1 | /* Relocate a shared object and resolve its references to other loaded objects. |
2 | Copyright (C) 1995-2017 Free Software Foundation, Inc. |
3 | This file is part of the GNU C Library. |
4 | |
5 | The GNU C Library is free software; you can redistribute it and/or |
6 | modify it under the terms of the GNU Lesser General Public |
7 | License as published by the Free Software Foundation; either |
8 | version 2.1 of the License, or (at your option) any later version. |
9 | |
10 | The GNU C Library is distributed in the hope that it will be useful, |
11 | but WITHOUT ANY WARRANTY; without even the implied warranty of |
12 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU |
13 | Lesser General Public License for more details. |
14 | |
15 | You should have received a copy of the GNU Lesser General Public |
16 | License along with the GNU C Library; if not, see |
17 | <http://www.gnu.org/licenses/>. */ |
18 | |
19 | #include <errno.h> |
20 | #include <libintl.h> |
21 | #include <stdlib.h> |
22 | #include <unistd.h> |
23 | #include <ldsodefs.h> |
24 | #include <sys/mman.h> |
25 | #include <sys/param.h> |
26 | #include <sys/types.h> |
27 | #include <_itoa.h> |
28 | #include <libc-pointer-arith.h> |
29 | #include "dynamic-link.h" |
30 | |
31 | /* Statistics function. */ |
32 | #ifdef SHARED |
33 | # define bump_num_cache_relocations() ++GL(dl_num_cache_relocations) |
34 | #else |
35 | # define bump_num_cache_relocations() ((void) 0) |
36 | #endif |
37 | |
38 | |
39 | /* We are trying to perform a static TLS relocation in MAP, but it was |
40 | dynamically loaded. This can only work if there is enough surplus in |
41 | the static TLS area already allocated for each running thread. If this |
42 | object's TLS segment is too big to fit, we fail. If it fits, |
43 | we set MAP->l_tls_offset and return. |
44 | This function intentionally does not return any value but signals error |
45 | directly, as static TLS should be rare and code handling it should |
46 | not be inlined as much as possible. */ |
47 | int |
48 | internal_function |
49 | _dl_try_allocate_static_tls (struct link_map *map) |
50 | { |
51 | /* If we've already used the variable with dynamic access, or if the |
52 | alignment requirements are too high, fail. */ |
53 | if (map->l_tls_offset == FORCED_DYNAMIC_TLS_OFFSET |
54 | || map->l_tls_align > GL(dl_tls_static_align)) |
55 | { |
56 | fail: |
57 | return -1; |
58 | } |
59 | |
60 | #if TLS_TCB_AT_TP |
61 | size_t freebytes = GL(dl_tls_static_size) - GL(dl_tls_static_used); |
62 | if (freebytes < TLS_TCB_SIZE) |
63 | goto fail; |
64 | freebytes -= TLS_TCB_SIZE; |
65 | |
66 | size_t blsize = map->l_tls_blocksize + map->l_tls_firstbyte_offset; |
67 | if (freebytes < blsize) |
68 | goto fail; |
69 | |
70 | size_t n = (freebytes - blsize) / map->l_tls_align; |
71 | |
72 | size_t offset = GL(dl_tls_static_used) + (freebytes - n * map->l_tls_align |
73 | - map->l_tls_firstbyte_offset); |
74 | |
75 | map->l_tls_offset = GL(dl_tls_static_used) = offset; |
76 | #elif TLS_DTV_AT_TP |
77 | /* dl_tls_static_used includes the TCB at the beginning. */ |
78 | size_t offset = (ALIGN_UP(GL(dl_tls_static_used) |
79 | - map->l_tls_firstbyte_offset, |
80 | map->l_tls_align) |
81 | + map->l_tls_firstbyte_offset); |
82 | size_t used = offset + map->l_tls_blocksize; |
83 | |
84 | if (used > GL(dl_tls_static_size)) |
85 | goto fail; |
86 | |
87 | map->l_tls_offset = offset; |
88 | map->l_tls_firstbyte_offset = GL(dl_tls_static_used); |
89 | GL(dl_tls_static_used) = used; |
90 | #else |
91 | # error "Either TLS_TCB_AT_TP or TLS_DTV_AT_TP must be defined" |
92 | #endif |
93 | |
94 | /* If the object is not yet relocated we cannot initialize the |
95 | static TLS region. Delay it. */ |
96 | if (map->l_real->l_relocated) |
97 | { |
98 | #ifdef SHARED |
99 | if (__builtin_expect (THREAD_DTV()[0].counter != GL(dl_tls_generation), |
100 | 0)) |
101 | /* Update the slot information data for at least the generation of |
102 | the DSO we are allocating data for. */ |
103 | (void) _dl_update_slotinfo (map->l_tls_modid); |
104 | #endif |
105 | |
106 | GL(dl_init_static_tls) (map); |
107 | } |
108 | else |
109 | map->l_need_tls_init = 1; |
110 | |
111 | return 0; |
112 | } |
113 | |
114 | void |
115 | internal_function __attribute_noinline__ |
116 | _dl_allocate_static_tls (struct link_map *map) |
117 | { |
118 | if (map->l_tls_offset == FORCED_DYNAMIC_TLS_OFFSET |
119 | || _dl_try_allocate_static_tls (map)) |
120 | { |
121 | _dl_signal_error (0, map->l_name, NULL, N_("\ |
122 | cannot allocate memory in static TLS block" )); |
123 | } |
124 | } |
125 | |
126 | /* Initialize static TLS area and DTV for current (only) thread. |
127 | libpthread implementations should provide their own hook |
128 | to handle all threads. */ |
129 | void |
130 | _dl_nothread_init_static_tls (struct link_map *map) |
131 | { |
132 | #if TLS_TCB_AT_TP |
133 | void *dest = (char *) THREAD_SELF - map->l_tls_offset; |
134 | #elif TLS_DTV_AT_TP |
135 | void *dest = (char *) THREAD_SELF + map->l_tls_offset + TLS_PRE_TCB_SIZE; |
136 | #else |
137 | # error "Either TLS_TCB_AT_TP or TLS_DTV_AT_TP must be defined" |
138 | #endif |
139 | |
140 | /* Initialize the memory. */ |
141 | memset (__mempcpy (dest, map->l_tls_initimage, map->l_tls_initimage_size), |
142 | '\0', map->l_tls_blocksize - map->l_tls_initimage_size); |
143 | } |
144 | |
145 | |
146 | void |
147 | _dl_relocate_object (struct link_map *l, struct r_scope_elem *scope[], |
148 | int reloc_mode, int consider_profiling) |
149 | { |
150 | struct textrels |
151 | { |
152 | caddr_t start; |
153 | size_t len; |
154 | int prot; |
155 | struct textrels *next; |
156 | } *textrels = NULL; |
157 | /* Initialize it to make the compiler happy. */ |
158 | const char *errstring = NULL; |
159 | int lazy = reloc_mode & RTLD_LAZY; |
160 | int skip_ifunc = reloc_mode & __RTLD_NOIFUNC; |
161 | |
162 | #ifdef SHARED |
163 | /* If we are auditing, install the same handlers we need for profiling. */ |
164 | if ((reloc_mode & __RTLD_AUDIT) == 0) |
165 | consider_profiling |= GLRO(dl_audit) != NULL; |
166 | #elif defined PROF |
167 | /* Never use dynamic linker profiling for gprof profiling code. */ |
168 | # define consider_profiling 0 |
169 | #endif |
170 | |
171 | if (l->l_relocated) |
172 | return; |
173 | |
174 | /* If DT_BIND_NOW is set relocate all references in this object. We |
175 | do not do this if we are profiling, of course. */ |
176 | // XXX Correct for auditing? |
177 | if (!consider_profiling |
178 | && __builtin_expect (l->l_info[DT_BIND_NOW] != NULL, 0)) |
179 | lazy = 0; |
180 | |
181 | if (__glibc_unlikely (GLRO(dl_debug_mask) & DL_DEBUG_RELOC)) |
182 | _dl_debug_printf ("\nrelocation processing: %s%s\n" , |
183 | DSO_FILENAME (l->l_name), lazy ? " (lazy)" : "" ); |
184 | |
185 | /* DT_TEXTREL is now in level 2 and might phase out at some time. |
186 | But we rewrite the DT_FLAGS entry to a DT_TEXTREL entry to make |
187 | testing easier and therefore it will be available at all time. */ |
188 | if (__glibc_unlikely (l->l_info[DT_TEXTREL] != NULL)) |
189 | { |
190 | /* Bletch. We must make read-only segments writable |
191 | long enough to relocate them. */ |
192 | const ElfW(Phdr) *ph; |
193 | for (ph = l->l_phdr; ph < &l->l_phdr[l->l_phnum]; ++ph) |
194 | if (ph->p_type == PT_LOAD && (ph->p_flags & PF_W) == 0) |
195 | { |
196 | struct textrels *newp; |
197 | |
198 | newp = (struct textrels *) alloca (sizeof (*newp)); |
199 | newp->len = ALIGN_UP (ph->p_vaddr + ph->p_memsz, GLRO(dl_pagesize)) |
200 | - ALIGN_DOWN (ph->p_vaddr, GLRO(dl_pagesize)); |
201 | newp->start = PTR_ALIGN_DOWN (ph->p_vaddr, GLRO(dl_pagesize)) |
202 | + (caddr_t) l->l_addr; |
203 | |
204 | if (__mprotect (newp->start, newp->len, PROT_READ|PROT_WRITE) < 0) |
205 | { |
206 | errstring = N_("cannot make segment writable for relocation" ); |
207 | call_error: |
208 | _dl_signal_error (errno, l->l_name, NULL, errstring); |
209 | } |
210 | |
211 | #if (PF_R | PF_W | PF_X) == 7 && (PROT_READ | PROT_WRITE | PROT_EXEC) == 7 |
212 | newp->prot = (PF_TO_PROT |
213 | >> ((ph->p_flags & (PF_R | PF_W | PF_X)) * 4)) & 0xf; |
214 | #else |
215 | newp->prot = 0; |
216 | if (ph->p_flags & PF_R) |
217 | newp->prot |= PROT_READ; |
218 | if (ph->p_flags & PF_W) |
219 | newp->prot |= PROT_WRITE; |
220 | if (ph->p_flags & PF_X) |
221 | newp->prot |= PROT_EXEC; |
222 | #endif |
223 | newp->next = textrels; |
224 | textrels = newp; |
225 | } |
226 | } |
227 | |
228 | { |
229 | /* Do the actual relocation of the object's GOT and other data. */ |
230 | |
231 | /* String table object symbols. */ |
232 | const char *strtab = (const void *) D_PTR (l, l_info[DT_STRTAB]); |
233 | |
234 | /* This macro is used as a callback from the ELF_DYNAMIC_RELOCATE code. */ |
235 | #define RESOLVE_MAP(ref, version, r_type) \ |
236 | ((ELFW(ST_BIND) ((*ref)->st_info) != STB_LOCAL \ |
237 | && __glibc_likely (!dl_symbol_visibility_binds_local_p (*ref))) \ |
238 | ? ((__builtin_expect ((*ref) == l->l_lookup_cache.sym, 0) \ |
239 | && elf_machine_type_class (r_type) == l->l_lookup_cache.type_class) \ |
240 | ? (bump_num_cache_relocations (), \ |
241 | (*ref) = l->l_lookup_cache.ret, \ |
242 | l->l_lookup_cache.value) \ |
243 | : ({ lookup_t _lr; \ |
244 | int _tc = elf_machine_type_class (r_type); \ |
245 | l->l_lookup_cache.type_class = _tc; \ |
246 | l->l_lookup_cache.sym = (*ref); \ |
247 | const struct r_found_version *v = NULL; \ |
248 | if ((version) != NULL && (version)->hash != 0) \ |
249 | v = (version); \ |
250 | _lr = _dl_lookup_symbol_x (strtab + (*ref)->st_name, l, (ref), \ |
251 | scope, v, _tc, \ |
252 | DL_LOOKUP_ADD_DEPENDENCY, NULL); \ |
253 | l->l_lookup_cache.ret = (*ref); \ |
254 | l->l_lookup_cache.value = _lr; })) \ |
255 | : l) |
256 | |
257 | #include "dynamic-link.h" |
258 | |
259 | ELF_DYNAMIC_RELOCATE (l, lazy, consider_profiling, skip_ifunc); |
260 | |
261 | #ifndef PROF |
262 | if (__glibc_unlikely (consider_profiling) |
263 | && l->l_info[DT_PLTRELSZ] != NULL) |
264 | { |
265 | /* Allocate the array which will contain the already found |
266 | relocations. If the shared object lacks a PLT (for example |
267 | if it only contains lead function) the l_info[DT_PLTRELSZ] |
268 | will be NULL. */ |
269 | size_t sizeofrel = l->l_info[DT_PLTREL]->d_un.d_val == DT_RELA |
270 | ? sizeof (ElfW(Rela)) |
271 | : sizeof (ElfW(Rel)); |
272 | size_t relcount = l->l_info[DT_PLTRELSZ]->d_un.d_val / sizeofrel; |
273 | l->l_reloc_result = calloc (sizeof (l->l_reloc_result[0]), relcount); |
274 | |
275 | if (l->l_reloc_result == NULL) |
276 | { |
277 | errstring = N_("\ |
278 | %s: out of memory to store relocation results for %s\n" ); |
279 | _dl_fatal_printf (errstring, RTLD_PROGNAME, l->l_name); |
280 | } |
281 | } |
282 | #endif |
283 | } |
284 | |
285 | /* Mark the object so we know this work has been done. */ |
286 | l->l_relocated = 1; |
287 | |
288 | /* Undo the segment protection changes. */ |
289 | while (__builtin_expect (textrels != NULL, 0)) |
290 | { |
291 | if (__mprotect (textrels->start, textrels->len, textrels->prot) < 0) |
292 | { |
293 | errstring = N_("cannot restore segment prot after reloc" ); |
294 | goto call_error; |
295 | } |
296 | |
297 | #ifdef CLEAR_CACHE |
298 | CLEAR_CACHE (textrels->start, textrels->start + textrels->len); |
299 | #endif |
300 | |
301 | textrels = textrels->next; |
302 | } |
303 | |
304 | /* In case we can protect the data now that the relocations are |
305 | done, do it. */ |
306 | if (l->l_relro_size != 0) |
307 | _dl_protect_relro (l); |
308 | } |
309 | |
310 | |
311 | void internal_function |
312 | _dl_protect_relro (struct link_map *l) |
313 | { |
314 | ElfW(Addr) start = ALIGN_DOWN((l->l_addr |
315 | + l->l_relro_addr), |
316 | GLRO(dl_pagesize)); |
317 | ElfW(Addr) end = ALIGN_DOWN((l->l_addr |
318 | + l->l_relro_addr |
319 | + l->l_relro_size), |
320 | GLRO(dl_pagesize)); |
321 | if (start != end |
322 | && __mprotect ((void *) start, end - start, PROT_READ) < 0) |
323 | { |
324 | static const char errstring[] = N_("\ |
325 | cannot apply additional memory protection after relocation" ); |
326 | _dl_signal_error (errno, l->l_name, NULL, errstring); |
327 | } |
328 | } |
329 | |
330 | void |
331 | internal_function __attribute_noinline__ |
332 | _dl_reloc_bad_type (struct link_map *map, unsigned int type, int plt) |
333 | { |
334 | #define DIGIT(b) _itoa_lower_digits[(b) & 0xf]; |
335 | |
336 | /* XXX We cannot translate these messages. */ |
337 | static const char msg[2][32 |
338 | #if __ELF_NATIVE_CLASS == 64 |
339 | + 6 |
340 | #endif |
341 | ] = { "unexpected reloc type 0x" , |
342 | "unexpected PLT reloc type 0x" }; |
343 | char msgbuf[sizeof (msg[0])]; |
344 | char *cp; |
345 | |
346 | cp = __stpcpy (msgbuf, msg[plt]); |
347 | #if __ELF_NATIVE_CLASS == 64 |
348 | if (__builtin_expect(type > 0xff, 0)) |
349 | { |
350 | *cp++ = DIGIT (type >> 28); |
351 | *cp++ = DIGIT (type >> 24); |
352 | *cp++ = DIGIT (type >> 20); |
353 | *cp++ = DIGIT (type >> 16); |
354 | *cp++ = DIGIT (type >> 12); |
355 | *cp++ = DIGIT (type >> 8); |
356 | } |
357 | #endif |
358 | *cp++ = DIGIT (type >> 4); |
359 | *cp++ = DIGIT (type); |
360 | *cp = '\0'; |
361 | |
362 | _dl_signal_error (0, map->l_name, NULL, msgbuf); |
363 | } |
364 | |