc/reboot.c, nis/nis_table.c, nptl_db/thread_dbP.h * nscd/connections.c, resolv/res_send.c, soft-fp/fmadf4.c * soft-fp/fmasf4.c, soft-fp/fmatf4.c, stdio-common/vfscanf.c * sysdeps/ieee754/dbl-64/e_lgamma_r.c * sysdeps/ieee754/dbl-64/k_rem_pio2.c * sysdeps/ieee754/flt-32/e_lgammaf_r.c * sysdeps/ieee754/flt-32/k_rem_pio2f.c * sysdeps/ieee754/ldbl-128/k_tanl.c * sysdeps/ieee754/ldbl-128ibm/k_tanl.c * sysdeps/ieee754/ldbl-96/e_lgammal_r.c * sysdeps/ieee754/ldbl-96/k_tanl.c, sysdeps/nptl/futex-internal.h: Include libc-diag.h instead of libc-internal.h. * elf/dl-load.c, elf/dl-reloc.c, locale/programs/locarchive.c * nptl/nptl-init.c, string/strcspn.c, string/strspn.c * malloc/malloc.c, sysdeps/i386/nptl/tls.h * sysdeps/nacl/dl-map-segments.h, sysdeps/x86_64/atomic-machine.h * sysdeps/unix/sysv/linux/spawni.c * sysdeps/x86_64/nptl/tls.h: Include libc-pointer-arith.h instead of libc-internal.h. * elf/get-dynamic-info.h, sysdeps/nacl/dl-map-segments.h * sysdeps/x86_64/atomic-machine.h: Add multiple include guard.
* Update copyright dates with scripts/update-copyrights.Joseph Myers2017-01-011-1/+1
|
generated by cgit-pink 1.4.1 (git 2.36.1) at 2024-07-27 11:42:54 +0000