elf/dl-runtime.c

   1 /* On-demand PLT fixup for shared objects.
   2    Copyright (C) 1995-2021 Free Software Foundation, Inc.
   3    This file is part of the GNU C Library.
   4
   5    The GNU C Library is free software; you can redistribute it and/or
   6    modify it under the terms of the GNU Lesser General Public
   7    License as published by the Free Software Foundation; either
   8    version 2.1 of the License, or (at your option) any later version.
   9
  10    The GNU C Library is distributed in the hope that it will be useful,
  11    but WITHOUT ANY WARRANTY; without even the implied warranty of
  12    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  13    Lesser General Public License for more details.
  14
  15    You should have received a copy of the GNU Lesser General Public
  16    License along with the GNU C Library; if not, see
  17    <https://www.gnu.org/licenses/>.  */
  18
  19 #define IN_DL_RUNTIME 1         /* This can be tested in dl-machine.h.  */
  20
  21 #include <alloca.h>
  22 #include <assert.h>
  23 #include <stdlib.h>
  24 #include <unistd.h>
  25 #include <sys/param.h>
  26 #include <ldsodefs.h>
  27 #include <sysdep-cancel.h>
  28 #include "dynamic-link.h"
  29 #include <tls.h>
  30 #include <dl-irel.h>
  31 #include <dl-runtime.h>
  32
  33
  34 #if (!ELF_MACHINE_NO_RELA && !defined ELF_MACHINE_PLT_REL) \
  35     || ELF_MACHINE_NO_REL
  36 # define PLTREL  ElfW(Rela)
  37 #else
  38 # define PLTREL  ElfW(Rel)
  39 #endif
  40
  41 /* The fixup functions might have need special attributes.  If none
  42    are provided define the macro as empty.  */
  43 #ifndef ARCH_FIXUP_ATTRIBUTE
  44 # define ARCH_FIXUP_ATTRIBUTE
  45 #endif
  46
  47 /* This function is called through a special trampoline from the PLT the
  48    first time each PLT entry is called.  We must perform the relocation
  49    specified in the PLT of the given shared object, and return the resolved
  50    function address to the trampoline, which will restart the original call
  51    to that address.  Future calls will bounce directly from the PLT to the
  52    function.  */
  53
  54 DL_FIXUP_VALUE_TYPE
  55 attribute_hidden __attribute ((noinline)) ARCH_FIXUP_ATTRIBUTE
  56 _dl_fixup (
  57 # ifdef ELF_MACHINE_RUNTIME_FIXUP_ARGS
  58            ELF_MACHINE_RUNTIME_FIXUP_ARGS,
  59 # endif
  60            struct link_map *l, ElfW(Word) reloc_arg)
  61 {
  62   const ElfW(Sym) *const symtab
  63     = (const void *) D_PTR (l, l_info[DT_SYMTAB]);
  64   const char *strtab = (const void *) D_PTR (l, l_info[DT_STRTAB]);
  65
  66   const uintptr_t pltgot = (uintptr_t) D_PTR (l, l_info[DT_PLTGOT]);
  67
  68   const PLTREL *const reloc
  69     = (const void *) (D_PTR (l, l_info[DT_JMPREL])
  70                       + reloc_offset (pltgot, reloc_arg));
  71   const ElfW(Sym) *sym = &symtab[ELFW(R_SYM) (reloc->r_info)];
  72   const ElfW(Sym) *refsym = sym;
  73   void *const rel_addr = (void *)(l->l_addr + reloc->r_offset);
  74   lookup_t result;
  75   DL_FIXUP_VALUE_TYPE value;
  76
  77   /* Sanity check that we're really looking at a PLT relocation.  */
  78   assert (ELFW(R_TYPE)(reloc->r_info) == ELF_MACHINE_JMP_SLOT);
  79
  80    /* Look up the target symbol.  If the normal lookup rules are not
  81       used don't look in the global scope.  */
  82   if (__builtin_expect (ELFW(ST_VISIBILITY) (sym->st_other), 0) == 0)
  83     {
  84       const struct r_found_version *version = NULL;
  85
  86       if (l->l_info[VERSYMIDX (DT_VERSYM)] != NULL)
  87         {
  88           const ElfW(Half) *vernum =
  89             (const void *) D_PTR (l, l_info[VERSYMIDX (DT_VERSYM)]);
  90           ElfW(Half) ndx = vernum[ELFW(R_SYM) (reloc->r_info)] & 0x7fff;
  91           version = &l->l_versions[ndx];
  92           if (version->hash == 0)
  93             version = NULL;
  94         }
  95
  96       /* We need to keep the scope around so do some locking.  This is
  97          not necessary for objects which cannot be unloaded or when
  98          we are not using any threads (yet).  */
  99       int flags = DL_LOOKUP_ADD_DEPENDENCY;
 100       if (!RTLD_SINGLE_THREAD_P)
 101         {
 102           THREAD_GSCOPE_SET_FLAG ();
 103           flags |= DL_LOOKUP_GSCOPE_LOCK;
 104         }
 105
 106 #ifdef RTLD_ENABLE_FOREIGN_CALL
 107       RTLD_ENABLE_FOREIGN_CALL;
 108 #endif
 109
 110       result = _dl_lookup_symbol_x (strtab + sym->st_name, l, &sym, l->l_scope,
 111                                     version, ELF_RTYPE_CLASS_PLT, flags, NULL);
 112
 113       /* We are done with the global scope.  */
 114       if (!RTLD_SINGLE_THREAD_P)
 115         THREAD_GSCOPE_RESET_FLAG ();
 116
 117 #ifdef RTLD_FINALIZE_FOREIGN_CALL
 118       RTLD_FINALIZE_FOREIGN_CALL;
 119 #endif
 120
 121       /* Currently result contains the base load address (or link map)
 122          of the object that defines sym.  Now add in the symbol
 123          offset.  */
 124       value = DL_FIXUP_MAKE_VALUE (result,
 125                                    SYMBOL_ADDRESS (result, sym, false));
 126     }
 127   else
 128     {
 129       /* We already found the symbol.  The module (and therefore its load
 130          address) is also known.  */
 131       value = DL_FIXUP_MAKE_VALUE (l, SYMBOL_ADDRESS (l, sym, true));
 132       result = l;
 133     }
 134
 135   /* And now perhaps the relocation addend.  */
 136   value = elf_machine_plt_value (l, reloc, value);
 137
 138   if (sym != NULL
 139       && __builtin_expect (ELFW(ST_TYPE) (sym->st_info) == STT_GNU_IFUNC, 0))
 140     value = elf_ifunc_invoke (DL_FIXUP_VALUE_ADDR (value));
 141
 142   /* Finally, fix up the plt itself.  */
 143   if (__glibc_unlikely (GLRO(dl_bind_not)))
 144     return value;
 145
 146   return elf_machine_fixup_plt (l, result, refsym, sym, reloc, rel_addr, value);
 147 }
 148
 149 #ifndef PROF
 150 DL_FIXUP_VALUE_TYPE
 151 __attribute ((noinline)) ARCH_FIXUP_ATTRIBUTE
 152 _dl_profile_fixup (
 153 #ifdef ELF_MACHINE_RUNTIME_FIXUP_ARGS
 154                    ELF_MACHINE_RUNTIME_FIXUP_ARGS,
 155 #endif
 156                    struct link_map *l, ElfW(Word) reloc_arg,
 157                    ElfW(Addr) retaddr, void *regs, long int *framesizep)
 158 {
 159   void (*mcount_fct) (ElfW(Addr), ElfW(Addr)) = _dl_mcount;
 160
 161   if (l->l_reloc_result == NULL)
 162     {
 163       /* BZ #14843: ELF_DYNAMIC_RELOCATE is called before l_reloc_result
 164          is allocated.  We will get here if ELF_DYNAMIC_RELOCATE calls a
 165          resolver function to resolve an IRELATIVE relocation and that
 166          resolver calls a function that is not yet resolved (lazy).  For
 167          example, the resolver in x86-64 libm.so calls __get_cpu_features
 168          defined in libc.so.  Skip audit and resolve the external function
 169          in this case.  */
 170       *framesizep = -1;
 171       return _dl_fixup (
 172 # ifdef ELF_MACHINE_RUNTIME_FIXUP_ARGS
 173 #  ifndef ELF_MACHINE_RUNTIME_FIXUP_PARAMS
 174 #   error Please define ELF_MACHINE_RUNTIME_FIXUP_PARAMS.
 175 #  endif
 176                         ELF_MACHINE_RUNTIME_FIXUP_PARAMS,
 177 # endif
 178                         l, reloc_arg);
 179     }
 180
 181   const uintptr_t pltgot = (uintptr_t) D_PTR (l, l_info[DT_PLTGOT]);
 182
 183   /* This is the address in the array where we store the result of previous
 184      relocations.  */
 185   struct reloc_result *reloc_result
 186     = &l->l_reloc_result[reloc_index (pltgot, reloc_arg, sizeof (PLTREL))];
 187
 188  /* CONCURRENCY NOTES:
 189
 190   Multiple threads may be calling the same PLT sequence and with
 191   LD_AUDIT enabled they will be calling into _dl_profile_fixup to
 192   update the reloc_result with the result of the lazy resolution.
 193   The reloc_result guard variable is reloc_init, and we use
 194   acquire/release loads and store to it to ensure that the results of
 195   the structure are consistent with the loaded value of the guard.
 196   This does not fix all of the data races that occur when two or more
 197   threads read reloc_result->reloc_init with a value of zero and read
 198   and write to that reloc_result concurrently.  The expectation is
 199   generally that while this is a data race it works because the
 200   threads write the same values.  Until the data races are fixed
 201   there is a potential for problems to arise from these data races.
 202   The reloc result updates should happen in parallel but there should
 203   be an atomic RMW which does the final update to the real result
 204   entry (see bug 23790).
 205
 206   The following code uses reloc_result->init set to 0 to indicate if it is
 207   the first time this object is being relocated, otherwise 1 which
 208   indicates the object has already been relocated.
 209
 210   Reading/Writing from/to reloc_result->reloc_init must not happen
 211   before previous writes to reloc_result complete as they could
 212   end-up with an incomplete struct.  */
 213   DL_FIXUP_VALUE_TYPE value;
 214   unsigned int init = atomic_load_acquire (&reloc_result->init);
 215
 216   if (init == 0)
 217     {
 218       /* This is the first time we have to relocate this object.  */
 219       const ElfW(Sym) *const symtab
 220         = (const void *) D_PTR (l, l_info[DT_SYMTAB]);
 221       const char *strtab = (const char *) D_PTR (l, l_info[DT_STRTAB]);
 222
 223       const uintptr_t pltgot = (uintptr_t) D_PTR (l, l_info[DT_PLTGOT]);
 224
 225       const PLTREL *const reloc
 226         = (const void *) (D_PTR (l, l_info[DT_JMPREL])
 227                           + reloc_offset (pltgot, reloc_arg));
 228       const ElfW(Sym) *refsym = &symtab[ELFW(R_SYM) (reloc->r_info)];
 229       const ElfW(Sym) *defsym = refsym;
 230       lookup_t result;
 231
 232       /* Sanity check that we're really looking at a PLT relocation.  */
 233       assert (ELFW(R_TYPE)(reloc->r_info) == ELF_MACHINE_JMP_SLOT);
 234
 235       /* Look up the target symbol.  If the symbol is marked STV_PROTECTED
 236          don't look in the global scope.  */
 237       if (__builtin_expect (ELFW(ST_VISIBILITY) (refsym->st_other), 0) == 0)
 238         {
 239           const struct r_found_version *version = NULL;
 240
 241           if (l->l_info[VERSYMIDX (DT_VERSYM)] != NULL)
 242             {
 243               const ElfW(Half) *vernum =
 244                 (const void *) D_PTR (l, l_info[VERSYMIDX (DT_VERSYM)]);
 245               ElfW(Half) ndx = vernum[ELFW(R_SYM) (reloc->r_info)] & 0x7fff;
 246               version = &l->l_versions[ndx];
 247               if (version->hash == 0)
 248                 version = NULL;
 249             }
 250
 251           /* We need to keep the scope around so do some locking.  This is
 252              not necessary for objects which cannot be unloaded or when
 253              we are not using any threads (yet).  */
 254           int flags = DL_LOOKUP_ADD_DEPENDENCY;
 255           if (!RTLD_SINGLE_THREAD_P)
 256             {
 257               THREAD_GSCOPE_SET_FLAG ();
 258               flags |= DL_LOOKUP_GSCOPE_LOCK;
 259             }
 260
 261           result = _dl_lookup_symbol_x (strtab + refsym->st_name, l,
 262                                         &defsym, l->l_scope, version,
 263                                         ELF_RTYPE_CLASS_PLT, flags, NULL);
 264
 265           /* We are done with the global scope.  */
 266           if (!RTLD_SINGLE_THREAD_P)
 267             THREAD_GSCOPE_RESET_FLAG ();
 268
 269           /* Currently result contains the base load address (or link map)
 270              of the object that defines sym.  Now add in the symbol
 271              offset.  */
 272           value = DL_FIXUP_MAKE_VALUE (result,
 273                                        SYMBOL_ADDRESS (result, defsym, false));
 274
 275           if (defsym != NULL
 276               && __builtin_expect (ELFW(ST_TYPE) (defsym->st_info)
 277                                    == STT_GNU_IFUNC, 0))
 278             value = elf_ifunc_invoke (DL_FIXUP_VALUE_ADDR (value));
 279         }
 280       else
 281         {
 282           /* We already found the symbol.  The module (and therefore its load
 283              address) is also known.  */
 284           value = DL_FIXUP_MAKE_VALUE (l, SYMBOL_ADDRESS (l, refsym, true));
 285
 286           if (__builtin_expect (ELFW(ST_TYPE) (refsym->st_info)
 287                                 == STT_GNU_IFUNC, 0))
 288             value = elf_ifunc_invoke (DL_FIXUP_VALUE_ADDR (value));
 289
 290           result = l;
 291         }
 292       /* And now perhaps the relocation addend.  */
 293       value = elf_machine_plt_value (l, reloc, value);
 294
 295 #ifdef SHARED
 296       /* Auditing checkpoint: we have a new binding.  Provide the
 297          auditing libraries the possibility to change the value and
 298          tell us whether further auditing is wanted.  */
 299       if (defsym != NULL && GLRO(dl_naudit) > 0)
 300         {
 301           reloc_result->bound = result;
 302           /* Compute index of the symbol entry in the symbol table of
 303              the DSO with the definition.  */
 304           reloc_result->boundndx = (defsym
 305                                     - (ElfW(Sym) *) D_PTR (result,
 306                                                            l_info[DT_SYMTAB]));
 307
 308           /* Determine whether any of the two participating DSOs is
 309              interested in auditing.  */
 310           if ((l->l_audit_any_plt | result->l_audit_any_plt) != 0)
 311             {
 312               unsigned int flags = 0;
 313               struct audit_ifaces *afct = GLRO(dl_audit);
 314               /* Synthesize a symbol record where the st_value field is
 315                  the result.  */
 316               ElfW(Sym) sym = *defsym;
 317               sym.st_value = DL_FIXUP_VALUE_ADDR (value);
 318
 319               /* Keep track whether there is any interest in tracing
 320                  the call in the lower two bits.  */
 321               assert (DL_NNS * 2 <= sizeof (reloc_result->flags) * 8);
 322               assert ((LA_SYMB_NOPLTENTER | LA_SYMB_NOPLTEXIT) == 3);
 323               reloc_result->enterexit = LA_SYMB_NOPLTENTER | LA_SYMB_NOPLTEXIT;
 324
 325               const char *strtab2 = (const void *) D_PTR (result,
 326                                                           l_info[DT_STRTAB]);
 327
 328               for (unsigned int cnt = 0; cnt < GLRO(dl_naudit); ++cnt)
 329                 {
 330                   /* XXX Check whether both DSOs must request action or
 331                      only one */
 332                   struct auditstate *l_state = link_map_audit_state (l, cnt);
 333                   struct auditstate *result_state
 334                     = link_map_audit_state (result, cnt);
 335                   if ((l_state->bindflags & LA_FLG_BINDFROM) != 0
 336                       && (result_state->bindflags & LA_FLG_BINDTO) != 0)
 337                     {
 338                       if (afct->symbind != NULL)
 339                         {
 340                           uintptr_t new_value
 341                             = afct->symbind (&sym, reloc_result->boundndx,
 342                                              &l_state->cookie,
 343                                              &result_state->cookie,
 344                                              &flags,
 345                                              strtab2 + defsym->st_name);
 346                           if (new_value != (uintptr_t) sym.st_value)
 347                             {
 348                               flags |= LA_SYMB_ALTVALUE;
 349                               sym.st_value = new_value;
 350                             }
 351                         }
 352
 353                       /* Remember the results for every audit library and
 354                          store a summary in the first two bits.  */
 355                       reloc_result->enterexit
 356                         &= flags & (LA_SYMB_NOPLTENTER | LA_SYMB_NOPLTEXIT);
 357                       reloc_result->enterexit
 358                         |= ((flags & (LA_SYMB_NOPLTENTER | LA_SYMB_NOPLTEXIT))
 359                             << ((cnt + 1) * 2));
 360                     }
 361                   else
 362                     /* If the bind flags say this auditor is not interested,
 363                        set the bits manually.  */
 364                     reloc_result->enterexit
 365                       |= ((LA_SYMB_NOPLTENTER | LA_SYMB_NOPLTEXIT)
 366                           << ((cnt + 1) * 2));
 367
 368                   afct = afct->next;
 369                 }
 370
 371               reloc_result->flags = flags;
 372               value = DL_FIXUP_ADDR_VALUE (sym.st_value);
 373             }
 374           else
 375             /* Set all bits since this symbol binding is not interesting.  */
 376             reloc_result->enterexit = (1u << DL_NNS) - 1;
 377         }
 378 #endif
 379
 380       /* Store the result for later runs.  */
 381       if (__glibc_likely (! GLRO(dl_bind_not)))
 382         {
 383           reloc_result->addr = value;
 384           /* Guarantee all previous writes complete before
 385              init is updated.  See CONCURRENCY NOTES earlier  */
 386           atomic_store_release (&reloc_result->init, 1);
 387         }
 388       init = 1;
 389     }
 390   else
 391     value = reloc_result->addr;
 392
 393   /* By default we do not call the pltexit function.  */
 394   long int framesize = -1;
 395
 396
 397 #ifdef SHARED
 398   /* Auditing checkpoint: report the PLT entering and allow the
 399      auditors to change the value.  */
 400   if (GLRO(dl_naudit) > 0
 401       /* Don't do anything if no auditor wants to intercept this call.  */
 402       && (reloc_result->enterexit & LA_SYMB_NOPLTENTER) == 0)
 403     {
 404       /* Sanity check:  DL_FIXUP_VALUE_CODE_ADDR (value) should have been
 405          initialized earlier in this function or in another thread.  */
 406       assert (DL_FIXUP_VALUE_CODE_ADDR (value) != 0);
 407       ElfW(Sym) *defsym = ((ElfW(Sym) *) D_PTR (reloc_result->bound,
 408                                                 l_info[DT_SYMTAB])
 409                            + reloc_result->boundndx);
 410
 411       /* Set up the sym parameter.  */
 412       ElfW(Sym) sym = *defsym;
 413       sym.st_value = DL_FIXUP_VALUE_ADDR (value);
 414
 415       /* Get the symbol name.  */
 416       const char *strtab = (const void *) D_PTR (reloc_result->bound,
 417                                                  l_info[DT_STRTAB]);
 418       const char *symname = strtab + sym.st_name;
 419
 420       /* Keep track of overwritten addresses.  */
 421       unsigned int flags = reloc_result->flags;
 422
 423       struct audit_ifaces *afct = GLRO(dl_audit);
 424       for (unsigned int cnt = 0; cnt < GLRO(dl_naudit); ++cnt)
 425         {
 426           if (afct->ARCH_LA_PLTENTER != NULL
 427               && (reloc_result->enterexit
 428                   & (LA_SYMB_NOPLTENTER << (2 * (cnt + 1)))) == 0)
 429             {
 430               long int new_framesize = -1;
 431               struct auditstate *l_state = link_map_audit_state (l, cnt);
 432               struct auditstate *bound_state
 433                 = link_map_audit_state (reloc_result->bound, cnt);
 434               uintptr_t new_value
 435                 = afct->ARCH_LA_PLTENTER (&sym, reloc_result->boundndx,
 436                                           &l_state->cookie,
 437                                           &bound_state->cookie,
 438                                           regs, &flags, symname,
 439                                           &new_framesize);
 440               if (new_value != (uintptr_t) sym.st_value)
 441                 {
 442                   flags |= LA_SYMB_ALTVALUE;
 443                   sym.st_value = new_value;
 444                 }
 445
 446               /* Remember the results for every audit library and
 447                  store a summary in the first two bits.  */
 448               reloc_result->enterexit
 449                 |= ((flags & (LA_SYMB_NOPLTENTER | LA_SYMB_NOPLTEXIT))
 450                     << (2 * (cnt + 1)));
 451
 452               if ((reloc_result->enterexit & (LA_SYMB_NOPLTEXIT
 453                                               << (2 * (cnt + 1))))
 454                   == 0 && new_framesize != -1 && framesize != -2)
 455                 {
 456                   /* If this is the first call providing information,
 457                      use it.  */
 458                   if (framesize == -1)
 459                     framesize = new_framesize;
 460                   /* If two pltenter calls provide conflicting information,
 461                      use the larger value.  */
 462                   else if (new_framesize != framesize)
 463                     framesize = MAX (new_framesize, framesize);
 464                 }
 465             }
 466
 467           afct = afct->next;
 468         }
 469
 470       value = DL_FIXUP_ADDR_VALUE (sym.st_value);
 471     }
 472 #endif
 473
 474   /* Store the frame size information.  */
 475   *framesizep = framesize;
 476
 477   (*mcount_fct) (retaddr, DL_FIXUP_VALUE_CODE_ADDR (value));
 478
 479   return value;
 480 }
 481
 482 #endif /* PROF */
 483
 484
 485 #include <stdio.h>
 486 void
 487 ARCH_FIXUP_ATTRIBUTE
 488 _dl_call_pltexit (struct link_map *l, ElfW(Word) reloc_arg,
 489                   const void *inregs, void *outregs)
 490 {
 491 #ifdef SHARED
 492   const uintptr_t pltgot = (uintptr_t) D_PTR (l, l_info[DT_PLTGOT]);
 493
 494   /* This is the address in the array where we store the result of previous
 495      relocations.  */
 496   // XXX Maybe the bound information must be stored on the stack since
 497   // XXX with bind_not a new value could have been stored in the meantime.
 498   struct reloc_result *reloc_result =
 499     &l->l_reloc_result[reloc_index (pltgot, reloc_arg, sizeof (PLTREL))];
 500   ElfW(Sym) *defsym = ((ElfW(Sym) *) D_PTR (reloc_result->bound,
 501                                             l_info[DT_SYMTAB])
 502                        + reloc_result->boundndx);
 503
 504   /* Set up the sym parameter.  */
 505   ElfW(Sym) sym = *defsym;
 506   sym.st_value = DL_FIXUP_VALUE_ADDR (reloc_result->addr);
 507
 508   /* Get the symbol name.  */
 509   const char *strtab = (const void *) D_PTR (reloc_result->bound,
 510                                              l_info[DT_STRTAB]);
 511   const char *symname = strtab + sym.st_name;
 512
 513   struct audit_ifaces *afct = GLRO(dl_audit);
 514   for (unsigned int cnt = 0; cnt < GLRO(dl_naudit); ++cnt)
 515     {
 516       if (afct->ARCH_LA_PLTEXIT != NULL
 517           && (reloc_result->enterexit
 518               & (LA_SYMB_NOPLTEXIT >> (2 * cnt))) == 0)
 519         {
 520           struct auditstate *l_state = link_map_audit_state (l, cnt);
 521           struct auditstate *bound_state
 522             = link_map_audit_state (reloc_result->bound, cnt);
 523           afct->ARCH_LA_PLTEXIT (&sym, reloc_result->boundndx,
 524                                  &l_state->cookie, &bound_state->cookie,
 525                                  inregs, outregs, symname);
 526         }
 527
 528       afct = afct->next;
 529     }
 530 #endif
 531 }