about summary refs log tree commit diff
path: root/elf
Commit message (Collapse)AuthorAgeFilesLines
* elf: Refuse to dlopen PIE objects [BZ #24323]Florian Weimer2019-11-011-4/+14
| | | | | | | | Another executable has already been mapped, so the dynamic linker cannot perform relocations correctly for the second executable. (cherry picked from commit 2c75b545de6fe3c44138799c68217a94bc669a88) (test omitted due to indirect dependency on test-in-container)
* Call _dl_open_check after relocation [BZ #24259]H.J. Lu2019-10-311-2/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is a workaround for [BZ #20839] which doesn't remove the NODELETE object when _dl_open_check throws an exception. Move it after relocation in dl_open_worker to avoid leaving the NODELETE object mapped without relocation. [BZ #24259] * elf/dl-open.c (dl_open_worker): Call _dl_open_check after relocation. * sysdeps/x86/Makefile (tests): Add tst-cet-legacy-5a, tst-cet-legacy-5b, tst-cet-legacy-6a and tst-cet-legacy-6b. (modules-names): Add tst-cet-legacy-mod-5a, tst-cet-legacy-mod-5b, tst-cet-legacy-mod-5c, tst-cet-legacy-mod-6a, tst-cet-legacy-mod-6b and tst-cet-legacy-mod-6c. (CFLAGS-tst-cet-legacy-5a.c): New. (CFLAGS-tst-cet-legacy-5b.c): Likewise. (CFLAGS-tst-cet-legacy-mod-5a.c): Likewise. (CFLAGS-tst-cet-legacy-mod-5b.c): Likewise. (CFLAGS-tst-cet-legacy-mod-5c.c): Likewise. (CFLAGS-tst-cet-legacy-6a.c): Likewise. (CFLAGS-tst-cet-legacy-6b.c): Likewise. (CFLAGS-tst-cet-legacy-mod-6a.c): Likewise. (CFLAGS-tst-cet-legacy-mod-6b.c): Likewise. (CFLAGS-tst-cet-legacy-mod-6c.c): Likewise. ($(objpfx)tst-cet-legacy-5a): Likewise. ($(objpfx)tst-cet-legacy-5a.out): Likewise. ($(objpfx)tst-cet-legacy-mod-5a.so): Likewise. ($(objpfx)tst-cet-legacy-mod-5b.so): Likewise. ($(objpfx)tst-cet-legacy-5b): Likewise. ($(objpfx)tst-cet-legacy-5b.out): Likewise. (tst-cet-legacy-5b-ENV): Likewise. ($(objpfx)tst-cet-legacy-6a): Likewise. ($(objpfx)tst-cet-legacy-6a.out): Likewise. ($(objpfx)tst-cet-legacy-mod-6a.so): Likewise. ($(objpfx)tst-cet-legacy-mod-6b.so): Likewise. ($(objpfx)tst-cet-legacy-6b): Likewise. ($(objpfx)tst-cet-legacy-6b.out): Likewise. (tst-cet-legacy-6b-ENV): Likewise. * sysdeps/x86/tst-cet-legacy-5.c: New file. * sysdeps/x86/tst-cet-legacy-5a.c: Likewise. * sysdeps/x86/tst-cet-legacy-5b.c: Likewise. * sysdeps/x86/tst-cet-legacy-6.c: Likewise. * sysdeps/x86/tst-cet-legacy-6a.c: Likewise. * sysdeps/x86/tst-cet-legacy-6b.c: Likewise. * sysdeps/x86/tst-cet-legacy-mod-5.c: Likewise. * sysdeps/x86/tst-cet-legacy-mod-5a.c: Likewise. * sysdeps/x86/tst-cet-legacy-mod-5b.c: Likewise. * sysdeps/x86/tst-cet-legacy-mod-5c.c: Likewise. * sysdeps/x86/tst-cet-legacy-mod-6.c: Likewise. * sysdeps/x86/tst-cet-legacy-mod-6a.c: Likewise. * sysdeps/x86/tst-cet-legacy-mod-6b.c: Likewise. * sysdeps/x86/tst-cet-legacy-mod-6c.c: Likewise. (cherry picked from commit d0093c5cefb7f7a4143f3bb03743633823229cc6)
* Add glibc.malloc.mxfast tunableDJ Delorie2019-10-301-0/+5
| | | | | | | | | | | | | * elf/dl-tunables.list: Add glibc.malloc.mxfast. * manual/tunables.texi: Document it. * malloc/malloc.c (do_set_mxfast): New. (__libc_mallopt): Call it. * malloc/arena.c: Add mxfast tunable. * malloc/tst-mxfast.c: New. * malloc/Makefile: Add it. Reviewed-by: Carlos O'Donell <carlos@redhat.com> (cherry picked from commit c48d92b430c480de06762f80c104922239416826)
* aarch64: add STO_AARCH64_VARIANT_PCS and DT_AARCH64_VARIANT_PCSSzabolcs Nagy2019-07-101-0/+7
| | | | | | | | | | | | | STO_AARCH64_VARIANT_PCS is a non-visibility st_other flag for marking symbols that reference functions that may follow a variant PCS with different register usage convention from the base PCS. DT_AARCH64_VARIANT_PCS is a dynamic tag that marks ELF modules that have R_*_JUMP_SLOT relocations for symbols marked with STO_AARCH64_VARIANT_PCS (i.e. have variant PCS calls via a PLT). * elf/elf.h (STO_AARCH64_VARIANT_PCS): Define. (DT_AARCH64_VARIANT_PCS): Define.
* elf: Fix pldd (BZ#18035)Adhemerval Zanella2019-04-262-108/+70
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Since 9182aa67994 (Fix vDSO l_name for GDB's, BZ#387) the initial link_map for executable itself and loader will have both l_name and l_libname->name holding the same value due: elf/dl-object.c 95 new->l_name = *realname ? realname : (char *) newname->name + libname_len - 1; Since newname->name points to new->l_libname->name. This leads to pldd to an infinite call at: elf/pldd-xx.c 203 again: 204 while (1) 205 { 206 ssize_t n = pread64 (memfd, tmpbuf.data, tmpbuf.length, name_offset); 228 /* Try the l_libname element. */ 229 struct E(libname_list) ln; 230 if (pread64 (memfd, &ln, sizeof (ln), m.l_libname) == sizeof (ln)) 231 { 232 name_offset = ln.name; 233 goto again; 234 } Since the value at ln.name (l_libname->name) will be the same as previously read. The straightforward fix is just avoid the check and read the new list entry. I checked also against binaries issues with old loaders with fix for BZ#387, and pldd could dump the shared objects. Checked on x86_64-linux-gnu, i686-linux-gnu, aarch64-linux-gnu, and powerpc64le-linux-gnu. [BZ #18035] * elf/Makefile (tests-container): Add tst-pldd. * elf/pldd-xx.c: Use _Static_assert in of pldd_assert. (E(find_maps)): Avoid use alloca, use default read file operations instead of explicit LFS names, and fix infinite loop. * elf/pldd.c: Explicit set _FILE_OFFSET_BITS, cleanup headers. (get_process_info): Use _Static_assert instead of assert, use default directory operations instead of explicit LFS names, and free some leadek pointers. * elf/tst-pldd.c: New file. (cherry picked from commit 1a4c27355e146b6d8cc6487b998462c7fdd1048f) (Backported without the test case due to lack of test-in-container support.)
* RISC-V: Fix elfutils testsuite unwind failures.Jim Wilson2019-02-192-4/+26
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The clone.S patch fixes 2 elfutils testsuite unwind failures, where the backtrace gets stuck repeating __thread_start until we hit the backtrace limit. This was confirmed by building and installing a patched glibc and then building elfutils and running its testsuite. Unfortunately, the testcase isn't working as expected and I don't know why. The testcase passes even when my clone.S patch is not installed. The testcase looks logically similarly to the elfutils testcases that are failing. Maybe there is a subtle difference in how the glibc unwinding works versus the elfutils unwinding? I don't have good gdb pthread support yet, so I haven't found a way to debug this. Anyways, I don't know if the testcase is useful or not. If the testcase isn't useful then maybe the clone.S patch is OK without a testcase? Jim [BZ #24040] * elf/Makefile (CFLAGS-tst-unwind-main.c): Add -DUSE_PTHREADS=0. * elf/tst-unwind-main.c: If USE_PTHEADS, include pthread.h and error.h (func): New. (main): If USE_PTHREADS, call pthread_create to run func. Otherwise call func directly. * nptl/Makefile (tests): Add tst-unwind-thread. (CFLAGS-tst-unwind-thread.c): Define. * nptl/tst-unwind-thread.c: New file. * sysdeps/unix/sysv/linux/riscv/clone.S (__thread_start): Mark ra as undefined. (cherry picked from commit 85bd1ddbdfdfd13cfd06f7c367519b6ed3360843)
* RISC-V: properly terminate call chain (bug 23125)Andreas Schwab2018-12-152-1/+42
| | | | | | | | Mark the ra register as undefined in _start, so that unwinding through main works correctly. Also, don't use a tail call so that ra points after the call to __libc_start_main, not after the previous call. (cherry picked from commit 2dd12baa045f25c52b30a34b10f72d51f2605413)
* Fix _dl_profile_fixup data-dependency issue (Bug 23690)Tulio Magno Quites Machado Filho2018-12-071-5/+43
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There is a data-dependency between the fields of struct l_reloc_result and the field used as the initialization guard. Users of the guard expect writes to the structure to be observable when they also observe the guard initialized. The solution for this problem is to use an acquire and release load and store to ensure previous writes to the structure are observable if the guard is initialized. The previous implementation used DL_FIXUP_VALUE_ADDR (l_reloc_result->addr) as the initialization guard, making it impossible for some architectures to load and store it atomically, i.e. hppa and ia64, due to its larger size. This commit adds an unsigned int to l_reloc_result to be used as the new initialization guard of the struct, making it possible to load and store it atomically in all architectures. The fix ensures that the values observed in l_reloc_result are consistent and do not lead to crashes. The algorithm is documented in the code in elf/dl-runtime.c (_dl_profile_fixup). Not all data races have been eliminated. Tested with build-many-glibcs and on powerpc, powerpc64, and powerpc64le. [BZ #23690] * elf/dl-runtime.c (_dl_profile_fixup): Guarantee memory modification order when accessing reloc_result->addr. * include/link.h (reloc_result): Add field init. * nptl/Makefile (tests): Add tst-audit-threads. (modules-names): Add tst-audit-threads-mod1 and tst-audit-threads-mod2. Add rules to build tst-audit-threads. * nptl/tst-audit-threads-mod1.c: New file. * nptl/tst-audit-threads-mod2.c: Likewise. * nptl/tst-audit-threads.c: Likewise. * nptl/tst-audit-threads.h: Likewise. Signed-off-by: Tulio Magno Quites Machado Filho <tuliom@linux.ibm.com> Reviewed-by: Carlos O'Donell <carlos@redhat.com> (cherry picked from commit e5d262effe3a87164308a3f37e61b32d0348692a)
* check-execstack: Permit sysdeps to xfail some libsSamuel Thibault2018-07-201-1/+1
| | | | | | | | | | | * scripts/check-execstack.awk: Consider `xfail' variable containing a list of libraries whose stack executability is expected. * elf/Makefile ($(objpfx)check-execstack.out): Pass $(check-execstack-xfail) to check-execstack.awk through `xfail' variable. * sysdeps/mach/hurd/i386/Makefile (check-execstack-xfail): Set to ld.so libc.so libpthread.so.
* x86: Support IBT and SHSTK in Intel CET [BZ #21598]H.J. Lu2018-07-164-25/+49
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Intel Control-flow Enforcement Technology (CET) instructions: https://software.intel.com/sites/default/files/managed/4d/2a/control-flow-en forcement-technology-preview.pdf includes Indirect Branch Tracking (IBT) and Shadow Stack (SHSTK). GNU_PROPERTY_X86_FEATURE_1_IBT is added to GNU program property to indicate that all executable sections are compatible with IBT when ENDBR instruction starts each valid target where an indirect branch instruction can land. Linker sets GNU_PROPERTY_X86_FEATURE_1_IBT on output only if it is set on all relocatable inputs. On an IBT capable processor, the following steps should be taken: 1. When loading an executable without an interpreter, enable IBT and lock IBT if GNU_PROPERTY_X86_FEATURE_1_IBT is set on the executable. 2. When loading an executable with an interpreter, enable IBT if GNU_PROPERTY_X86_FEATURE_1_IBT is set on the interpreter. a. If GNU_PROPERTY_X86_FEATURE_1_IBT isn't set on the executable, disable IBT. b. Lock IBT. 3. If IBT is enabled, when loading a shared object without GNU_PROPERTY_X86_FEATURE_1_IBT: a. If legacy interwork is allowed, then mark all pages in executable PT_LOAD segments in legacy code page bitmap. Failure of legacy code page bitmap allocation causes an error. b. If legacy interwork isn't allowed, it causes an error. GNU_PROPERTY_X86_FEATURE_1_SHSTK is added to GNU program property to indicate that all executable sections are compatible with SHSTK where return address popped from shadow stack always matches return address popped from normal stack. Linker sets GNU_PROPERTY_X86_FEATURE_1_SHSTK on output only if it is set on all relocatable inputs. On a SHSTK capable processor, the following steps should be taken: 1. When loading an executable without an interpreter, enable SHSTK if GNU_PROPERTY_X86_FEATURE_1_SHSTK is set on the executable. 2. When loading an executable with an interpreter, enable SHSTK if GNU_PROPERTY_X86_FEATURE_1_SHSTK is set on interpreter. a. If GNU_PROPERTY_X86_FEATURE_1_SHSTK isn't set on the executable or any shared objects loaded via the DT_NEEDED tag, disable SHSTK. b. Otherwise lock SHSTK. 3. After SHSTK is enabled, it is an error to load a shared object without GNU_PROPERTY_X86_FEATURE_1_SHSTK. To enable CET support in glibc, --enable-cet is required to configure glibc. When CET is enabled, both compiler and assembler must support CET. Otherwise, it is a configure-time error. To support CET run-time control, 1. _dl_x86_feature_1 is added to the writable ld.so namespace to indicate if IBT or SHSTK are enabled at run-time. It should be initialized by init_cpu_features. 2. For dynamic executables: a. A l_cet field is added to struct link_map to indicate if IBT or SHSTK is enabled in an ELF module. _dl_process_pt_note or _rtld_process_pt_note is called to process PT_NOTE segment for GNU program property and set l_cet. b. _dl_open_check is added to check IBT and SHSTK compatibilty when dlopening a shared object. 3. Replace i386 _dl_runtime_resolve and _dl_runtime_profile with _dl_runtime_resolve_shstk and _dl_runtime_profile_shstk, respectively if SHSTK is enabled. CET run-time control can be changed via GLIBC_TUNABLES with $ export GLIBC_TUNABLES=glibc.tune.x86_shstk=[permissive|on|off] $ export GLIBC_TUNABLES=glibc.tune.x86_ibt=[permissive|on|off] 1. permissive: SHSTK is disabled when dlopening a legacy ELF module. 2. on: IBT or SHSTK are always enabled, regardless if there are IBT or SHSTK bits in GNU program property. 3. off: IBT or SHSTK are always disabled, regardless if there are IBT or SHSTK bits in GNU program property. <cet.h> from CET-enabled GCC is automatically included by assembly codes to add GNU_PROPERTY_X86_FEATURE_1_IBT and GNU_PROPERTY_X86_FEATURE_1_SHSTK to GNU program property. _CET_ENDBR is added at the entrance of all assembly functions whose address may be taken. _CET_NOTRACK is used to insert NOTRACK prefix with indirect jump table to support IBT. It is defined as notrack when _CET_NOTRACK is defined in <cet.h>. [BZ #21598] * configure.ac: Add --enable-cet. * configure: Regenerated. * elf/Makefille (all-built-dso): Add a comment. * elf/dl-load.c (filebuf): Moved before "dynamic-link.h". Include <dl-prop.h>. (_dl_map_object_from_fd): Call _dl_process_pt_note on PT_NOTE segment. * elf/dl-open.c: Include <dl-prop.h>. (dl_open_worker): Call _dl_open_check. * elf/rtld.c: Include <dl-prop.h>. (dl_main): Call _rtld_process_pt_note on PT_NOTE segment. Call _rtld_main_check. * sysdeps/generic/dl-prop.h: New file. * sysdeps/i386/dl-cet.c: Likewise. * sysdeps/unix/sysv/linux/x86/cpu-features.c: Likewise. * sysdeps/unix/sysv/linux/x86/dl-cet.h: Likewise. * sysdeps/x86/cet-tunables.h: Likewise. * sysdeps/x86/check-cet.awk: Likewise. * sysdeps/x86/configure: Likewise. * sysdeps/x86/configure.ac: Likewise. * sysdeps/x86/dl-cet.c: Likewise. * sysdeps/x86/dl-procruntime.c: Likewise. * sysdeps/x86/dl-prop.h: Likewise. * sysdeps/x86/libc-start.h: Likewise. * sysdeps/x86/link_map.h: Likewise. * sysdeps/i386/dl-trampoline.S (_dl_runtime_resolve): Add _CET_ENDBR. (_dl_runtime_profile): Likewise. (_dl_runtime_resolve_shstk): New. (_dl_runtime_profile_shstk): Likewise. * sysdeps/linux/x86/Makefile (sysdep-dl-routines): Add dl-cet if CET is enabled. (CFLAGS-.o): Add -fcf-protection if CET is enabled. (CFLAGS-.os): Likewise. (CFLAGS-.op): Likewise. (CFLAGS-.oS): Likewise. (asm-CPPFLAGS): Add -fcf-protection -include cet.h if CET is enabled. (tests-special): Add $(objpfx)check-cet.out. (cet-built-dso): New. (+$(cet-built-dso:=.note)): Likewise. (common-generated): Add $(cet-built-dso:$(common-objpfx)%=%.note). ($(objpfx)check-cet.out): New. (generated): Add check-cet.out. * sysdeps/x86/cpu-features.c: Include <dl-cet.h> and <cet-tunables.h>. (TUNABLE_CALLBACK (set_x86_ibt)): New prototype. (TUNABLE_CALLBACK (set_x86_shstk)): Likewise. (init_cpu_features): Call get_cet_status to check CET status and update dl_x86_feature_1 with CET status. Call TUNABLE_CALLBACK (set_x86_ibt) and TUNABLE_CALLBACK (set_x86_shstk). Disable and lock CET in libc.a. * sysdeps/x86/cpu-tunables.c: Include <cet-tunables.h>. (TUNABLE_CALLBACK (set_x86_ibt)): New function. (TUNABLE_CALLBACK (set_x86_shstk)): Likewise. * sysdeps/x86/sysdep.h (_CET_NOTRACK): New. (_CET_ENDBR): Define if not defined. (ENTRY): Add _CET_ENDBR. * sysdeps/x86/dl-tunables.list (glibc.tune): Add x86_ibt and x86_shstk. * sysdeps/x86_64/dl-trampoline.h (_dl_runtime_resolve): Add _CET_ENDBR. (_dl_runtime_profile): Likewise.
* elf: Accept absolute (SHN_ABS) symbols whose value is zero [BZ #23307]Maciej W. Rozycki2018-06-295-2/+71
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We have this condition in `check_match' (in elf/dl-lookup.c): if (__glibc_unlikely ((sym->st_value == 0 /* No value. */ && stt != STT_TLS) || ELF_MACHINE_SYM_NO_MATCH (sym) || (type_class & (sym->st_shndx == SHN_UNDEF)))) return NULL; which causes all !STT_TLS symbols whose value is zero to be silently ignored in lookup. This may make sense for regular symbols, however not for absolute (SHN_ABS) ones, where zero is like any value, there's no special meaning attached to it. Consequently legitimate programs fail, for example taking the `elf/tst-absolute-sym' test case, substituting 0 for 0x55aa in `elf/tst-absolute-sym-lib.lds' and then trying to run the resulting program we get this: $ .../elf/tst-absolute-sym .../elf/tst-absolute-sym: symbol lookup error: .../elf/tst-absolute-sym-lib.so: undefined symbol: absolute $ even though the symbol clearly is there: $ readelf --dyn-syms .../elf/tst-absolute-sym-lib.so | grep '\babsolute\b' 7: 00000000 0 NOTYPE GLOBAL DEFAULT ABS absolute $ The check for the zero value has been there since forever or commit d66e34cd4234/08162fa88891 ("Implemented runtime dynamic linker to support ELF shared libraries.") dating back to May 2nd 1995, and the problem triggers regardless of commit e7feec374c63 ("elf: Correct absolute (SHN_ABS) symbol run-time calculation [BZ #19818]") being present or not. Fix the issue then, by permitting `sym->st_value' to be 0 for SHN_ABS symbols in lookup. [BZ #23307] * elf/dl-lookup.c (check_match): Do not reject a symbol whose `st_value' is 0 if `st_shndx' is SHN_ABS. * elf/tst-absolute-zero.c: New file. * elf/tst-absolute-zero-lib.c: New file. * elf/tst-absolute-zero-lib.lds: New file. * elf/Makefile (tests): Add `tst-absolute-zero'. (modules-names): Add `tst-absolute-zero-lib'. (LDLIBS-tst-absolute-zero-lib.so): New variable. ($(objpfx)tst-absolute-zero-lib.so): New dependency. ($(objpfx)tst-absolute-zero: New dependency.
* New configure option --disable-crypt.Zack Weinberg2018-06-292-9/+22
| | | | | | | | Some Linux distributions are experimenting with a new, separately maintained and hopefully more agile implementation of the crypt API. To facilitate this, add a configure option which disables glibc's embedded libcrypt. When this option is given, libcrypt.* and crypt.h will not be built nor installed.
* _dl_map_object_deps: Use struct scratch_buffer [BZ #18023]Florian Weimer2018-06-271-12/+16
| | | | | | The function comment suggests that _dl_map_object_deps cannot use malloc, but it already allocates the l_initfini array on the heap, so the additional allocation should be acceptable.
* Add Andes nds32 dynamic relocations to elf.hVincent Chen2018-06-211-0/+10
| | | | | | | | | | | * elf/elf.h (R_NDS32_NONE): New define. (R_NDS32_32_RELA): Likewise. (R_NDS32_COPY): Likewise. (R_NDS32_GLOB_DAT): Likewise. (R_NDS32_JUMP_SLOT): Likewise. (R_NDS32_RELATIVE): Likewise. (R_NDS32_TLS_TPOFF): Likewise. (R_NDS32_TLS_DESC): Likewise.
* elf.h: Add BPF relocation types.Mark Wielaard2018-06-211-1/+2
| | | | | | | | The BPF ELF format has new relocation types R_BPF_64_64 and R_BPF_64_32. The existing R_BPF_MAP_FD was an extension that never got implemented. Remove it, because the constant conflicts with the official R_BPF_64_64. Reviewed-by: Carlos O'Donell <carlos@redhat.com>
* Fix comments in _dl_dst_count and _dl_dst_substitute.Carlos O'Donell2018-06-121-6/+8
| | | | | | | | | The comments in _dl_dst_count is adjusted to match what the code does which is count DSTs from the start of the string. With the removal of DL_DST_COUNT we no longer accept an input that starts at the first $. In _dl_dst_substitute we adjust the comment to indicate that both conditions must be true for the SUID/SGID $ORIGIN exception.
* Improve DST handling (Bug 23102, Bug 21942, Bug 18018, Bug 23259).Carlos O'Donell2018-06-123-93/+135
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This commit improves DST handling significantly in the following ways: firstly is_dst () is overhauled to correctly process DST sequences that would be accepted given the ELF gABI. This means that we actually now accept slightly more sequences than before. Now we accept $ORIGIN$ORIGIN, but in the past we accepted only $ORIGIN\0 or $ORIGIN/..., but this kind of behaviour results in unexpected and uninterpreted DST sequences being used as literal search paths leading to security defects. Therefore the first step in correcting this defect is making is_dst () properly account for all DSTs and making the function context free in the sense that it counts DSTs without knowledge of path, or AT_SECURE. Next, _dl_dst_count () is also simplified to count all DSTs regardless of context. Then in _dl_dst_substitute () we reintroduce context-dependent processing for such things as AT_SECURE handling. At the level of _dl_dst_substitute we can have access to things like the true start of the string sequence to validate $ORIGIN-based paths rooted in trusted directories. Lastly, we tighten up the accepted sequences in AT_SECURE, and avoid leaving known unexpanded DSTs, this is noted in the NEWS entry. Verified with a sequence of 68 tests on x86_64 that cover non-AT_SECURE and AT_SECURE testing using a sysroot (requires root to run). The tests cover cases for bug 23102, bug 21942, bug 18018, and bug 23259. These tests are not yet appropriate for the glibc regression testsuite, but with the upcoming test-in-container testing framework it should be possible to include these tests upstream soon. See the mailing list for the tests: https://www.sourceware.org/ml/libc-alpha/2018-06/msg00251.html
* Avoid cancellable I/O primitives in ld.so.Zack Weinberg2018-06-124-28/+30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Neither the <dlfcn.h> entry points, nor lazy symbol resolution, nor initial shared library load-up, are cancellation points, so ld.so should exclusively use I/O primitives that are not cancellable. We currently achieve this by having the cancellation hooks compile as no-ops when IS_IN(rtld); this patch changes to using exclusively _nocancel primitives in the source code instead, which makes the intent clearer and significantly reduces the amount of code compiled under IS_IN(rtld) as well as IS_IN(libc) -- in particular, elf/Makefile no longer thinks we require a copy of unwind.c in rtld-libc.a. (The older mechanism is preserved as a backstop.) The bulk of the change is splitting up the files that define the _nocancel I/O functions, so they don't also define the variants that *are* cancellation points; after which, the existing logic for picking out the bits of libc that need to be recompiled as part of ld.so Just Works. I did this for all of the _nocancel functions, not just the ones used by ld.so, for consistency. fcntl was a little tricky because it's only a cancellation point for certain opcodes (F_SETLKW(64), which can block), and the existing __fcntl_nocancel wasn't applying the FCNTL_ADJUST_CMD hook, which strikes me as asking for trouble, especially as the only nontrivial definition of FCNTL_ADJUST_CMD (for powerpc64) changes F_*LK* opcodes. To fix this, fcntl_common moves to fcntl_nocancel.c along with __fcntl_nocancel, and changes its name to the extern (but hidden) symbol __fcntl_nocancel_adjusted, so that regular fcntl can continue calling it. __fcntl_nocancel now applies FCNTL_ADJUST_CMD; so that both both fcntl.c and fcntl_nocancel.c can see it, the only nontrivial definition moves from sysdeps/u/s/l/powerpc/powerpc64/fcntl.c to .../powerpc64/sysdep.h and becomes entirely a macro, instead of a macro that calls an inline function. The nptl version of libpthread also changes a little, because its "compat-routines" formerly included files that defined all the _nocancel functions it uses; instead of continuing to duplicate them, I exported the relevant ones from libc.so as GLIBC_PRIVATE. Since the Linux fcntl.c calls a function defined by fcntl_nocancel.c, it can no longer be used from libpthread.so; instead, introduce a custom forwarder, pt-fcntl.c, and export __libc_fcntl from libc.so as GLIBC_PRIVATE. The nios2-linux ABI doesn't include a copy of vfork() in libpthread, and it was handling that by manipulating libpthread-routines in .../linux/nios2/Makefile; it is cleaner to do what other such ports do, and have a pt-vfork.S that defines no symbols. Right now, it appears that Hurd does not implement _nocancel I/O, so sysdeps/generic/not-cancel.h will forward everything back to the regular functions. This changed the names of some of the functions that sysdeps/mach/hurd/dl-sysdep.c needs to interpose. * elf/dl-load.c, elf/dl-misc.c, elf/dl-profile.c, elf/rtld.c * sysdeps/unix/sysv/linux/dl-sysdep.c Include not-cancel.h. Use __close_nocancel instead of __close, __open64_nocancel instead of __open, __read_nocancel instead of __libc_read, and __write_nocancel instead of __libc_write. * csu/check_fds.c (check_one_fd) * sysdeps/posix/fdopendir.c (__fdopendir) * sysdeps/posix/opendir.c (__alloc_dir): Use __fcntl_nocancel instead of __fcntl and/or __libc_fcntl. * sysdeps/unix/sysv/linux/pthread_setname.c (pthread_setname_np) * sysdeps/unix/sysv/linux/pthread_getname.c (pthread_getname_np) * sysdeps/unix/sysv/linux/i386/smp.h (is_smp_system): Use __open64_nocancel instead of __open_nocancel. * sysdeps/unix/sysv/linux/not-cancel.h: Move all of the hidden_proto declarations to the end and issue them if either IS_IN(libc) or IS_IN(rtld). * sysdeps/unix/sysv/linux/Makefile [subdir=io] (sysdep_routines): Add close_nocancel, fcntl_nocancel, nanosleep_nocancel, open_nocancel, open64_nocancel, openat_nocancel, pause_nocancel, read_nocancel, waitpid_nocancel, write_nocancel. * io/Versions [GLIBC_PRIVATE]: Add __libc_fcntl, __fcntl_nocancel, __open64_nocancel, __write_nocancel. * posix/Versions: Add __nanosleep_nocancel, __pause_nocancel. * nptl/pt-fcntl.c: New file. * nptl/Makefile (pthread-compat-wrappers): Remove fcntl. (libpthread-routines): Add pt-fcntl. * include/fcntl.h (__fcntl_nocancel_adjusted): New function. (__libc_fcntl): Remove attribute_hidden. * sysdeps/unix/sysv/linux/fcntl.c (__libc_fcntl): Call __fcntl_nocancel_adjusted, not fcntl_common. (__fcntl_nocancel): Move to new file fcntl_nocancel.c. (fcntl_common): Rename to __fcntl_nocancel_adjusted; also move to fcntl_nocancel.c. * sysdeps/unix/sysv/linux/fcntl_nocancel.c: New file. * sysdeps/unix/sysv/linux/powerpc/powerpc64/fcntl.c: Remove file. * sysdeps/unix/sysv/linux/powerpc/powerpc64/sysdep.h: Define FCNTL_ADJUST_CMD here, as a self-contained macro. * sysdeps/unix/sysv/linux/close.c: Move __close_nocancel to... * sysdeps/unix/sysv/linux/close_nocancel.c: ...this new file. * sysdeps/unix/sysv/linux/nanosleep.c: Move __nanosleep_nocancel to... * sysdeps/unix/sysv/linux/nanosleep_nocancel.c: ...this new file. * sysdeps/unix/sysv/linux/open.c: Move __open_nocancel to... * sysdeps/unix/sysv/linux/open_nocancel.c: ...this new file. * sysdeps/unix/sysv/linux/open64.c: Move __open64_nocancel to... * sysdeps/unix/sysv/linux/open64_nocancel.c: ...this new file. * sysdeps/unix/sysv/linux/openat.c: Move __openat_nocancel to... * sysdeps/unix/sysv/linux/openat_nocancel.c: ...this new file. * sysdeps/unix/sysv/linux/openat64.c: Move __openat64_nocancel to... * sysdeps/unix/sysv/linux/openat64_nocancel.c: ...this new file. * sysdeps/unix/sysv/linux/pause.c: Move __pause_nocancel to... * sysdeps/unix/sysv/linux/pause_nocancel.c: ...this new file. * sysdeps/unix/sysv/linux/read.c: Move __read_nocancel to... * sysdeps/unix/sysv/linux/read_nocancel.c: ...this new file. * sysdeps/unix/sysv/linux/waitpid.c: Move __waitpid_nocancel to... * sysdeps/unix/sysv/linux/waitpid_nocancel.c: ...this new file. * sysdeps/unix/sysv/linux/write.c: Move __write_nocancel to... * sysdeps/unix/sysv/linux/write_nocancel.c: ...this new file. * sysdeps/unix/sysv/linux/nios2/Makefile: Don't override libpthread-routines. * sysdeps/unix/sysv/linux/nios2/pt-vfork.S: New file which defines nothing. * sysdeps/mach/hurd/dl-sysdep.c: Define __read instead of __libc_read, and __write instead of __libc_write. Define __open64 in addition to __open.
* Mark _init and _fini as hidden [BZ #23145]H.J. Lu2018-06-081-1/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | _init and _fini are special functions provided by glibc for linker to define DT_INIT and DT_FINI in executable and shared library. They should never be put in dynamic symbol table. This patch marks them as hidden to remove them from dynamic symbol table. Tested with build-many-glibcs.py. [BZ #23145] * elf/Makefile (tests-special): Add $(objpfx)check-initfini.out. ($(all-built-dso:=.dynsym): New target. (common-generated): Add $(all-built-dso:$(common-objpfx)%=%.dynsym). ($(objpfx)check-initfini.out): New target. (generated): Add check-initfini.out. * scripts/check-initfini.awk: New file. * sysdeps/aarch64/crti.S (_init): Mark as hidden. (_fini): Likewise. * sysdeps/alpha/crti.S (_init): Mark as hidden. (_fini): Likewise. * sysdeps/arm/crti.S (_init): Mark as hidden. (_fini): Likewise. * sysdeps/hppa/crti.S (_init): Mark as hidden. (_fini): Likewise. * sysdeps/i386/crti.S (_init): Mark as hidden. (_fini): Likewise. * sysdeps/ia64/crti.S (_init): Mark as hidden. (_fini): Likewise. * sysdeps/m68k/crti.S (_init): Mark as hidden. (_fini): Likewise. * sysdeps/microblaze/crti.S (_init): Mark as hidden. (_fini): Likewise. * sysdeps/mips/mips32/crti.S (_init): Mark as hidden. (_fini): Likewise. * sysdeps/mips/mips64/n32/crti.S (_init): Mark as hidden. (_fini): Likewise. * sysdeps/mips/mips64/n64/crti.S (_init): Mark as hidden. (_fini): Likewise. * sysdeps/nios2/crti.S (_init): Mark as hidden. (_fini): Likewise. * sysdeps/powerpc/powerpc32/crti.S (_init): Mark as hidden. (_fini): Likewise. * sysdeps/powerpc/powerpc64/crti.S (_init): Mark as hidden. (_fini): Likewise. * sysdeps/s390/s390-32/crti.S (_init): Mark as hidden. (_fini): Likewise. * sysdeps/s390/s390-64/crti.S (_init): Mark as hidden. (_fini): Likewise. * sysdeps/sh/crti.S (_init): Mark as hidden. (_fini): Likewise. * sysdeps/sparc/crti.S (_init): Mark as hidden. (_fini): Likewise. * sysdeps/x86_64/crti.S (_init): Mark as hidden. (_fini): Likewise.
* static-PIE: Update DT_DEBUG for debugger [BZ #23206]H.J. Lu2018-05-291-0/+16
| | | | | | | | | | | This is needed to support debugging dlopened shared libraries in static PIE. [BZ #23206] * elf/dl-reloc-static-pie.c (_dl_relocate_static_pie): Initialize _r_debug and update DT_DEBUG for debugger. Reviewed-by: Carlos O'Donell <carlos@redhat.com>
* Fix BZ 20419. A PT_NOTE in a binary could be arbitratily large, so usingPaul Pluzhnikov2018-05-054-4/+77
| | | | | | | | | | | | | alloca for it may cause stack overflow. If the note is larger than __MAX_ALLOCA_CUTOFF, use dynamically allocated memory to read it in. 2018-05-05 Paul Pluzhnikov <ppluzhnikov@google.com> [BZ #20419] * elf/dl-load.c (open_verify): Fix stack overflow. * elf/Makefile (tst-big-note): New test. * elf/tst-big-note-lib.S: New. * elf/tst-big-note.c: New.
* Add NT_PPC_PKEY from Linux 4.16 to elf.h.Joseph Myers2018-04-231-0/+2
| | | | | | | | This patch adds the NT_PPC_PKEY macro from Linux 4.16 to elf.h. Tested for x86_64. * elf/elf.h (NT_PPC_PKEY): New macro.
* elf: Correct absolute (SHN_ABS) symbol run-time calculation [BZ #19818]Maciej W. Rozycki2018-04-045-2/+90
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Do not relocate absolute symbols by the base address. Such symbols have SHN_ABS as the section index and their value is not supposed to be affected by relocation as per the ELF gABI[1]: "SHN_ABS The symbol has an absolute value that will not change because of relocation." The reason for our non-conformance here seems to be an old SysV linker bug causing symbols like _DYNAMIC to be incorrectly emitted as absolute symbols[2]. However in a previous discussion it was pointed that this is seriously flawed by preventing the lone purpose of the existence of absolute symbols from being used[3]: "On the contrary, the only interpretation that makes sense to me is that it will not change because of relocation at link time or at load time. Absolute symbols, from the days of the earliest linking loaders, have been used to represent addresses that are outside the address space of the module (e.g., memory-mapped addresses or kernel gateway pages). They've even been used to represent true symbolic constants (e.g., system entry point numbers, sizes, version numbers). There's no other way to represent a true absolute symbol, while the meaning you seek is easily represented by giving the symbol a non-negative st_shndx value." and we ought to stop supporting our current broken interpretation. Update processing for dladdr(3) and dladdr1(3) so that SHN_ABS symbols are ignored, because under the corrected interpretation they do not represent addresses within a mapped file and therefore are not supposed to be considered. References: [1] "System V Application Binary Interface - DRAFT - 19 October 2010", The SCO Group, Section "Symbol Table", <http://www.sco.com/developers/gabi/2012-12-31/ch4.symtab.html> [2] Alan Modra, "Absolute symbols" <https://sourceware.org/ml/binutils/2012-05/msg00019.html> [3] Cary Coutant, "Re: Absolute symbols" <https://sourceware.org/ml/binutils/2012-05/msg00020.html> [BZ #19818] * sysdeps/generic/ldsodefs.h (SYMBOL_ADDRESS): Handle SHN_ABS symbols. * elf/dl-addr.c (determine_info): Ignore SHN_ABS symbols. * elf/tst-absolute-sym.c: New file. * elf/tst-absolute-sym-lib.c: New file. * elf/tst-absolute-sym-lib.lds: New file. * elf/Makefile (tests): Add `tst-absolute-sym'. (modules-names): Add `tst-absolute-sym-lib'. (LDLIBS-tst-absolute-sym-lib.so): New variable. ($(objpfx)tst-absolute-sym-lib.so): New dependency. ($(objpfx)tst-absolute-sym): New dependency.
* elf: Unify symbol address run-time calculation [BZ #19818]Maciej W. Rozycki2018-04-043-9/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Wrap symbol address run-time calculation into a macro and use it throughout, replacing inline calculations. There are a couple of variants, most of them different in a functionally insignificant way. Most calculations are right following RESOLVE_MAP, at which point either the map or the symbol returned can be checked for validity as the macro sets either both or neither. In some places both the symbol and the map has to be checked however. My initial implementation therefore always checked both, however that resulted in code larger by as much as 0.3%, as many places know from elsewhere that no check is needed. I have decided the size growth was unacceptable. Having looked closer I realized that it's the map that is the culprit. Therefore I have modified LOOKUP_VALUE_ADDRESS to accept an additional boolean argument telling it to access the map without checking it for validity. This in turn has brought quite nice results, with new code actually being smaller for i686, and MIPS o32, n32 and little-endian n64 targets, unchanged in size for x86-64 and, unusually, marginally larger for big-endian MIPS n64, as follows: i686: text data bss dec hex filename 152255 4052 192 156499 26353 ld-2.27.9000-base.so 152159 4052 192 156403 262f3 ld-2.27.9000-elf-symbol-value.so MIPS/o32/el: text data bss dec hex filename 142906 4396 260 147562 2406a ld-2.27.9000-base.so 142890 4396 260 147546 2405a ld-2.27.9000-elf-symbol-value.so MIPS/n32/el: text data bss dec hex filename 142267 4404 260 146931 23df3 ld-2.27.9000-base.so 142171 4404 260 146835 23d93 ld-2.27.9000-elf-symbol-value.so MIPS/n64/el: text data bss dec hex filename 149835 7376 408 157619 267b3 ld-2.27.9000-base.so 149787 7376 408 157571 26783 ld-2.27.9000-elf-symbol-value.so MIPS/o32/eb: text data bss dec hex filename 142870 4396 260 147526 24046 ld-2.27.9000-base.so 142854 4396 260 147510 24036 ld-2.27.9000-elf-symbol-value.so MIPS/n32/eb: text data bss dec hex filename 142019 4404 260 146683 23cfb ld-2.27.9000-base.so 141923 4404 260 146587 23c9b ld-2.27.9000-elf-symbol-value.so MIPS/n64/eb: text data bss dec hex filename 149763 7376 408 157547 2676b ld-2.27.9000-base.so 149779 7376 408 157563 2677b ld-2.27.9000-elf-symbol-value.so x86-64: text data bss dec hex filename 148462 6452 400 155314 25eb2 ld-2.27.9000-base.so 148462 6452 400 155314 25eb2 ld-2.27.9000-elf-symbol-value.so [BZ #19818] * sysdeps/generic/ldsodefs.h (LOOKUP_VALUE_ADDRESS): Add `set' parameter. (SYMBOL_ADDRESS): New macro. [!ELF_FUNCTION_PTR_IS_SPECIAL] (DL_SYMBOL_ADDRESS): Use SYMBOL_ADDRESS for symbol address calculation. * elf/dl-runtime.c (_dl_fixup): Likewise. (_dl_profile_fixup): Likewise. * elf/dl-symaddr.c (_dl_symbol_address): Likewise. * elf/rtld.c (dl_main): Likewise. * sysdeps/aarch64/dl-machine.h (elf_machine_rela): Likewise. * sysdeps/alpha/dl-machine.h (elf_machine_rela): Likewise. * sysdeps/arm/dl-machine.h (elf_machine_rel): Likewise. (elf_machine_rela): Likewise. * sysdeps/hppa/dl-machine.h (elf_machine_rela): Likewise. * sysdeps/hppa/dl-symaddr.c (_dl_symbol_address): Likewise. * sysdeps/i386/dl-machine.h (elf_machine_rel): Likewise. (elf_machine_rela): Likewise. * sysdeps/ia64/dl-machine.h (elf_machine_rela): Likewise. * sysdeps/m68k/dl-machine.h (elf_machine_rela): Likewise. * sysdeps/microblaze/dl-machine.h (elf_machine_rela): Likewise. * sysdeps/mips/dl-machine.h (ELF_MACHINE_BEFORE_RTLD_RELOC): Likewise. (elf_machine_reloc): Likewise. (elf_machine_got_rel): Likewise. * sysdeps/mips/dl-trampoline.c (__dl_runtime_resolve): Likewise. * sysdeps/nios2/dl-machine.h (elf_machine_rela): Likewise. * sysdeps/powerpc/powerpc32/dl-machine.h (elf_machine_rela): Likewise. * sysdeps/powerpc/powerpc64/dl-machine.h (elf_machine_rela): Likewise. * sysdeps/riscv/dl-machine.h (elf_machine_rela): Likewise. * sysdeps/s390/s390-32/dl-machine.h (elf_machine_rela): Likewise. * sysdeps/s390/s390-64/dl-machine.h (elf_machine_rela): Likewise. * sysdeps/sh/dl-machine.h (elf_machine_rela): Likewise. * sysdeps/sparc/sparc32/dl-machine.h (elf_machine_rela): Likewise. * sysdeps/sparc/sparc64/dl-machine.h (elf_machine_rela): Likewise. * sysdeps/tile/dl-machine.h (elf_machine_rela): Likewise. * sysdeps/x86_64/dl-machine.h (elf_machine_rela): Likewise. Reviewed-by: Adhemerval Zanella <adhemerval.zanella@linaro.org>
* RISC-V: add remaining relocationsAndreas Schwab2018-03-261-12/+56
|
* Add $(tests-execstack-$(have-z-execstack)) after defined [BZ #22998]H.J. Lu2018-03-241-1/+2
| | | | | | | | | | When $(tests-execstack-$(have-z-execstack)) is added to tests before it is defined, it is empty. This patch adds it to tests after it is defined. [BZ #22998] * elf/Makefile (tests): Add $(tests-execstack-$(have-z-execstack)) after it is defined.
* Add SHT_X86_64_UNWIND to elf.h (bug 20079).Joseph Myers2018-03-191-0/+3
| | | | | | | | | | As requested in bug 20079, this patch adds SHT_X86_64_UNWIND (a standard value from the x86_64 ABI) to elf.h. Tested for x86_64. [BZ #20079] * elf/elf.h (SHT_X86_64_UNWIND): New macro.
* hurd: add gscope supportSamuel Thibault2018-03-111-0/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | * elf/dl-support.c [!THREAD_GSCOPE_IN_TCB] (_dl_thread_gscope_count): Define variable. * sysdeps/generic/ldsodefs.h [!THREAD_GSCOPE_IN_TCB] (struct rtld_global): Add _dl_thread_gscope_count member. * sysdeps/mach/hurd/tls.h: Include <atomic.h>. [!defined __ASSEMBLER__] (THREAD_GSCOPE_GLOBAL, THREAD_GSCOPE_SET_FLAG, THREAD_GSCOPE_RESET_FLAG, THREAD_GSCOPE_WAIT): Define macros. * sysdeps/generic/tls.h: Document THREAD_GSCOPE_IN_TCB. * sysdeps/aarch64/nptl/tls.h: Define THREAD_GSCOPE_IN_TCB to 1. * sysdeps/alpha/nptl/tls.h: Define THREAD_GSCOPE_IN_TCB to 1. * sysdeps/arm/nptl/tls.h: Define THREAD_GSCOPE_IN_TCB to 1. * sysdeps/hppa/nptl/tls.h: Define THREAD_GSCOPE_IN_TCB to 1. * sysdeps/i386/nptl/tls.h: Define THREAD_GSCOPE_IN_TCB to 1. * sysdeps/ia64/nptl/tls.h: Define THREAD_GSCOPE_IN_TCB to 1. * sysdeps/m68k/nptl/tls.h: Define THREAD_GSCOPE_IN_TCB to 1. * sysdeps/microblaze/nptl/tls.h: Define THREAD_GSCOPE_IN_TCB to 1. * sysdeps/mips/nptl/tls.h: Define THREAD_GSCOPE_IN_TCB to 1. * sysdeps/nios2/nptl/tls.h: Define THREAD_GSCOPE_IN_TCB to 1. * sysdeps/powerpc/nptl/tls.h: Define THREAD_GSCOPE_IN_TCB to 1. * sysdeps/riscv/nptl/tls.h: Define THREAD_GSCOPE_IN_TCB to 1. * sysdeps/s390/nptl/tls.h: Define THREAD_GSCOPE_IN_TCB to 1. * sysdeps/sh/nptl/tls.h: Define THREAD_GSCOPE_IN_TCB to 1. * sysdeps/sparc/nptl/tls.h: Define THREAD_GSCOPE_IN_TCB to 1. * sysdeps/tile/nptl/tls.h: Define THREAD_GSCOPE_IN_TCB to 1. * sysdeps/x86_64/nptl/tls.h: Define THREAD_GSCOPE_IN_TCB to 1.
* ldconfig: Sync temporary files to disk before renaming them [BZ #20890]Florian Weimer2018-02-211-3/+7
| | | | | | | If the system crashes before the file data has been written to disk, the file system recovery upon the next mount may restore a partially rewritten temporary file under the non-temporary (final) name (after the rename operation).
* elf: Remove ad-hoc restrictions on dlopen callers [BZ #22787]Florian Weimer2018-02-215-105/+1
| | | | | | | | | | | | | | | | | | | | | | This looks like a post-exploitation hardening measure: If an attacker is able to redirect execution flow, they could use that to load a DSO which contains additional code (or perhaps make the stack executable). However, the checks are not in the correct place to be effective: If they are performed before the critical operation, an attacker with sufficient control over execution flow could simply jump directly to the code which performs the operation, bypassing the check. The check would have to be executed unconditionally after the operation and terminate the process in case a caller violation was detected. Furthermore, in _dl_check_caller, there was a fallback reading global writable data (GL(dl_rtld_map).l_map_start and GL(dl_rtld_map).l_text_end), which could conceivably be targeted by an attacker to disable the check, too. Other critical functions (such as system) remain completely unprotected, so the value of these additional checks does not appear that large. Therefore this commit removes this functionality.
* Add elf.h NT_* macros from Linux 4.15 (bug 14890).Joseph Myers2018-02-061-0/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Linux 4.15 adds NT_S390_RI_CB to linux/elf.h (and NT_ARM_SVE, which we already have in glibc). This shows up that various other ELF note values from linux/elf.h are missing from glibc's elf.h. This patch adds the missing values that are relevant to glibc architectures. As elf.h is a general description of the ELF format, not necessarily limited to glibc configurations, there's an argument for having the remaining NT_* values that Linux uses for non-glibc architectures in glibc's elf.h as well, but this patch does not add them. Adding the NT_PRFPREG name is bug 14890. That bug also requests making the NT_FPREGSET name obsolete. Given that elf.h is not just for Linux but can describe ELF for other operating systems, I don't think that a change of name in the Linux kernel is sufficient justification for declaring the other name obsolete; there can be multiple names for the same note value, even with incompatible semantics, if those reflect variants of the ELF format in actual use. For example, FreeBSD appears still to have the name NT_FPREGSET <https://github.com/freebsd/freebsd/blob/master/sys/sys/elf_common.h> (note: I haven't checked whether the FreeBSD kernel actually generates such notes or whether this is actually an other-OS definition present in FreeBSD's header). [BZ #14890] * elf/elf.h (NT_PRFPREG): New macro. (NT_S390_VXRS_LOW): Likewise. (NT_S390_VXRS_HIGH): Likewise. (NT_S390_GS_CB): Likewise. (NT_S390_GS_BC): Likewise. (NT_S390_RI_CB): Likewise.
* Use ADDRIDX with DT_GNU_HASHH.J. Lu2018-02-053-10/+4
| | | | | | | | | | The only differences in ld.so are line numbers for asserts. Reviewed-by: Jonathan Nieder <jrnieder@gmail.com> * elf/dl-addr.c (determine_info): Use ADDRIDX with DT_GNU_HASH. * elf/dl-lookup.c (_dl_setup_hash): Likewise. * elf/get-dynamic-info.h (elf_get_dynamic_info): Likewise.
* Add DT_SYMTAB_SHNDX from gABIH.J. Lu2018-02-051-1/+2
| | | | | * elf/elf.h (DT_SYMTAB_SHNDX): New. Set to 34. (DT_NUM): Updated to 35.
* Add support for the RISC-V-specific ELF flagsPalmer Dabbelt2018-01-252-0/+14
| | | | | | | | | | | | | | | | | | | | The RISC-V port defines ELF flags that enforce compatibility between various objects. This adds the shared support necessary for these flags. 2018-01-25 Palmer Dabbelt <palmer@sifive.com> * elf/cache.c (print_entry): Add FLAG_RISCV_FLOAT_ABI_SOFT and FLAG_RISCV_FLOAT_ABI_DOUBLE. * elf/elf.h (EF_RISCV_RVC): New define. (EF_RISCV_FLOAT_ABI): Likewise. (EF_RISCV_FLOAT_ABI_SOFT): Likewise. (EF_RISCV_FLOAT_ABI_SINGLE): Likewise. (EF_RISCV_FLOAT_ABI_DOUBLE): Likewise. (EF_RISCV_FLOAT_ABI_QUAD): Likewise. * sysdeps/generic/ldconfig.h (FLAG_RISCV_FLOAT_ABI_SOFT): New define. (FLAG_RISCV_FLOAT_ABI_DOUBLE): Likewise.
* Add NT_ARM_SVE to elf.hAlan Hayward2018-01-151-0/+2
| | | | | | This definition is for AArch64 SVE registers in elf core dumps. * elf/elf.h (NT_ARM_SVE): Define.
* Synchronize DF_1_* flags with binutils (Bug 22707)Carlos O'Donell2018-01-131-0/+2
| | | | | | | | | | This patch synchronizes DF_1_* flags with binutils and ensures that all DF_1_* flags defined in binutil's include/elf/common.h are also defined glibc's elf/elf.h. This is a user visible change since elf/elf.h is installed by default as /usr/include/elf.h. Signed-off-by: Carlos O'Donell <carlos@redhat.com>
* Add RISC-V dynamic relocations to elf.hPalmer Dabbelt2018-01-061-0/+14
| | | | | | | | | | | | | | | | | | | These relocations can appear in shared objects on RISC-V ELF systems. 2018-01-06 Palmer Dabbelt <palmer@sifive.com> * elf/elf.h (R_RISCV_NONE): New define. (R_RISCV_32): Likewise. (R_RISCV_64): Likewise. (R_RISCV_RELATIVE): Likewise. (R_RISCV_COPY): Likewise. (R_RISCV_JUMP_SLOT): Likewise. (R_RISCV_TLS_DTPMOD32): Likewise. (R_RISCV_TLS_DTPMOD64): Likewise. (R_RISCV_TLS_DTPREL32): Likewise. (R_RISCV_TLS_DTPREL64): Likewise. (R_RISCV_TLS_TPREL32): Likewise. (R_RISCV_TLS_TPREL64): Likewise.
* elf: Support dlvsym within libc.soFlorian Weimer2018-01-047-6/+303
| | | | | | | | | | This commit adds a new _dl_open_hook entry for dlvsym and implements the function using the existing dl_lookup_symbol_x function supplied by the dynamic loader. A new hook variable, _dl_open_hook2, is introduced, which should make this change suitable for backporting: For old statically linked binaries, __libc_dlvsym will always return NULL.
* elf: check for rpath emptiness before making a copy of itDmitry V. Levin2018-01-011-10/+8
| | | | | * elf/dl-load.c (decompose_rpath): Check for rpath emptiness before making a copy of it.
* Update copyright dates not handled by scripts/update-copyrights.Joseph Myers2018-01-015-5/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | I've updated copyright dates in glibc for 2018. This is the patch for the changes not generated by scripts/update-copyrights and subsequent build / regeneration of generated files. Please remember to include 2018 in the dates for any new files added in future (which means updating any existing uncommitted patches you have that add new files to use the new copyright dates in them). * NEWS: Update copyright dates. * catgets/gencat.c (print_version): Likewise. * csu/version.c (banner): Likewise. * debug/catchsegv.sh: Likewise. * debug/pcprofiledump.c (print_version): Likewise. * debug/xtrace.sh (do_version): Likewise. * elf/ldconfig.c (print_version): Likewise. * elf/ldd.bash.in: Likewise. * elf/pldd.c (print_version): Likewise. * elf/sotruss.sh: Likewise. * elf/sprof.c (print_version): Likewise. * iconv/iconv_prog.c (print_version): Likewise. * iconv/iconvconfig.c (print_version): Likewise. * locale/programs/locale.c (print_version): Likewise. * locale/programs/localedef.c (print_version): Likewise. * login/programs/pt_chown.c (print_version): Likewise. * malloc/memusage.sh (do_version): Likewise. * malloc/memusagestat.c (print_version): Likewise. * malloc/mtrace.pl: Likewise. * manual/libc.texinfo: Likewise. * nptl/version.c (banner): Likewise. * nscd/nscd.c (print_version): Likewise. * nss/getent.c (print_version): Likewise. * nss/makedb.c (print_version): Likewise. * posix/getconf.c (main): Likewise. * scripts/test-installation.pl: Likewise. * sysdeps/unix/sysv/linux/lddlibc4.c (main): Likewise.
* Update copyright dates with scripts/update-copyrights.Joseph Myers2018-01-01139-139/+139
| | | | | | | * All files with FSF copyright notices: Update copyright dates using scripts/update-copyrights. * locale/programs/charmap-kw.h: Regenerated. * locale/programs/locfile-kw.h: Likewise.
* elf: Check for empty tokens before dynamic string token expansion [BZ #22625]Aurelien Jarno2017-12-301-16/+33
| | | | | | | | | | | | | | | | | | | | | | | | | The fillin_rpath function in elf/dl-load.c loops over each RPATH or RUNPATH tokens and interprets empty tokens as the current directory ("./"). In practice the check for empty token is done *after* the dynamic string token expansion. The expansion process can return an empty string for the $ORIGIN token if __libc_enable_secure is set or if the path of the binary can not be determined (/proc not mounted). Fix that by moving the check for empty tokens before the dynamic string token expansion. In addition, check for NULL pointer or empty strings return by expand_dynamic_string_token. The above changes highlighted a bug in decompose_rpath, an empty array is represented by the first element being NULL at the fillin_rpath level, but by using a -1 pointer in decompose_rpath and other functions. Changelog: [BZ #22625] * elf/dl-load.c (fillin_rpath): Check for empty tokens before dynamic string token expansion. Check for NULL pointer or empty string possibly returned by expand_dynamic_string_token. (decompose_rpath): Check for empty path after dynamic string token expansion.
* elf: remove redundant is_path argumentDmitry V. Levin2017-12-273-22/+18
| | | | | | | | | | | is_path argument is no longer used and could be safely removed. * elf/dl-dst.h (DL_DST_COUNT): Remove is_path argument, all callers updated. * elf/dl-load.c (is_dst, _dl_dst_count, _dl_dst_substitute, expand_dynamic_string_token): Likewise. * sysdeps/generic/ldsodefs.h (_dl_dst_count, _dl_dst_substitute): Remove is_path argument.
* elf: remove redundant code from is_dstDmitry V. Levin2017-12-271-5/+3
| | | | | | | | | | | | | | | | | is_dst is called either by _dl_dst_count or by _dl_dst_substitute. _dl_dst_count is called by DL_DST_COUNT only. DL_DST_COUNT is called either by expand_dst with is_path == 0 or by expand_dynamic_string_token. _dl_dst_substitute is called either from expand_dst with is_path == 0 or from expand_dynamic_string_token. The latter function is called either from _dl_map_object with is_path == 0 or from fillin_rpath with is_path == 1 and name containing no ':'. In any case (is_path && name[i] == ':') is always false and all code depending on it can be safely removed. * elf/dl-load.c (is_dst): Remove checks that is_path is set and name contains ':', and all code depending on these checks.
* elf: remove redundant code from _dl_dst_substituteDmitry V. Levin2017-12-271-20/+1
| | | | | | | | | | | | | | There are just two users of _dl_dst_substitute: one is expand_dst that sets is_path argument to 0, another one is expand_dynamic_string_token. The latter function also has just two users: one is _dl_map_object that sets is_path argument to 0, another one is fillin_rpath that sets is_path argument to 1 and name argument contains no ':'. In any case (is_path && name[i] == ':') is always false and all code depending on it can be safely removed. * elf/dl-load.c (_dl_dst_substitute): Remove checks that is_path is set and name contains ':', and all code depending on these checks.
* elf: remove redundant __libc_enable_secure check from fillin_rpathDmitry V. Levin2017-12-191-30/+3
| | | | | | | | | | | | | | | | There are just two users of fillin_rpath: one is decompose_rpath that sets check_trusted argument to 0, another one is _dl_init_paths that sets check_trusted argument to __libc_enable_secure and invokes fillin_rpath only when LD_LIBRARY_PATH is non-empty. Starting with commit glibc-2.25.90-512-gf6110a8fee2ca36f8e2d2abecf3cba9fa7b8ea7d, LD_LIBRARY_PATH is ignored for __libc_enable_secure executables, so check_trusted argument of fillin_rpath is always zero. * elf/dl-load.c (is_trusted_path): Remove. (fillin_rpath): Remove check_trusted argument and its use, all callers changed.
* Replece LDFLAGS-* = $(no-pie-ldflag) with tst-*-no-pie = yes [BZ #22630]H.J. Lu2017-12-191-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | After commit 9d7a3741c9e59eba87fb3ca6b9f979befce07826 Author: H.J. Lu <hjl.tools@gmail.com> Date: Fri Dec 15 16:59:33 2017 -0800 Add --enable-static-pie configure option to build static PIE [BZ #19574] and commit 00c714df398b63934540d95ce3792596f7a94a6c Author: H.J. Lu <hjl.tools@gmail.com> Date: Mon Dec 18 12:24:26 2017 -0800 Pass -no-pie to GCC only if GCC defaults to PIE [BZ #22614] $(no-pie-ldflag) is no longer effective since no-pie-ldflag is defined to -no-pie only if GCC defaults to PIE. When --enable-static-pie is used to configure glibc build and GCC doesn't default to PIE. no-pie-ldflag is undefined and these tests: elf/Makefile:LDFLAGS-tst-dlopen-aout = $(no-pie-ldflag) elf/Makefile:LDFLAGS-tst-prelink = $(no-pie-ldflag) elf/Makefile:LDFLAGS-tst-main1 = $(no-pie-ldflag) gmon/Makefile:LDFLAGS-tst-gmon := $(no-pie-ldflag) may fail to link. This patch replaces "-pie" with $(if $($(@F)-no-pie),$(no-pie-ldflag),-pie) and repleces LDFLAGS-* = $(no-pie-ldflag) with tst-*-no-pie = yes so that tst-dlopen-aout, tst-prelink, tst-main1 and tst-gmon are always built as non-PIE, with and without --enable-static-pie, regardless if GCC defaults to PIE or non-PIE. Tested with build-many-glibcs.py without --enable-static-pie as well as with --enable-static-pie for x86_64, x32 and i686. [BZ #22630] * Makeconfig (link-pie-before-libc): Replace -pie with $(if $($(@F)-no-pie),$(no-pie-ldflag),-pie). * elf/Makefile (LDFLAGS-tst-dlopen-aout): Removed. (tst-dlopen-aout-no-pie): New. (LDFLAGS-tst-prelink): Removed. (tst-prelink-no-pie): New. (LDFLAGS-tst-main1): Removed. (tst-main1-no-pie): New. * gmon/Makefile (LDFLAGS-tst-gmon): Removed. (tst-gmon-no-pie): New.
* ld.so: Examine GLRO to detect inactive loader [BZ #20204]Florian Weimer2017-12-182-4/+6
| | | | | | | | | | | | GLRO (_rtld_global_ro) is read-only after initialization and can therefore not be patched at run time, unlike the hook table addresses and their contents, so this is a desirable hardening feature. The hooks are only needed if ld.so has not been initialized, and this happens only after static dlopen (dlmopen uses a single ld.so object across all namespaces). Reviewed-by: Carlos O'Donell <carlos@redhat.com>
* elf: do not substitute dst in $LD_LIBRARY_PATH twice [BZ #22627]Dmitry V. Levin2017-12-181-19/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | Starting with commit glibc-2.18.90-470-g2a939a7e6d81f109d49306bc2e10b4ac9ceed8f9 that introduced substitution of dynamic string tokens in fillin_rpath, _dl_init_paths invokes _dl_dst_substitute for $LD_LIBRARY_PATH twice: the first time it's called directly, the second time the result is passed on to fillin_rpath which calls expand_dynamic_string_token which in turn calls _dl_dst_substitute, leading to the following behaviour: $ mkdir -p /tmp/'$ORIGIN' && cd /tmp/'$ORIGIN' && echo 'int main(){}' |gcc -xc - && strace -qq -E LD_LIBRARY_PATH='$ORIGIN' -e /open ./a.out open("/tmp//tmp/$ORIGIN/tls/x86_64/libc.so.6", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) open("/tmp//tmp/$ORIGIN/tls/libc.so.6", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) open("/tmp//tmp/$ORIGIN/x86_64/libc.so.6", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) open("/tmp//tmp/$ORIGIN/libc.so.6", O_RDONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) open("/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3 open("/lib64/libc.so.6", O_RDONLY|O_CLOEXEC) = 3 Fix this by removing the direct _dl_dst_substitute invocation. * elf/dl-load.c (_dl_init_paths): Remove _dl_dst_substitute preparatory code and invocation.
* ldconfig: set LC_COLLATE to C [BZ #22505]Aurelien Jarno2017-12-161-0/+4
| | | | | | | | | | | | | | | | | | | | | ldconfig supports `include' directives and use the glob function to process them. The glob function sort entries according to the LC_COLLATE category. When using a standard "include /etc/ld.so.conf.d/*.conf" entry in /etc/ld.so.conf, the order therefore depends on the locale used to run ldconfig. A few examples of locale specific order that might be disturbing in that context compared to the C locale: - The cs_CZ and sk_SK locales sort the digits after the letters. - The et_EE locale sorts the 'z' between 's' and 't'. This patch fixes that by setting LC_COLLATE to C in order to process files in deterministic order, independently of the locale used to launch ldconfig. NOTE: This should NOT be backported to older release branches. Changelog: [BZ #22505] * elf/ldconfig.c (main): Call setlocale to force LC_COLLATE to C.
generated by cgit-pink 1.4.1 (git 2.36.1) at 2024-11-22 01:19:10 +0000