1 | /* On-demand PLT fixup for shared objects. |
2 | Copyright (C) 1995-2019 Free Software Foundation, Inc. |
3 | This file is part of the GNU C Library. |
4 | |
5 | The GNU C Library is free software; you can redistribute it and/or |
6 | modify it under the terms of the GNU Lesser General Public |
7 | License as published by the Free Software Foundation; either |
8 | version 2.1 of the License, or (at your option) any later version. |
9 | |
10 | The GNU C Library is distributed in the hope that it will be useful, |
11 | but WITHOUT ANY WARRANTY; without even the implied warranty of |
12 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU |
13 | Lesser General Public License for more details. |
14 | |
15 | You should have received a copy of the GNU Lesser General Public |
16 | License along with the GNU C Library; if not, see |
17 | <http://www.gnu.org/licenses/>. */ |
18 | |
19 | #define IN_DL_RUNTIME 1 /* This can be tested in dl-machine.h. */ |
20 | |
21 | #include <alloca.h> |
22 | #include <stdlib.h> |
23 | #include <unistd.h> |
24 | #include <sys/param.h> |
25 | #include <ldsodefs.h> |
26 | #include <sysdep-cancel.h> |
27 | #include "dynamic-link.h" |
28 | #include <tls.h> |
29 | #include <dl-irel.h> |
30 | |
31 | |
32 | #if (!ELF_MACHINE_NO_RELA && !defined ELF_MACHINE_PLT_REL) \ |
33 | || ELF_MACHINE_NO_REL |
34 | # define PLTREL ElfW(Rela) |
35 | #else |
36 | # define PLTREL ElfW(Rel) |
37 | #endif |
38 | |
39 | /* The fixup functions might have need special attributes. If none |
40 | are provided define the macro as empty. */ |
41 | #ifndef ARCH_FIXUP_ATTRIBUTE |
42 | # define ARCH_FIXUP_ATTRIBUTE |
43 | #endif |
44 | |
45 | #ifndef reloc_offset |
46 | # define reloc_offset reloc_arg |
47 | # define reloc_index reloc_arg / sizeof (PLTREL) |
48 | #endif |
49 | |
50 | |
51 | |
52 | /* This function is called through a special trampoline from the PLT the |
53 | first time each PLT entry is called. We must perform the relocation |
54 | specified in the PLT of the given shared object, and return the resolved |
55 | function address to the trampoline, which will restart the original call |
56 | to that address. Future calls will bounce directly from the PLT to the |
57 | function. */ |
58 | |
59 | DL_FIXUP_VALUE_TYPE |
60 | attribute_hidden __attribute ((noinline)) ARCH_FIXUP_ATTRIBUTE |
61 | _dl_fixup ( |
62 | # ifdef ELF_MACHINE_RUNTIME_FIXUP_ARGS |
63 | ELF_MACHINE_RUNTIME_FIXUP_ARGS, |
64 | # endif |
65 | struct link_map *l, ElfW(Word) reloc_arg) |
66 | { |
67 | const ElfW(Sym) *const symtab |
68 | = (const void *) D_PTR (l, l_info[DT_SYMTAB]); |
69 | const char *strtab = (const void *) D_PTR (l, l_info[DT_STRTAB]); |
70 | |
71 | const PLTREL *const reloc |
72 | = (const void *) (D_PTR (l, l_info[DT_JMPREL]) + reloc_offset); |
73 | const ElfW(Sym) *sym = &symtab[ELFW(R_SYM) (reloc->r_info)]; |
74 | const ElfW(Sym) *refsym = sym; |
75 | void *const rel_addr = (void *)(l->l_addr + reloc->r_offset); |
76 | lookup_t result; |
77 | DL_FIXUP_VALUE_TYPE value; |
78 | |
79 | /* Sanity check that we're really looking at a PLT relocation. */ |
80 | assert (ELFW(R_TYPE)(reloc->r_info) == ELF_MACHINE_JMP_SLOT); |
81 | |
82 | /* Look up the target symbol. If the normal lookup rules are not |
83 | used don't look in the global scope. */ |
84 | if (__builtin_expect (ELFW(ST_VISIBILITY) (sym->st_other), 0) == 0) |
85 | { |
86 | const struct r_found_version *version = NULL; |
87 | |
88 | if (l->l_info[VERSYMIDX (DT_VERSYM)] != NULL) |
89 | { |
90 | const ElfW(Half) *vernum = |
91 | (const void *) D_PTR (l, l_info[VERSYMIDX (DT_VERSYM)]); |
92 | ElfW(Half) ndx = vernum[ELFW(R_SYM) (reloc->r_info)] & 0x7fff; |
93 | version = &l->l_versions[ndx]; |
94 | if (version->hash == 0) |
95 | version = NULL; |
96 | } |
97 | |
98 | /* We need to keep the scope around so do some locking. This is |
99 | not necessary for objects which cannot be unloaded or when |
100 | we are not using any threads (yet). */ |
101 | int flags = DL_LOOKUP_ADD_DEPENDENCY; |
102 | if (!RTLD_SINGLE_THREAD_P) |
103 | { |
104 | THREAD_GSCOPE_SET_FLAG (); |
105 | flags |= DL_LOOKUP_GSCOPE_LOCK; |
106 | } |
107 | |
108 | #ifdef RTLD_ENABLE_FOREIGN_CALL |
109 | RTLD_ENABLE_FOREIGN_CALL; |
110 | #endif |
111 | |
112 | result = _dl_lookup_symbol_x (strtab + sym->st_name, l, &sym, l->l_scope, |
113 | version, ELF_RTYPE_CLASS_PLT, flags, NULL); |
114 | |
115 | /* We are done with the global scope. */ |
116 | if (!RTLD_SINGLE_THREAD_P) |
117 | THREAD_GSCOPE_RESET_FLAG (); |
118 | |
119 | #ifdef RTLD_FINALIZE_FOREIGN_CALL |
120 | RTLD_FINALIZE_FOREIGN_CALL; |
121 | #endif |
122 | |
123 | /* Currently result contains the base load address (or link map) |
124 | of the object that defines sym. Now add in the symbol |
125 | offset. */ |
126 | value = DL_FIXUP_MAKE_VALUE (result, |
127 | SYMBOL_ADDRESS (result, sym, false)); |
128 | } |
129 | else |
130 | { |
131 | /* We already found the symbol. The module (and therefore its load |
132 | address) is also known. */ |
133 | value = DL_FIXUP_MAKE_VALUE (l, SYMBOL_ADDRESS (l, sym, true)); |
134 | result = l; |
135 | } |
136 | |
137 | /* And now perhaps the relocation addend. */ |
138 | value = elf_machine_plt_value (l, reloc, value); |
139 | |
140 | if (sym != NULL |
141 | && __builtin_expect (ELFW(ST_TYPE) (sym->st_info) == STT_GNU_IFUNC, 0)) |
142 | value = elf_ifunc_invoke (DL_FIXUP_VALUE_ADDR (value)); |
143 | |
144 | /* Finally, fix up the plt itself. */ |
145 | if (__glibc_unlikely (GLRO(dl_bind_not))) |
146 | return value; |
147 | |
148 | return elf_machine_fixup_plt (l, result, refsym, sym, reloc, rel_addr, value); |
149 | } |
150 | |
151 | #ifndef PROF |
152 | DL_FIXUP_VALUE_TYPE |
153 | __attribute ((noinline)) ARCH_FIXUP_ATTRIBUTE |
154 | _dl_profile_fixup ( |
155 | #ifdef ELF_MACHINE_RUNTIME_FIXUP_ARGS |
156 | ELF_MACHINE_RUNTIME_FIXUP_ARGS, |
157 | #endif |
158 | struct link_map *l, ElfW(Word) reloc_arg, |
159 | ElfW(Addr) retaddr, void *regs, long int *framesizep) |
160 | { |
161 | void (*mcount_fct) (ElfW(Addr), ElfW(Addr)) = _dl_mcount; |
162 | |
163 | if (l->l_reloc_result == NULL) |
164 | { |
165 | /* BZ #14843: ELF_DYNAMIC_RELOCATE is called before l_reloc_result |
166 | is allocated. We will get here if ELF_DYNAMIC_RELOCATE calls a |
167 | resolver function to resolve an IRELATIVE relocation and that |
168 | resolver calls a function that is not yet resolved (lazy). For |
169 | example, the resolver in x86-64 libm.so calls __get_cpu_features |
170 | defined in libc.so. Skip audit and resolve the external function |
171 | in this case. */ |
172 | *framesizep = -1; |
173 | return _dl_fixup ( |
174 | # ifdef ELF_MACHINE_RUNTIME_FIXUP_ARGS |
175 | # ifndef ELF_MACHINE_RUNTIME_FIXUP_PARAMS |
176 | # error Please define ELF_MACHINE_RUNTIME_FIXUP_PARAMS. |
177 | # endif |
178 | ELF_MACHINE_RUNTIME_FIXUP_PARAMS, |
179 | # endif |
180 | l, reloc_arg); |
181 | } |
182 | |
183 | /* This is the address in the array where we store the result of previous |
184 | relocations. */ |
185 | struct reloc_result *reloc_result = &l->l_reloc_result[reloc_index]; |
186 | |
187 | /* CONCURRENCY NOTES: |
188 | |
189 | Multiple threads may be calling the same PLT sequence and with |
190 | LD_AUDIT enabled they will be calling into _dl_profile_fixup to |
191 | update the reloc_result with the result of the lazy resolution. |
192 | The reloc_result guard variable is reloc_init, and we use |
193 | acquire/release loads and store to it to ensure that the results of |
194 | the structure are consistent with the loaded value of the guard. |
195 | This does not fix all of the data races that occur when two or more |
196 | threads read reloc_result->reloc_init with a value of zero and read |
197 | and write to that reloc_result concurrently. The expectation is |
198 | generally that while this is a data race it works because the |
199 | threads write the same values. Until the data races are fixed |
200 | there is a potential for problems to arise from these data races. |
201 | The reloc result updates should happen in parallel but there should |
202 | be an atomic RMW which does the final update to the real result |
203 | entry (see bug 23790). |
204 | |
205 | The following code uses reloc_result->init set to 0 to indicate if it is |
206 | the first time this object is being relocated, otherwise 1 which |
207 | indicates the object has already been relocated. |
208 | |
209 | Reading/Writing from/to reloc_result->reloc_init must not happen |
210 | before previous writes to reloc_result complete as they could |
211 | end-up with an incomplete struct. */ |
212 | DL_FIXUP_VALUE_TYPE value; |
213 | unsigned int init = atomic_load_acquire (&reloc_result->init); |
214 | |
215 | if (init == 0) |
216 | { |
217 | /* This is the first time we have to relocate this object. */ |
218 | const ElfW(Sym) *const symtab |
219 | = (const void *) D_PTR (l, l_info[DT_SYMTAB]); |
220 | const char *strtab = (const char *) D_PTR (l, l_info[DT_STRTAB]); |
221 | |
222 | const PLTREL *const reloc |
223 | = (const void *) (D_PTR (l, l_info[DT_JMPREL]) + reloc_offset); |
224 | const ElfW(Sym) *refsym = &symtab[ELFW(R_SYM) (reloc->r_info)]; |
225 | const ElfW(Sym) *defsym = refsym; |
226 | lookup_t result; |
227 | |
228 | /* Sanity check that we're really looking at a PLT relocation. */ |
229 | assert (ELFW(R_TYPE)(reloc->r_info) == ELF_MACHINE_JMP_SLOT); |
230 | |
231 | /* Look up the target symbol. If the symbol is marked STV_PROTECTED |
232 | don't look in the global scope. */ |
233 | if (__builtin_expect (ELFW(ST_VISIBILITY) (refsym->st_other), 0) == 0) |
234 | { |
235 | const struct r_found_version *version = NULL; |
236 | |
237 | if (l->l_info[VERSYMIDX (DT_VERSYM)] != NULL) |
238 | { |
239 | const ElfW(Half) *vernum = |
240 | (const void *) D_PTR (l, l_info[VERSYMIDX (DT_VERSYM)]); |
241 | ElfW(Half) ndx = vernum[ELFW(R_SYM) (reloc->r_info)] & 0x7fff; |
242 | version = &l->l_versions[ndx]; |
243 | if (version->hash == 0) |
244 | version = NULL; |
245 | } |
246 | |
247 | /* We need to keep the scope around so do some locking. This is |
248 | not necessary for objects which cannot be unloaded or when |
249 | we are not using any threads (yet). */ |
250 | int flags = DL_LOOKUP_ADD_DEPENDENCY; |
251 | if (!RTLD_SINGLE_THREAD_P) |
252 | { |
253 | THREAD_GSCOPE_SET_FLAG (); |
254 | flags |= DL_LOOKUP_GSCOPE_LOCK; |
255 | } |
256 | |
257 | result = _dl_lookup_symbol_x (strtab + refsym->st_name, l, |
258 | &defsym, l->l_scope, version, |
259 | ELF_RTYPE_CLASS_PLT, flags, NULL); |
260 | |
261 | /* We are done with the global scope. */ |
262 | if (!RTLD_SINGLE_THREAD_P) |
263 | THREAD_GSCOPE_RESET_FLAG (); |
264 | |
265 | /* Currently result contains the base load address (or link map) |
266 | of the object that defines sym. Now add in the symbol |
267 | offset. */ |
268 | value = DL_FIXUP_MAKE_VALUE (result, |
269 | SYMBOL_ADDRESS (result, defsym, false)); |
270 | |
271 | if (defsym != NULL |
272 | && __builtin_expect (ELFW(ST_TYPE) (defsym->st_info) |
273 | == STT_GNU_IFUNC, 0)) |
274 | value = elf_ifunc_invoke (DL_FIXUP_VALUE_ADDR (value)); |
275 | } |
276 | else |
277 | { |
278 | /* We already found the symbol. The module (and therefore its load |
279 | address) is also known. */ |
280 | value = DL_FIXUP_MAKE_VALUE (l, SYMBOL_ADDRESS (l, refsym, true)); |
281 | |
282 | if (__builtin_expect (ELFW(ST_TYPE) (refsym->st_info) |
283 | == STT_GNU_IFUNC, 0)) |
284 | value = elf_ifunc_invoke (DL_FIXUP_VALUE_ADDR (value)); |
285 | |
286 | result = l; |
287 | } |
288 | /* And now perhaps the relocation addend. */ |
289 | value = elf_machine_plt_value (l, reloc, value); |
290 | |
291 | #ifdef SHARED |
292 | /* Auditing checkpoint: we have a new binding. Provide the |
293 | auditing libraries the possibility to change the value and |
294 | tell us whether further auditing is wanted. */ |
295 | if (defsym != NULL && GLRO(dl_naudit) > 0) |
296 | { |
297 | reloc_result->bound = result; |
298 | /* Compute index of the symbol entry in the symbol table of |
299 | the DSO with the definition. */ |
300 | reloc_result->boundndx = (defsym |
301 | - (ElfW(Sym) *) D_PTR (result, |
302 | l_info[DT_SYMTAB])); |
303 | |
304 | /* Determine whether any of the two participating DSOs is |
305 | interested in auditing. */ |
306 | if ((l->l_audit_any_plt | result->l_audit_any_plt) != 0) |
307 | { |
308 | unsigned int flags = 0; |
309 | struct audit_ifaces *afct = GLRO(dl_audit); |
310 | /* Synthesize a symbol record where the st_value field is |
311 | the result. */ |
312 | ElfW(Sym) sym = *defsym; |
313 | sym.st_value = DL_FIXUP_VALUE_ADDR (value); |
314 | |
315 | /* Keep track whether there is any interest in tracing |
316 | the call in the lower two bits. */ |
317 | assert (DL_NNS * 2 <= sizeof (reloc_result->flags) * 8); |
318 | assert ((LA_SYMB_NOPLTENTER | LA_SYMB_NOPLTEXIT) == 3); |
319 | reloc_result->enterexit = LA_SYMB_NOPLTENTER | LA_SYMB_NOPLTEXIT; |
320 | |
321 | const char *strtab2 = (const void *) D_PTR (result, |
322 | l_info[DT_STRTAB]); |
323 | |
324 | for (unsigned int cnt = 0; cnt < GLRO(dl_naudit); ++cnt) |
325 | { |
326 | /* XXX Check whether both DSOs must request action or |
327 | only one */ |
328 | if ((l->l_audit[cnt].bindflags & LA_FLG_BINDFROM) != 0 |
329 | && (result->l_audit[cnt].bindflags & LA_FLG_BINDTO) != 0) |
330 | { |
331 | if (afct->symbind != NULL) |
332 | { |
333 | uintptr_t new_value |
334 | = afct->symbind (&sym, reloc_result->boundndx, |
335 | &l->l_audit[cnt].cookie, |
336 | &result->l_audit[cnt].cookie, |
337 | &flags, |
338 | strtab2 + defsym->st_name); |
339 | if (new_value != (uintptr_t) sym.st_value) |
340 | { |
341 | flags |= LA_SYMB_ALTVALUE; |
342 | sym.st_value = new_value; |
343 | } |
344 | } |
345 | |
346 | /* Remember the results for every audit library and |
347 | store a summary in the first two bits. */ |
348 | reloc_result->enterexit |
349 | &= flags & (LA_SYMB_NOPLTENTER | LA_SYMB_NOPLTEXIT); |
350 | reloc_result->enterexit |
351 | |= ((flags & (LA_SYMB_NOPLTENTER | LA_SYMB_NOPLTEXIT)) |
352 | << ((cnt + 1) * 2)); |
353 | } |
354 | else |
355 | /* If the bind flags say this auditor is not interested, |
356 | set the bits manually. */ |
357 | reloc_result->enterexit |
358 | |= ((LA_SYMB_NOPLTENTER | LA_SYMB_NOPLTEXIT) |
359 | << ((cnt + 1) * 2)); |
360 | |
361 | afct = afct->next; |
362 | } |
363 | |
364 | reloc_result->flags = flags; |
365 | value = DL_FIXUP_ADDR_VALUE (sym.st_value); |
366 | } |
367 | else |
368 | /* Set all bits since this symbol binding is not interesting. */ |
369 | reloc_result->enterexit = (1u << DL_NNS) - 1; |
370 | } |
371 | #endif |
372 | |
373 | /* Store the result for later runs. */ |
374 | if (__glibc_likely (! GLRO(dl_bind_not))) |
375 | { |
376 | reloc_result->addr = value; |
377 | /* Guarantee all previous writes complete before |
378 | init is updated. See CONCURRENCY NOTES earlier */ |
379 | atomic_store_release (&reloc_result->init, 1); |
380 | } |
381 | init = 1; |
382 | } |
383 | else |
384 | value = reloc_result->addr; |
385 | |
386 | /* By default we do not call the pltexit function. */ |
387 | long int framesize = -1; |
388 | |
389 | |
390 | #ifdef SHARED |
391 | /* Auditing checkpoint: report the PLT entering and allow the |
392 | auditors to change the value. */ |
393 | if (GLRO(dl_naudit) > 0 |
394 | /* Don't do anything if no auditor wants to intercept this call. */ |
395 | && (reloc_result->enterexit & LA_SYMB_NOPLTENTER) == 0) |
396 | { |
397 | /* Sanity check: DL_FIXUP_VALUE_CODE_ADDR (value) should have been |
398 | initialized earlier in this function or in another thread. */ |
399 | assert (DL_FIXUP_VALUE_CODE_ADDR (value) != 0); |
400 | ElfW(Sym) *defsym = ((ElfW(Sym) *) D_PTR (reloc_result->bound, |
401 | l_info[DT_SYMTAB]) |
402 | + reloc_result->boundndx); |
403 | |
404 | /* Set up the sym parameter. */ |
405 | ElfW(Sym) sym = *defsym; |
406 | sym.st_value = DL_FIXUP_VALUE_ADDR (value); |
407 | |
408 | /* Get the symbol name. */ |
409 | const char *strtab = (const void *) D_PTR (reloc_result->bound, |
410 | l_info[DT_STRTAB]); |
411 | const char *symname = strtab + sym.st_name; |
412 | |
413 | /* Keep track of overwritten addresses. */ |
414 | unsigned int flags = reloc_result->flags; |
415 | |
416 | struct audit_ifaces *afct = GLRO(dl_audit); |
417 | for (unsigned int cnt = 0; cnt < GLRO(dl_naudit); ++cnt) |
418 | { |
419 | if (afct->ARCH_LA_PLTENTER != NULL |
420 | && (reloc_result->enterexit |
421 | & (LA_SYMB_NOPLTENTER << (2 * (cnt + 1)))) == 0) |
422 | { |
423 | long int new_framesize = -1; |
424 | uintptr_t new_value |
425 | = afct->ARCH_LA_PLTENTER (&sym, reloc_result->boundndx, |
426 | &l->l_audit[cnt].cookie, |
427 | &reloc_result->bound->l_audit[cnt].cookie, |
428 | regs, &flags, symname, |
429 | &new_framesize); |
430 | if (new_value != (uintptr_t) sym.st_value) |
431 | { |
432 | flags |= LA_SYMB_ALTVALUE; |
433 | sym.st_value = new_value; |
434 | } |
435 | |
436 | /* Remember the results for every audit library and |
437 | store a summary in the first two bits. */ |
438 | reloc_result->enterexit |
439 | |= ((flags & (LA_SYMB_NOPLTENTER | LA_SYMB_NOPLTEXIT)) |
440 | << (2 * (cnt + 1))); |
441 | |
442 | if ((reloc_result->enterexit & (LA_SYMB_NOPLTEXIT |
443 | << (2 * (cnt + 1)))) |
444 | == 0 && new_framesize != -1 && framesize != -2) |
445 | { |
446 | /* If this is the first call providing information, |
447 | use it. */ |
448 | if (framesize == -1) |
449 | framesize = new_framesize; |
450 | /* If two pltenter calls provide conflicting information, |
451 | use the larger value. */ |
452 | else if (new_framesize != framesize) |
453 | framesize = MAX (new_framesize, framesize); |
454 | } |
455 | } |
456 | |
457 | afct = afct->next; |
458 | } |
459 | |
460 | value = DL_FIXUP_ADDR_VALUE (sym.st_value); |
461 | } |
462 | #endif |
463 | |
464 | /* Store the frame size information. */ |
465 | *framesizep = framesize; |
466 | |
467 | (*mcount_fct) (retaddr, DL_FIXUP_VALUE_CODE_ADDR (value)); |
468 | |
469 | return value; |
470 | } |
471 | |
472 | #endif /* PROF */ |
473 | |
474 | |
475 | #include <stdio.h> |
476 | void |
477 | ARCH_FIXUP_ATTRIBUTE |
478 | _dl_call_pltexit (struct link_map *l, ElfW(Word) reloc_arg, |
479 | const void *inregs, void *outregs) |
480 | { |
481 | #ifdef SHARED |
482 | /* This is the address in the array where we store the result of previous |
483 | relocations. */ |
484 | // XXX Maybe the bound information must be stored on the stack since |
485 | // XXX with bind_not a new value could have been stored in the meantime. |
486 | struct reloc_result *reloc_result = &l->l_reloc_result[reloc_index]; |
487 | ElfW(Sym) *defsym = ((ElfW(Sym) *) D_PTR (reloc_result->bound, |
488 | l_info[DT_SYMTAB]) |
489 | + reloc_result->boundndx); |
490 | |
491 | /* Set up the sym parameter. */ |
492 | ElfW(Sym) sym = *defsym; |
493 | sym.st_value = DL_FIXUP_VALUE_ADDR (reloc_result->addr); |
494 | |
495 | /* Get the symbol name. */ |
496 | const char *strtab = (const void *) D_PTR (reloc_result->bound, |
497 | l_info[DT_STRTAB]); |
498 | const char *symname = strtab + sym.st_name; |
499 | |
500 | struct audit_ifaces *afct = GLRO(dl_audit); |
501 | for (unsigned int cnt = 0; cnt < GLRO(dl_naudit); ++cnt) |
502 | { |
503 | if (afct->ARCH_LA_PLTEXIT != NULL |
504 | && (reloc_result->enterexit |
505 | & (LA_SYMB_NOPLTEXIT >> (2 * cnt))) == 0) |
506 | { |
507 | afct->ARCH_LA_PLTEXIT (&sym, reloc_result->boundndx, |
508 | &l->l_audit[cnt].cookie, |
509 | &reloc_result->bound->l_audit[cnt].cookie, |
510 | inregs, outregs, symname); |
511 | } |
512 | |
513 | afct = afct->next; |
514 | } |
515 | #endif |
516 | } |
517 | |