sunrpc: Test case for clnt_create "unix" buffer overflow (bug 22542)
[glibc.git] / elf / dl-support.c
blobfb64765537842a283e81ccf188c6a5da3142b0d9
1 /* Support for dynamic linking code in static libc.
2 Copyright (C) 1996-2022 Free Software Foundation, Inc.
3 This file is part of the GNU C Library.
5 The GNU C Library is free software; you can redistribute it and/or
6 modify it under the terms of the GNU Lesser General Public
7 License as published by the Free Software Foundation; either
8 version 2.1 of the License, or (at your option) any later version.
10 The GNU C Library is distributed in the hope that it will be useful,
11 but WITHOUT ANY WARRANTY; without even the implied warranty of
12 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
13 Lesser General Public License for more details.
15 You should have received a copy of the GNU Lesser General Public
16 License along with the GNU C Library; if not, see
17 <https://www.gnu.org/licenses/>. */
19 /* This file defines some things that for the dynamic linker are defined in
20 rtld.c and dl-sysdep.c in ways appropriate to bootstrap dynamic linking. */
22 #include <string.h>
23 /* Mark symbols hidden in static PIE for early self relocation to work.
24 Note: string.h may have ifuncs which cannot be hidden on i686. */
25 #if BUILD_PIE_DEFAULT
26 # pragma GCC visibility push(hidden)
27 #endif
28 #include <errno.h>
29 #include <libintl.h>
30 #include <stdlib.h>
31 #include <unistd.h>
32 #include <sys/param.h>
33 #include <stdint.h>
34 #include <ldsodefs.h>
35 #include <dl-machine.h>
36 #include <libc-lock.h>
37 #include <dl-cache.h>
38 #include <dl-librecon.h>
39 #include <dl-procinfo.h>
40 #include <unsecvars.h>
41 #include <hp-timing.h>
42 #include <stackinfo.h>
43 #include <dl-vdso.h>
44 #include <dl-vdso-setup.h>
45 #include <dl-auxv.h>
46 #include <dl-find_object.h>
48 extern char *__progname;
49 char **_dl_argv = &__progname; /* This is checked for some error messages. */
51 /* Name of the architecture. */
52 const char *_dl_platform;
53 size_t _dl_platformlen;
55 int _dl_debug_mask;
56 int _dl_lazy;
57 ElfW(Addr) _dl_use_load_bias = -2;
58 int _dl_dynamic_weak;
60 /* If nonzero print warnings about problematic situations. */
61 int _dl_verbose;
63 /* We never do profiling. */
64 const char *_dl_profile;
65 const char *_dl_profile_output;
67 /* Names of shared object for which the RUNPATHs and RPATHs should be
68 ignored. */
69 const char *_dl_inhibit_rpath;
71 /* The map for the object we will profile. */
72 struct link_map *_dl_profile_map;
74 /* This is the address of the last stack address ever used. */
75 void *__libc_stack_end;
77 /* Path where the binary is found. */
78 const char *_dl_origin_path;
80 /* Nonzero if runtime lookup should not update the .got/.plt. */
81 int _dl_bind_not;
83 /* A dummy link map for the executable, used by dlopen to access the global
84 scope. We don't export any symbols ourselves, so this can be minimal. */
85 static struct link_map _dl_main_map =
87 .l_name = (char *) "",
88 .l_real = &_dl_main_map,
89 .l_ns = LM_ID_BASE,
90 .l_libname = &(struct libname_list) { .name = "", .dont_free = 1 },
91 .l_searchlist =
93 .r_list = &(struct link_map *) { &_dl_main_map },
94 .r_nlist = 1,
96 .l_symbolic_searchlist = { .r_list = &(struct link_map *) { NULL } },
97 .l_type = lt_executable,
98 .l_scope_mem = { &_dl_main_map.l_searchlist },
99 .l_scope_max = (sizeof (_dl_main_map.l_scope_mem)
100 / sizeof (_dl_main_map.l_scope_mem[0])),
101 .l_scope = _dl_main_map.l_scope_mem,
102 .l_local_scope = { &_dl_main_map.l_searchlist },
103 .l_used = 1,
104 .l_tls_offset = NO_TLS_OFFSET,
105 .l_serial = 1,
108 /* Namespace information. */
109 struct link_namespaces _dl_ns[DL_NNS] =
111 [LM_ID_BASE] =
113 ._ns_loaded = &_dl_main_map,
114 ._ns_nloaded = 1,
115 ._ns_main_searchlist = &_dl_main_map.l_searchlist,
118 size_t _dl_nns = 1;
120 /* Incremented whenever something may have been added to dl_loaded. */
121 unsigned long long _dl_load_adds = 1;
123 /* Fake scope of the main application. */
124 struct r_scope_elem _dl_initial_searchlist =
126 .r_list = &(struct link_map *) { &_dl_main_map },
127 .r_nlist = 1,
130 #ifndef HAVE_INLINED_SYSCALLS
131 /* Nonzero during startup. */
132 int _dl_starting_up = 1;
133 #endif
135 /* Random data provided by the kernel. */
136 void *_dl_random;
138 /* Get architecture specific initializer. */
139 #include <dl-procruntime.c>
140 #include <dl-procinfo.c>
142 size_t _dl_pagesize = EXEC_PAGESIZE;
144 size_t _dl_minsigstacksize = CONSTANT_MINSIGSTKSZ;
146 int _dl_inhibit_cache;
148 unsigned int _dl_osversion;
150 /* All known directories in sorted order. */
151 struct r_search_path_elem *_dl_all_dirs;
153 /* All directories after startup. */
154 struct r_search_path_elem *_dl_init_all_dirs;
156 /* The object to be initialized first. */
157 struct link_map *_dl_initfirst;
159 /* Descriptor to write debug messages to. */
160 int _dl_debug_fd = STDERR_FILENO;
162 int _dl_correct_cache_id = _DL_CACHE_DEFAULT_ID;
164 ElfW(auxv_t) *_dl_auxv;
165 const ElfW(Phdr) *_dl_phdr;
166 size_t _dl_phnum;
167 uint64_t _dl_hwcap;
168 uint64_t _dl_hwcap2;
170 enum dso_sort_algorithm _dl_dso_sort_algo;
172 /* The value of the FPU control word the kernel will preset in hardware. */
173 fpu_control_t _dl_fpu_control = _FPU_DEFAULT;
175 #if !HAVE_TUNABLES
176 /* This is not initialized to HWCAP_IMPORTANT, matching the definition
177 of _dl_important_hwcaps, below, where no hwcap strings are ever
178 used. This mask is still used to mediate the lookups in the cache
179 file. Since there is no way to set this nonzero (we don't grok the
180 LD_HWCAP_MASK environment variable here), there is no real point in
181 setting _dl_hwcap nonzero below, but we do anyway. */
182 uint64_t _dl_hwcap_mask;
183 #endif
185 /* Prevailing state of the stack. Generally this includes PF_X, indicating it's
186 * executable but this isn't true for all platforms. */
187 ElfW(Word) _dl_stack_flags = DEFAULT_STACK_PERMS;
189 #if PTHREAD_IN_LIBC
190 list_t _dl_stack_used;
191 list_t _dl_stack_user;
192 list_t _dl_stack_cache;
193 size_t _dl_stack_cache_actsize;
194 uintptr_t _dl_in_flight_stack;
195 int _dl_stack_cache_lock;
196 #else
197 /* If loading a shared object requires that we make the stack executable
198 when it was not, we do it by calling this function.
199 It returns an errno code or zero on success. */
200 int (*_dl_make_stack_executable_hook) (void **) = _dl_make_stack_executable;
201 void (*_dl_init_static_tls) (struct link_map *) = &_dl_nothread_init_static_tls;
202 #endif
203 struct dl_scope_free_list *_dl_scope_free_list;
205 #ifdef NEED_DL_SYSINFO
206 /* Needed for improved syscall handling on at least x86/Linux. NB: Don't
207 initialize it here to avoid RELATIVE relocation in static PIE. */
208 uintptr_t _dl_sysinfo;
209 #endif
210 #ifdef NEED_DL_SYSINFO_DSO
211 /* Address of the ELF headers in the vsyscall page. */
212 const ElfW(Ehdr) *_dl_sysinfo_dso;
214 struct link_map *_dl_sysinfo_map;
216 # include "get-dynamic-info.h"
217 #endif
218 #include "setup-vdso.h"
219 /* Define the vDSO function pointers. */
220 #include <dl-vdso-setup.c>
222 /* During the program run we must not modify the global data of
223 loaded shared object simultanously in two threads. Therefore we
224 protect `_dl_open' and `_dl_close' in dl-close.c.
226 This must be a recursive lock since the initializer function of
227 the loaded object might as well require a call to this function.
228 At this time it is not anymore a problem to modify the tables. */
229 __rtld_lock_define_initialized_recursive (, _dl_load_lock)
230 /* This lock is used to keep __dl_iterate_phdr from inspecting the
231 list of loaded objects while an object is added to or removed from
232 that list. */
233 __rtld_lock_define_initialized_recursive (, _dl_load_write_lock)
234 /* This lock protects global and module specific TLS related data.
235 E.g. it is held in dlopen and dlclose when GL(dl_tls_generation),
236 GL(dl_tls_max_dtv_idx) or GL(dl_tls_dtv_slotinfo_list) are
237 accessed and when TLS related relocations are processed for a
238 module. It was introduced to keep pthread_create accessing TLS
239 state that is being set up. */
240 __rtld_lock_define_initialized_recursive (, _dl_load_tls_lock)
243 #ifdef HAVE_AUX_VECTOR
244 int _dl_clktck;
246 void
247 _dl_aux_init (ElfW(auxv_t) *av)
249 int seen = 0;
250 uid_t uid = 0;
251 gid_t gid = 0;
253 #ifdef NEED_DL_SYSINFO
254 /* NB: Avoid RELATIVE relocation in static PIE. */
255 GL(dl_sysinfo) = DL_SYSINFO_DEFAULT;
256 #endif
258 _dl_auxv = av;
259 for (; av->a_type != AT_NULL; ++av)
260 switch (av->a_type)
262 case AT_PAGESZ:
263 if (av->a_un.a_val != 0)
264 GLRO(dl_pagesize) = av->a_un.a_val;
265 break;
266 case AT_CLKTCK:
267 GLRO(dl_clktck) = av->a_un.a_val;
268 break;
269 case AT_PHDR:
270 GL(dl_phdr) = (const void *) av->a_un.a_val;
271 break;
272 case AT_PHNUM:
273 GL(dl_phnum) = av->a_un.a_val;
274 break;
275 case AT_PLATFORM:
276 GLRO(dl_platform) = (void *) av->a_un.a_val;
277 break;
278 case AT_HWCAP:
279 GLRO(dl_hwcap) = (unsigned long int) av->a_un.a_val;
280 break;
281 case AT_HWCAP2:
282 GLRO(dl_hwcap2) = (unsigned long int) av->a_un.a_val;
283 break;
284 case AT_FPUCW:
285 GLRO(dl_fpu_control) = av->a_un.a_val;
286 break;
287 #ifdef NEED_DL_SYSINFO
288 case AT_SYSINFO:
289 GL(dl_sysinfo) = av->a_un.a_val;
290 break;
291 #endif
292 #ifdef NEED_DL_SYSINFO_DSO
293 case AT_SYSINFO_EHDR:
294 GL(dl_sysinfo_dso) = (void *) av->a_un.a_val;
295 break;
296 #endif
297 case AT_UID:
298 uid ^= av->a_un.a_val;
299 seen |= 1;
300 break;
301 case AT_EUID:
302 uid ^= av->a_un.a_val;
303 seen |= 2;
304 break;
305 case AT_GID:
306 gid ^= av->a_un.a_val;
307 seen |= 4;
308 break;
309 case AT_EGID:
310 gid ^= av->a_un.a_val;
311 seen |= 8;
312 break;
313 case AT_SECURE:
314 seen = -1;
315 __libc_enable_secure = av->a_un.a_val;
316 __libc_enable_secure_decided = 1;
317 break;
318 case AT_RANDOM:
319 _dl_random = (void *) av->a_un.a_val;
320 break;
321 case AT_MINSIGSTKSZ:
322 _dl_minsigstacksize = av->a_un.a_val;
323 break;
324 DL_PLATFORM_AUXV
326 if (seen == 0xf)
328 __libc_enable_secure = uid != 0 || gid != 0;
329 __libc_enable_secure_decided = 1;
332 #endif
335 void
336 _dl_non_dynamic_init (void)
338 _dl_main_map.l_origin = _dl_get_origin ();
339 _dl_main_map.l_phdr = GL(dl_phdr);
340 _dl_main_map.l_phnum = GL(dl_phnum);
342 _dl_verbose = *(getenv ("LD_WARN") ?: "") == '\0' ? 0 : 1;
344 /* Set up the data structures for the system-supplied DSO early,
345 so they can influence _dl_init_paths. */
346 setup_vdso (NULL, NULL);
348 /* With vDSO setup we can initialize the function pointers. */
349 setup_vdso_pointers ();
351 /* Initialize the data structures for the search paths for shared
352 objects. */
353 _dl_init_paths (getenv ("LD_LIBRARY_PATH"), "LD_LIBRARY_PATH",
354 /* No glibc-hwcaps selection support in statically
355 linked binaries. */
356 NULL, NULL);
358 /* Remember the last search directory added at startup. */
359 _dl_init_all_dirs = GL(dl_all_dirs);
361 _dl_lazy = *(getenv ("LD_BIND_NOW") ?: "") == '\0';
363 _dl_bind_not = *(getenv ("LD_BIND_NOT") ?: "") != '\0';
365 _dl_dynamic_weak = *(getenv ("LD_DYNAMIC_WEAK") ?: "") == '\0';
367 _dl_profile_output = getenv ("LD_PROFILE_OUTPUT");
368 if (_dl_profile_output == NULL || _dl_profile_output[0] == '\0')
369 _dl_profile_output
370 = &"/var/tmp\0/var/profile"[__libc_enable_secure ? 9 : 0];
372 if (__libc_enable_secure)
374 static const char unsecure_envvars[] =
375 UNSECURE_ENVVARS
376 #ifdef EXTRA_UNSECURE_ENVVARS
377 EXTRA_UNSECURE_ENVVARS
378 #endif
380 const char *cp = unsecure_envvars;
382 while (cp < unsecure_envvars + sizeof (unsecure_envvars))
384 __unsetenv (cp);
385 cp = (const char *) __rawmemchr (cp, '\0') + 1;
388 #if !HAVE_TUNABLES
389 if (__access ("/etc/suid-debug", F_OK) != 0)
390 __unsetenv ("MALLOC_CHECK_");
391 #endif
394 #ifdef DL_PLATFORM_INIT
395 DL_PLATFORM_INIT;
396 #endif
398 #ifdef DL_OSVERSION_INIT
399 DL_OSVERSION_INIT;
400 #endif
402 /* Now determine the length of the platform string. */
403 if (_dl_platform != NULL)
404 _dl_platformlen = strlen (_dl_platform);
406 if (_dl_phdr != NULL)
407 for (const ElfW(Phdr) *ph = _dl_phdr; ph < &_dl_phdr[_dl_phnum]; ++ph)
408 switch (ph->p_type)
410 /* Check if the stack is nonexecutable. */
411 case PT_GNU_STACK:
412 _dl_stack_flags = ph->p_flags;
413 break;
415 case PT_GNU_RELRO:
416 _dl_main_map.l_relro_addr = ph->p_vaddr;
417 _dl_main_map.l_relro_size = ph->p_memsz;
418 break;
421 call_function_static_weak (_dl_find_object_init);
423 /* Setup relro on the binary itself. */
424 if (_dl_main_map.l_relro_size != 0)
425 _dl_protect_relro (&_dl_main_map);
428 #ifdef DL_SYSINFO_IMPLEMENTATION
429 DL_SYSINFO_IMPLEMENTATION
430 #endif
432 #if ENABLE_STATIC_PIE
433 /* Since relocation to hidden _dl_main_map causes relocation overflow on
434 aarch64, a function is used to get the address of _dl_main_map. */
436 struct link_map *
437 _dl_get_dl_main_map (void)
439 return &_dl_main_map;
441 #endif
443 /* This is used by _dl_runtime_profile, not used on static code. */
444 void
445 DL_ARCH_FIXUP_ATTRIBUTE
446 _dl_audit_pltexit (struct link_map *l, ElfW(Word) reloc_arg,
447 const void *inregs, void *outregs)