1/* Look up a symbol in the loaded objects.
2 Copyright (C) 1995-2020 Free Software Foundation, Inc.
3 This file is part of the GNU C Library.
4
5 The GNU C Library is free software; you can redistribute it and/or
6 modify it under the terms of the GNU Lesser General Public
7 License as published by the Free Software Foundation; either
8 version 2.1 of the License, or (at your option) any later version.
9
10 The GNU C Library is distributed in the hope that it will be useful,
11 but WITHOUT ANY WARRANTY; without even the implied warranty of
12 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
13 Lesser General Public License for more details.
14
15 You should have received a copy of the GNU Lesser General Public
16 License along with the GNU C Library; if not, see
17 <https://www.gnu.org/licenses/>. */
18
19#include <alloca.h>
20#include <libintl.h>
21#include <stdlib.h>
22#include <string.h>
23#include <unistd.h>
24#include <ldsodefs.h>
25#include <dl-hash.h>
26#include <dl-machine.h>
27#include <sysdep-cancel.h>
28#include <libc-lock.h>
29#include <tls.h>
30#include <atomic.h>
31
32#include <assert.h>
33
34/* Return nonzero if check_match should consider SYM to fail to match a
35 symbol reference for some machine-specific reason. */
36#ifndef ELF_MACHINE_SYM_NO_MATCH
37# define ELF_MACHINE_SYM_NO_MATCH(sym) 0
38#endif
39
40#define VERSTAG(tag) (DT_NUM + DT_THISPROCNUM + DT_VERSIONTAGIDX (tag))
41
42
43struct sym_val
44 {
45 const ElfW(Sym) *s;
46 struct link_map *m;
47 };
48
49
50/* Statistics function. */
51#ifdef SHARED
52# define bump_num_relocations() ++GL(dl_num_relocations)
53#else
54# define bump_num_relocations() ((void) 0)
55#endif
56
57/* Utility function for do_lookup_x. The caller is called with undef_name,
58 ref, version, flags and type_class, and those are passed as the first
59 five arguments. The caller then computes sym, symidx, strtab, and map
60 and passes them as the next four arguments. Lastly the caller passes in
61 versioned_sym and num_versions which are modified by check_match during
62 the checking process. */
63static const ElfW(Sym) *
64check_match (const char *const undef_name,
65 const ElfW(Sym) *const ref,
66 const struct r_found_version *const version,
67 const int flags,
68 const int type_class,
69 const ElfW(Sym) *const sym,
70 const Elf_Symndx symidx,
71 const char *const strtab,
72 const struct link_map *const map,
73 const ElfW(Sym) **const versioned_sym,
74 int *const num_versions)
75{
76 unsigned int stt = ELFW(ST_TYPE) (sym->st_info);
77 assert (ELF_RTYPE_CLASS_PLT == 1);
78 if (__glibc_unlikely ((sym->st_value == 0 /* No value. */
79 && sym->st_shndx != SHN_ABS
80 && stt != STT_TLS)
81 || ELF_MACHINE_SYM_NO_MATCH (sym)
82 || (type_class & (sym->st_shndx == SHN_UNDEF))))
83 return NULL;
84
85 /* Ignore all but STT_NOTYPE, STT_OBJECT, STT_FUNC,
86 STT_COMMON, STT_TLS, and STT_GNU_IFUNC since these are no
87 code/data definitions. */
88#define ALLOWED_STT \
89 ((1 << STT_NOTYPE) | (1 << STT_OBJECT) | (1 << STT_FUNC) \
90 | (1 << STT_COMMON) | (1 << STT_TLS) | (1 << STT_GNU_IFUNC))
91 if (__glibc_unlikely (((1 << stt) & ALLOWED_STT) == 0))
92 return NULL;
93
94 if (sym != ref && strcmp (strtab + sym->st_name, undef_name))
95 /* Not the symbol we are looking for. */
96 return NULL;
97
98 const ElfW(Half) *verstab = map->l_versyms;
99 if (version != NULL)
100 {
101 if (__glibc_unlikely (verstab == NULL))
102 {
103 /* We need a versioned symbol but haven't found any. If
104 this is the object which is referenced in the verneed
105 entry it is a bug in the library since a symbol must
106 not simply disappear.
107
108 It would also be a bug in the object since it means that
109 the list of required versions is incomplete and so the
110 tests in dl-version.c haven't found a problem.*/
111 assert (version->filename == NULL
112 || ! _dl_name_match_p (version->filename, map));
113
114 /* Otherwise we accept the symbol. */
115 }
116 else
117 {
118 /* We can match the version information or use the
119 default one if it is not hidden. */
120 ElfW(Half) ndx = verstab[symidx] & 0x7fff;
121 if ((map->l_versions[ndx].hash != version->hash
122 || strcmp (map->l_versions[ndx].name, version->name))
123 && (version->hidden || map->l_versions[ndx].hash
124 || (verstab[symidx] & 0x8000)))
125 /* It's not the version we want. */
126 return NULL;
127 }
128 }
129 else
130 {
131 /* No specific version is selected. There are two ways we
132 can got here:
133
134 - a binary which does not include versioning information
135 is loaded
136
137 - dlsym() instead of dlvsym() is used to get a symbol which
138 might exist in more than one form
139
140 If the library does not provide symbol version information
141 there is no problem at all: we simply use the symbol if it
142 is defined.
143
144 These two lookups need to be handled differently if the
145 library defines versions. In the case of the old
146 unversioned application the oldest (default) version
147 should be used. In case of a dlsym() call the latest and
148 public interface should be returned. */
149 if (verstab != NULL)
150 {
151 if ((verstab[symidx] & 0x7fff)
152 >= ((flags & DL_LOOKUP_RETURN_NEWEST) ? 2 : 3))
153 {
154 /* Don't accept hidden symbols. */
155 if ((verstab[symidx] & 0x8000) == 0
156 && (*num_versions)++ == 0)
157 /* No version so far. */
158 *versioned_sym = sym;
159
160 return NULL;
161 }
162 }
163 }
164
165 /* There cannot be another entry for this symbol so stop here. */
166 return sym;
167}
168
169/* Utility function for do_lookup_unique. Add a symbol to TABLE. */
170static void
171enter_unique_sym (struct unique_sym *table, size_t size,
172 unsigned int hash, const char *name,
173 const ElfW(Sym) *sym, const struct link_map *map)
174{
175 size_t idx = hash % size;
176 size_t hash2 = 1 + hash % (size - 2);
177 while (table[idx].name != NULL)
178 {
179 idx += hash2;
180 if (idx >= size)
181 idx -= size;
182 }
183
184 table[idx].hashval = hash;
185 table[idx].name = name;
186 table[idx].sym = sym;
187 table[idx].map = map;
188}
189
190/* Mark MAP as NODELETE according to the lookup mode in FLAGS. During
191 initial relocation, NODELETE state is pending only. */
192static void
193mark_nodelete (struct link_map *map, int flags)
194{
195 if (flags & DL_LOOKUP_FOR_RELOCATE)
196 map->l_nodelete_pending = true;
197 else
198 map->l_nodelete_active = true;
199}
200
201/* Return true if MAP is marked as NODELETE according to the lookup
202 mode in FLAGS> */
203static bool
204is_nodelete (struct link_map *map, int flags)
205{
206 /* Non-pending NODELETE always counts. Pending NODELETE only counts
207 during initial relocation processing. */
208 return map->l_nodelete_active
209 || ((flags & DL_LOOKUP_FOR_RELOCATE) && map->l_nodelete_pending);
210}
211
212/* Utility function for do_lookup_x. Lookup an STB_GNU_UNIQUE symbol
213 in the unique symbol table, creating a new entry if necessary.
214 Return the matching symbol in RESULT. */
215static void
216do_lookup_unique (const char *undef_name, uint_fast32_t new_hash,
217 struct link_map *map, struct sym_val *result,
218 int type_class, const ElfW(Sym) *sym, const char *strtab,
219 const ElfW(Sym) *ref, const struct link_map *undef_map,
220 int flags)
221{
222 /* We have to determine whether we already found a symbol with this
223 name before. If not then we have to add it to the search table.
224 If we already found a definition we have to use it. */
225
226 struct unique_sym_table *tab
227 = &GL(dl_ns)[map->l_ns]._ns_unique_sym_table;
228
229 __rtld_lock_lock_recursive (tab->lock);
230
231 struct unique_sym *entries = tab->entries;
232 size_t size = tab->size;
233 if (entries != NULL)
234 {
235 size_t idx = new_hash % size;
236 size_t hash2 = 1 + new_hash % (size - 2);
237 while (1)
238 {
239 if (entries[idx].hashval == new_hash
240 && strcmp (entries[idx].name, undef_name) == 0)
241 {
242 if ((type_class & ELF_RTYPE_CLASS_COPY) != 0)
243 {
244 /* We possibly have to initialize the central
245 copy from the copy addressed through the
246 relocation. */
247 result->s = sym;
248 result->m = map;
249 }
250 else
251 {
252 result->s = entries[idx].sym;
253 result->m = (struct link_map *) entries[idx].map;
254 }
255 __rtld_lock_unlock_recursive (tab->lock);
256 return;
257 }
258
259 if (entries[idx].name == NULL)
260 break;
261
262 idx += hash2;
263 if (idx >= size)
264 idx -= size;
265 }
266
267 if (size * 3 <= tab->n_elements * 4)
268 {
269 /* Expand the table. */
270#ifdef RTLD_CHECK_FOREIGN_CALL
271 /* This must not happen during runtime relocations. */
272 assert (!RTLD_CHECK_FOREIGN_CALL);
273#endif
274 size_t newsize = _dl_higher_prime_number (size + 1);
275 struct unique_sym *newentries
276 = calloc (sizeof (struct unique_sym), newsize);
277 if (newentries == NULL)
278 {
279 nomem:
280 __rtld_lock_unlock_recursive (tab->lock);
281 _dl_fatal_printf ("out of memory\n");
282 }
283
284 for (idx = 0; idx < size; ++idx)
285 if (entries[idx].name != NULL)
286 enter_unique_sym (newentries, newsize, entries[idx].hashval,
287 entries[idx].name, entries[idx].sym,
288 entries[idx].map);
289
290 tab->free (entries);
291 tab->size = newsize;
292 size = newsize;
293 entries = tab->entries = newentries;
294 tab->free = free;
295 }
296 }
297 else
298 {
299#ifdef RTLD_CHECK_FOREIGN_CALL
300 /* This must not happen during runtime relocations. */
301 assert (!RTLD_CHECK_FOREIGN_CALL);
302#endif
303
304#ifdef SHARED
305 /* If tab->entries is NULL, but tab->size is not, it means
306 this is the second, conflict finding, lookup for
307 LD_TRACE_PRELINKING in _dl_debug_bindings. Don't
308 allocate anything and don't enter anything into the
309 hash table. */
310 if (__glibc_unlikely (tab->size))
311 {
312 assert (GLRO(dl_debug_mask) & DL_DEBUG_PRELINK);
313 goto success;
314 }
315#endif
316
317#define INITIAL_NUNIQUE_SYM_TABLE 31
318 size = INITIAL_NUNIQUE_SYM_TABLE;
319 entries = calloc (sizeof (struct unique_sym), size);
320 if (entries == NULL)
321 goto nomem;
322
323 tab->entries = entries;
324 tab->size = size;
325 tab->free = free;
326 }
327
328 if ((type_class & ELF_RTYPE_CLASS_COPY) != 0)
329 enter_unique_sym (entries, size, new_hash, strtab + sym->st_name, ref,
330 undef_map);
331 else
332 {
333 enter_unique_sym (entries, size,
334 new_hash, strtab + sym->st_name, sym, map);
335
336 if (map->l_type == lt_loaded && !is_nodelete (map, flags))
337 {
338 /* Make sure we don't unload this object by
339 setting the appropriate flag. */
340 if (__glibc_unlikely (GLRO (dl_debug_mask) & DL_DEBUG_BINDINGS))
341 _dl_debug_printf ("\
342marking %s [%lu] as NODELETE due to unique symbol\n",
343 map->l_name, map->l_ns);
344 mark_nodelete (map, flags);
345 }
346 }
347 ++tab->n_elements;
348
349#ifdef SHARED
350 success:
351#endif
352 __rtld_lock_unlock_recursive (tab->lock);
353
354 result->s = sym;
355 result->m = (struct link_map *) map;
356}
357
358/* Inner part of the lookup functions. We return a value > 0 if we
359 found the symbol, the value 0 if nothing is found and < 0 if
360 something bad happened. */
361static int
362__attribute_noinline__
363do_lookup_x (const char *undef_name, uint_fast32_t new_hash,
364 unsigned long int *old_hash, const ElfW(Sym) *ref,
365 struct sym_val *result, struct r_scope_elem *scope, size_t i,
366 const struct r_found_version *const version, int flags,
367 struct link_map *skip, int type_class, struct link_map *undef_map)
368{
369 size_t n = scope->r_nlist;
370 /* Make sure we read the value before proceeding. Otherwise we
371 might use r_list pointing to the initial scope and r_nlist being
372 the value after a resize. That is the only path in dl-open.c not
373 protected by GSCOPE. A read barrier here might be to expensive. */
374 __asm volatile ("" : "+r" (n), "+m" (scope->r_list));
375 struct link_map **list = scope->r_list;
376
377 do
378 {
379 const struct link_map *map = list[i]->l_real;
380
381 /* Here come the extra test needed for `_dl_lookup_symbol_skip'. */
382 if (map == skip)
383 continue;
384
385 /* Don't search the executable when resolving a copy reloc. */
386 if ((type_class & ELF_RTYPE_CLASS_COPY) && map->l_type == lt_executable)
387 continue;
388
389 /* Do not look into objects which are going to be removed. */
390 if (map->l_removed)
391 continue;
392
393 /* Print some debugging info if wanted. */
394 if (__glibc_unlikely (GLRO(dl_debug_mask) & DL_DEBUG_SYMBOLS))
395 _dl_debug_printf ("symbol=%s; lookup in file=%s [%lu]\n",
396 undef_name, DSO_FILENAME (map->l_name),
397 map->l_ns);
398
399 /* If the hash table is empty there is nothing to do here. */
400 if (map->l_nbuckets == 0)
401 continue;
402
403 Elf_Symndx symidx;
404 int num_versions = 0;
405 const ElfW(Sym) *versioned_sym = NULL;
406
407 /* The tables for this map. */
408 const ElfW(Sym) *symtab = (const void *) D_PTR (map, l_info[DT_SYMTAB]);
409 const char *strtab = (const void *) D_PTR (map, l_info[DT_STRTAB]);
410
411 const ElfW(Sym) *sym;
412 const ElfW(Addr) *bitmask = map->l_gnu_bitmask;
413 if (__glibc_likely (bitmask != NULL))
414 {
415 ElfW(Addr) bitmask_word
416 = bitmask[(new_hash / __ELF_NATIVE_CLASS)
417 & map->l_gnu_bitmask_idxbits];
418
419 unsigned int hashbit1 = new_hash & (__ELF_NATIVE_CLASS - 1);
420 unsigned int hashbit2 = ((new_hash >> map->l_gnu_shift)
421 & (__ELF_NATIVE_CLASS - 1));
422
423 if (__glibc_unlikely ((bitmask_word >> hashbit1)
424 & (bitmask_word >> hashbit2) & 1))
425 {
426 Elf32_Word bucket = map->l_gnu_buckets[new_hash
427 % map->l_nbuckets];
428 if (bucket != 0)
429 {
430 const Elf32_Word *hasharr = &map->l_gnu_chain_zero[bucket];
431
432 do
433 if (((*hasharr ^ new_hash) >> 1) == 0)
434 {
435 symidx = ELF_MACHINE_HASH_SYMIDX (map, hasharr);
436 sym = check_match (undef_name, ref, version, flags,
437 type_class, &symtab[symidx], symidx,
438 strtab, map, &versioned_sym,
439 &num_versions);
440 if (sym != NULL)
441 goto found_it;
442 }
443 while ((*hasharr++ & 1u) == 0);
444 }
445 }
446 /* No symbol found. */
447 symidx = SHN_UNDEF;
448 }
449 else
450 {
451 if (*old_hash == 0xffffffff)
452 *old_hash = _dl_elf_hash (undef_name);
453
454 /* Use the old SysV-style hash table. Search the appropriate
455 hash bucket in this object's symbol table for a definition
456 for the same symbol name. */
457 for (symidx = map->l_buckets[*old_hash % map->l_nbuckets];
458 symidx != STN_UNDEF;
459 symidx = map->l_chain[symidx])
460 {
461 sym = check_match (undef_name, ref, version, flags,
462 type_class, &symtab[symidx], symidx,
463 strtab, map, &versioned_sym,
464 &num_versions);
465 if (sym != NULL)
466 goto found_it;
467 }
468 }
469
470 /* If we have seen exactly one versioned symbol while we are
471 looking for an unversioned symbol and the version is not the
472 default version we still accept this symbol since there are
473 no possible ambiguities. */
474 sym = num_versions == 1 ? versioned_sym : NULL;
475
476 if (sym != NULL)
477 {
478 found_it:
479 /* When UNDEF_MAP is NULL, which indicates we are called from
480 do_lookup_x on relocation against protected data, we skip
481 the data definion in the executable from copy reloc. */
482 if (ELF_RTYPE_CLASS_EXTERN_PROTECTED_DATA
483 && undef_map == NULL
484 && map->l_type == lt_executable
485 && type_class == ELF_RTYPE_CLASS_EXTERN_PROTECTED_DATA)
486 {
487 const ElfW(Sym) *s;
488 unsigned int i;
489
490#if ! ELF_MACHINE_NO_RELA
491 if (map->l_info[DT_RELA] != NULL
492 && map->l_info[DT_RELASZ] != NULL
493 && map->l_info[DT_RELASZ]->d_un.d_val != 0)
494 {
495 const ElfW(Rela) *rela
496 = (const ElfW(Rela) *) D_PTR (map, l_info[DT_RELA]);
497 unsigned int rela_count
498 = map->l_info[DT_RELASZ]->d_un.d_val / sizeof (*rela);
499
500 for (i = 0; i < rela_count; i++, rela++)
501 if (elf_machine_type_class (ELFW(R_TYPE) (rela->r_info))
502 == ELF_RTYPE_CLASS_COPY)
503 {
504 s = &symtab[ELFW(R_SYM) (rela->r_info)];
505 if (!strcmp (strtab + s->st_name, undef_name))
506 goto skip;
507 }
508 }
509#endif
510#if ! ELF_MACHINE_NO_REL
511 if (map->l_info[DT_REL] != NULL
512 && map->l_info[DT_RELSZ] != NULL
513 && map->l_info[DT_RELSZ]->d_un.d_val != 0)
514 {
515 const ElfW(Rel) *rel
516 = (const ElfW(Rel) *) D_PTR (map, l_info[DT_REL]);
517 unsigned int rel_count
518 = map->l_info[DT_RELSZ]->d_un.d_val / sizeof (*rel);
519
520 for (i = 0; i < rel_count; i++, rel++)
521 if (elf_machine_type_class (ELFW(R_TYPE) (rel->r_info))
522 == ELF_RTYPE_CLASS_COPY)
523 {
524 s = &symtab[ELFW(R_SYM) (rel->r_info)];
525 if (!strcmp (strtab + s->st_name, undef_name))
526 goto skip;
527 }
528 }
529#endif
530 }
531
532 /* Hidden and internal symbols are local, ignore them. */
533 if (__glibc_unlikely (dl_symbol_visibility_binds_local_p (sym)))
534 goto skip;
535
536 switch (ELFW(ST_BIND) (sym->st_info))
537 {
538 case STB_WEAK:
539 /* Weak definition. Use this value if we don't find another. */
540 if (__glibc_unlikely (GLRO(dl_dynamic_weak)))
541 {
542 if (! result->s)
543 {
544 result->s = sym;
545 result->m = (struct link_map *) map;
546 }
547 break;
548 }
549 /* FALLTHROUGH */
550 case STB_GLOBAL:
551 /* Global definition. Just what we need. */
552 result->s = sym;
553 result->m = (struct link_map *) map;
554 return 1;
555
556 case STB_GNU_UNIQUE:;
557 do_lookup_unique (undef_name, new_hash, (struct link_map *) map,
558 result, type_class, sym, strtab, ref,
559 undef_map, flags);
560 return 1;
561
562 default:
563 /* Local symbols are ignored. */
564 break;
565 }
566 }
567
568skip:
569 ;
570 }
571 while (++i < n);
572
573 /* We have not found anything until now. */
574 return 0;
575}
576
577
578static uint_fast32_t
579dl_new_hash (const char *s)
580{
581 uint_fast32_t h = 5381;
582 for (unsigned char c = *s; c != '\0'; c = *++s)
583 h = h * 33 + c;
584 return h & 0xffffffff;
585}
586
587
588/* Add extra dependency on MAP to UNDEF_MAP. */
589static int
590add_dependency (struct link_map *undef_map, struct link_map *map, int flags)
591{
592 struct link_map *runp;
593 unsigned int i;
594 int result = 0;
595
596 /* Avoid self-references and references to objects which cannot be
597 unloaded anyway. */
598 if (undef_map == map)
599 return 0;
600
601 /* Avoid references to objects which cannot be unloaded anyway. We
602 do not need to record dependencies if this object goes away
603 during dlopen failure, either. IFUNC resolvers with relocation
604 dependencies may pick an dependency which can be dlclose'd, but
605 such IFUNC resolvers are undefined anyway. */
606 assert (map->l_type == lt_loaded);
607 if (is_nodelete (map, flags))
608 return 0;
609
610 struct link_map_reldeps *l_reldeps
611 = atomic_forced_read (undef_map->l_reldeps);
612
613 /* Make sure l_reldeps is read before l_initfini. */
614 atomic_read_barrier ();
615
616 /* Determine whether UNDEF_MAP already has a reference to MAP. First
617 look in the normal dependencies. */
618 struct link_map **l_initfini = atomic_forced_read (undef_map->l_initfini);
619 if (l_initfini != NULL)
620 {
621 for (i = 0; l_initfini[i] != NULL; ++i)
622 if (l_initfini[i] == map)
623 return 0;
624 }
625
626 /* No normal dependency. See whether we already had to add it
627 to the special list of dynamic dependencies. */
628 unsigned int l_reldepsact = 0;
629 if (l_reldeps != NULL)
630 {
631 struct link_map **list = &l_reldeps->list[0];
632 l_reldepsact = l_reldeps->act;
633 for (i = 0; i < l_reldepsact; ++i)
634 if (list[i] == map)
635 return 0;
636 }
637
638 /* Save serial number of the target MAP. */
639 unsigned long long serial = map->l_serial;
640
641 /* Make sure nobody can unload the object while we are at it. */
642 if (__glibc_unlikely (flags & DL_LOOKUP_GSCOPE_LOCK))
643 {
644 /* We can't just call __rtld_lock_lock_recursive (GL(dl_load_lock))
645 here, that can result in ABBA deadlock. */
646 THREAD_GSCOPE_RESET_FLAG ();
647 __rtld_lock_lock_recursive (GL(dl_load_lock));
648 /* While MAP value won't change, after THREAD_GSCOPE_RESET_FLAG ()
649 it can e.g. point to unallocated memory. So avoid the optimizer
650 treating the above read from MAP->l_serial as ensurance it
651 can safely dereference it. */
652 map = atomic_forced_read (map);
653
654 /* From this point on it is unsafe to dereference MAP, until it
655 has been found in one of the lists. */
656
657 /* Redo the l_initfini check in case undef_map's l_initfini
658 changed in the mean time. */
659 if (undef_map->l_initfini != l_initfini
660 && undef_map->l_initfini != NULL)
661 {
662 l_initfini = undef_map->l_initfini;
663 for (i = 0; l_initfini[i] != NULL; ++i)
664 if (l_initfini[i] == map)
665 goto out_check;
666 }
667
668 /* Redo the l_reldeps check if undef_map's l_reldeps changed in
669 the mean time. */
670 if (undef_map->l_reldeps != NULL)
671 {
672 if (undef_map->l_reldeps != l_reldeps)
673 {
674 struct link_map **list = &undef_map->l_reldeps->list[0];
675 l_reldepsact = undef_map->l_reldeps->act;
676 for (i = 0; i < l_reldepsact; ++i)
677 if (list[i] == map)
678 goto out_check;
679 }
680 else if (undef_map->l_reldeps->act > l_reldepsact)
681 {
682 struct link_map **list
683 = &undef_map->l_reldeps->list[0];
684 i = l_reldepsact;
685 l_reldepsact = undef_map->l_reldeps->act;
686 for (; i < l_reldepsact; ++i)
687 if (list[i] == map)
688 goto out_check;
689 }
690 }
691 }
692 else
693 __rtld_lock_lock_recursive (GL(dl_load_lock));
694
695 /* The object is not yet in the dependency list. Before we add
696 it make sure just one more time the object we are about to
697 reference is still available. There is a brief period in
698 which the object could have been removed since we found the
699 definition. */
700 runp = GL(dl_ns)[undef_map->l_ns]._ns_loaded;
701 while (runp != NULL && runp != map)
702 runp = runp->l_next;
703
704 if (runp != NULL)
705 {
706 /* The object is still available. */
707
708 /* MAP could have been dlclosed, freed and then some other dlopened
709 library could have the same link_map pointer. */
710 if (map->l_serial != serial)
711 goto out_check;
712
713 /* Redo the NODELETE check, as when dl_load_lock wasn't held
714 yet this could have changed. */
715 if (is_nodelete (map, flags))
716 goto out;
717
718 /* If the object with the undefined reference cannot be removed ever
719 just make sure the same is true for the object which contains the
720 definition. */
721 if (undef_map->l_type != lt_loaded || is_nodelete (map, flags))
722 {
723 if (__glibc_unlikely (GLRO (dl_debug_mask) & DL_DEBUG_BINDINGS)
724 && !is_nodelete (map, flags))
725 {
726 if (undef_map->l_name[0] == '\0')
727 _dl_debug_printf ("\
728marking %s [%lu] as NODELETE due to reference to main program\n",
729 map->l_name, map->l_ns);
730 else
731 _dl_debug_printf ("\
732marking %s [%lu] as NODELETE due to reference to %s [%lu]\n",
733 map->l_name, map->l_ns,
734 undef_map->l_name, undef_map->l_ns);
735 }
736 mark_nodelete (map, flags);
737 goto out;
738 }
739
740 /* Add the reference now. */
741 if (__glibc_unlikely (l_reldepsact >= undef_map->l_reldepsmax))
742 {
743 /* Allocate more memory for the dependency list. Since this
744 can never happen during the startup phase we can use
745 `realloc'. */
746 struct link_map_reldeps *newp;
747 unsigned int max
748 = undef_map->l_reldepsmax ? undef_map->l_reldepsmax * 2 : 10;
749
750#ifdef RTLD_PREPARE_FOREIGN_CALL
751 RTLD_PREPARE_FOREIGN_CALL;
752#endif
753
754 newp = malloc (sizeof (*newp) + max * sizeof (struct link_map *));
755 if (newp == NULL)
756 {
757 /* If we didn't manage to allocate memory for the list this is
758 no fatal problem. We simply make sure the referenced object
759 cannot be unloaded. This is semantically the correct
760 behavior. */
761 if (__glibc_unlikely (GLRO (dl_debug_mask) & DL_DEBUG_BINDINGS)
762 && !is_nodelete (map, flags))
763 _dl_debug_printf ("\
764marking %s [%lu] as NODELETE due to memory allocation failure\n",
765 map->l_name, map->l_ns);
766 /* In case of non-lazy binding, we could actually report
767 the memory allocation error, but for now, we use the
768 conservative approximation as well. */
769 mark_nodelete (map, flags);
770 goto out;
771 }
772 else
773 {
774 if (l_reldepsact)
775 memcpy (&newp->list[0], &undef_map->l_reldeps->list[0],
776 l_reldepsact * sizeof (struct link_map *));
777 newp->list[l_reldepsact] = map;
778 newp->act = l_reldepsact + 1;
779 atomic_write_barrier ();
780 void *old = undef_map->l_reldeps;
781 undef_map->l_reldeps = newp;
782 undef_map->l_reldepsmax = max;
783 if (old)
784 _dl_scope_free (old);
785 }
786 }
787 else
788 {
789 undef_map->l_reldeps->list[l_reldepsact] = map;
790 atomic_write_barrier ();
791 undef_map->l_reldeps->act = l_reldepsact + 1;
792 }
793
794 /* Display information if we are debugging. */
795 if (__glibc_unlikely (GLRO(dl_debug_mask) & DL_DEBUG_FILES))
796 _dl_debug_printf ("\
797\nfile=%s [%lu]; needed by %s [%lu] (relocation dependency)\n\n",
798 DSO_FILENAME (map->l_name),
799 map->l_ns,
800 DSO_FILENAME (undef_map->l_name),
801 undef_map->l_ns);
802 }
803 else
804 /* Whoa, that was bad luck. We have to search again. */
805 result = -1;
806
807 out:
808 /* Release the lock. */
809 __rtld_lock_unlock_recursive (GL(dl_load_lock));
810
811 if (__glibc_unlikely (flags & DL_LOOKUP_GSCOPE_LOCK))
812 THREAD_GSCOPE_SET_FLAG ();
813
814 return result;
815
816 out_check:
817 if (map->l_serial != serial)
818 result = -1;
819 goto out;
820}
821
822static void
823_dl_debug_bindings (const char *undef_name, struct link_map *undef_map,
824 const ElfW(Sym) **ref, struct sym_val *value,
825 const struct r_found_version *version, int type_class,
826 int protected);
827
828
829/* Search loaded objects' symbol tables for a definition of the symbol
830 UNDEF_NAME, perhaps with a requested version for the symbol.
831
832 We must never have calls to the audit functions inside this function
833 or in any function which gets called. If this would happen the audit
834 code might create a thread which can throw off all the scope locking. */
835lookup_t
836_dl_lookup_symbol_x (const char *undef_name, struct link_map *undef_map,
837 const ElfW(Sym) **ref,
838 struct r_scope_elem *symbol_scope[],
839 const struct r_found_version *version,
840 int type_class, int flags, struct link_map *skip_map)
841{
842 const uint_fast32_t new_hash = dl_new_hash (undef_name);
843 unsigned long int old_hash = 0xffffffff;
844 struct sym_val current_value = { NULL, NULL };
845 struct r_scope_elem **scope = symbol_scope;
846
847 bump_num_relocations ();
848
849 /* DL_LOOKUP_RETURN_NEWEST does not make sense for versioned
850 lookups. */
851 assert (version == NULL || !(flags & DL_LOOKUP_RETURN_NEWEST));
852
853 size_t i = 0;
854 if (__glibc_unlikely (skip_map != NULL))
855 /* Search the relevant loaded objects for a definition. */
856 while ((*scope)->r_list[i] != skip_map)
857 ++i;
858
859 /* Search the relevant loaded objects for a definition. */
860 for (size_t start = i; *scope != NULL; start = 0, ++scope)
861 if (do_lookup_x (undef_name, new_hash, &old_hash, *ref,
862 &current_value, *scope, start, version, flags,
863 skip_map, type_class, undef_map) != 0)
864 break;
865
866 if (__glibc_unlikely (current_value.s == NULL))
867 {
868 if ((*ref == NULL || ELFW(ST_BIND) ((*ref)->st_info) != STB_WEAK)
869 && !(GLRO(dl_debug_mask) & DL_DEBUG_UNUSED))
870 {
871 /* We could find no value for a strong reference. */
872 const char *reference_name = undef_map ? undef_map->l_name : "";
873 const char *versionstr = version ? ", version " : "";
874 const char *versionname = (version && version->name
875 ? version->name : "");
876 struct dl_exception exception;
877 /* XXX We cannot translate the message. */
878 _dl_exception_create_format
879 (&exception, DSO_FILENAME (reference_name),
880 "undefined symbol: %s%s%s",
881 undef_name, versionstr, versionname);
882 _dl_signal_cexception (0, &exception, N_("symbol lookup error"));
883 _dl_exception_free (&exception);
884 }
885 *ref = NULL;
886 return 0;
887 }
888
889 int protected = (*ref
890 && ELFW(ST_VISIBILITY) ((*ref)->st_other) == STV_PROTECTED);
891 if (__glibc_unlikely (protected != 0))
892 {
893 /* It is very tricky. We need to figure out what value to
894 return for the protected symbol. */
895 if (type_class == ELF_RTYPE_CLASS_PLT)
896 {
897 if (current_value.s != NULL && current_value.m != undef_map)
898 {
899 current_value.s = *ref;
900 current_value.m = undef_map;
901 }
902 }
903 else
904 {
905 struct sym_val protected_value = { NULL, NULL };
906
907 for (scope = symbol_scope; *scope != NULL; i = 0, ++scope)
908 if (do_lookup_x (undef_name, new_hash, &old_hash, *ref,
909 &protected_value, *scope, i, version, flags,
910 skip_map,
911 (ELF_RTYPE_CLASS_EXTERN_PROTECTED_DATA
912 && ELFW(ST_TYPE) ((*ref)->st_info) == STT_OBJECT
913 && type_class == ELF_RTYPE_CLASS_EXTERN_PROTECTED_DATA)
914 ? ELF_RTYPE_CLASS_EXTERN_PROTECTED_DATA
915 : ELF_RTYPE_CLASS_PLT, NULL) != 0)
916 break;
917
918 if (protected_value.s != NULL && protected_value.m != undef_map)
919 {
920 current_value.s = *ref;
921 current_value.m = undef_map;
922 }
923 }
924 }
925
926 /* We have to check whether this would bind UNDEF_MAP to an object
927 in the global scope which was dynamically loaded. In this case
928 we have to prevent the latter from being unloaded unless the
929 UNDEF_MAP object is also unloaded. */
930 if (__glibc_unlikely (current_value.m->l_type == lt_loaded)
931 /* Don't do this for explicit lookups as opposed to implicit
932 runtime lookups. */
933 && (flags & DL_LOOKUP_ADD_DEPENDENCY) != 0
934 /* Add UNDEF_MAP to the dependencies. */
935 && add_dependency (undef_map, current_value.m, flags) < 0)
936 /* Something went wrong. Perhaps the object we tried to reference
937 was just removed. Try finding another definition. */
938 return _dl_lookup_symbol_x (undef_name, undef_map, ref,
939 (flags & DL_LOOKUP_GSCOPE_LOCK)
940 ? undef_map->l_scope : symbol_scope,
941 version, type_class, flags, skip_map);
942
943 /* The object is used. */
944 if (__glibc_unlikely (current_value.m->l_used == 0))
945 current_value.m->l_used = 1;
946
947 if (__glibc_unlikely (GLRO(dl_debug_mask)
948 & (DL_DEBUG_BINDINGS|DL_DEBUG_PRELINK)))
949 _dl_debug_bindings (undef_name, undef_map, ref,
950 &current_value, version, type_class, protected);
951
952 *ref = current_value.s;
953 return LOOKUP_VALUE (current_value.m);
954}
955
956
957/* Cache the location of MAP's hash table. */
958
959void
960_dl_setup_hash (struct link_map *map)
961{
962 Elf_Symndx *hash;
963
964 if (__glibc_likely (map->l_info[ELF_MACHINE_GNU_HASH_ADDRIDX] != NULL))
965 {
966 Elf32_Word *hash32
967 = (void *) D_PTR (map, l_info[ELF_MACHINE_GNU_HASH_ADDRIDX]);
968 map->l_nbuckets = *hash32++;
969 Elf32_Word symbias = *hash32++;
970 Elf32_Word bitmask_nwords = *hash32++;
971 /* Must be a power of two. */
972 assert ((bitmask_nwords & (bitmask_nwords - 1)) == 0);
973 map->l_gnu_bitmask_idxbits = bitmask_nwords - 1;
974 map->l_gnu_shift = *hash32++;
975
976 map->l_gnu_bitmask = (ElfW(Addr) *) hash32;
977 hash32 += __ELF_NATIVE_CLASS / 32 * bitmask_nwords;
978
979 map->l_gnu_buckets = hash32;
980 hash32 += map->l_nbuckets;
981 map->l_gnu_chain_zero = hash32 - symbias;
982
983 /* Initialize MIPS xhash translation table. */
984 ELF_MACHINE_XHASH_SETUP (hash32, symbias, map);
985
986 return;
987 }
988
989 if (!map->l_info[DT_HASH])
990 return;
991 hash = (void *) D_PTR (map, l_info[DT_HASH]);
992
993 map->l_nbuckets = *hash++;
994 /* Skip nchain. */
995 hash++;
996 map->l_buckets = hash;
997 hash += map->l_nbuckets;
998 map->l_chain = hash;
999}
1000
1001
1002static void
1003_dl_debug_bindings (const char *undef_name, struct link_map *undef_map,
1004 const ElfW(Sym) **ref, struct sym_val *value,
1005 const struct r_found_version *version, int type_class,
1006 int protected)
1007{
1008 const char *reference_name = undef_map->l_name;
1009
1010 if (GLRO(dl_debug_mask) & DL_DEBUG_BINDINGS)
1011 {
1012 _dl_debug_printf ("binding file %s [%lu] to %s [%lu]: %s symbol `%s'",
1013 DSO_FILENAME (reference_name),
1014 undef_map->l_ns,
1015 DSO_FILENAME (value->m->l_name),
1016 value->m->l_ns,
1017 protected ? "protected" : "normal", undef_name);
1018 if (version)
1019 _dl_debug_printf_c (" [%s]\n", version->name);
1020 else
1021 _dl_debug_printf_c ("\n");
1022 }
1023#ifdef SHARED
1024 if (GLRO(dl_debug_mask) & DL_DEBUG_PRELINK)
1025 {
1026/* ELF_RTYPE_CLASS_XXX must match RTYPE_CLASS_XXX used by prelink with
1027 LD_TRACE_PRELINKING. */
1028#define RTYPE_CLASS_VALID 8
1029#define RTYPE_CLASS_PLT (8|1)
1030#define RTYPE_CLASS_COPY (8|2)
1031#define RTYPE_CLASS_TLS (8|4)
1032#if ELF_RTYPE_CLASS_PLT != 0 && ELF_RTYPE_CLASS_PLT != 1
1033# error ELF_RTYPE_CLASS_PLT must be 0 or 1!
1034#endif
1035#if ELF_RTYPE_CLASS_COPY != 0 && ELF_RTYPE_CLASS_COPY != 2
1036# error ELF_RTYPE_CLASS_COPY must be 0 or 2!
1037#endif
1038 int conflict = 0;
1039 struct sym_val val = { NULL, NULL };
1040
1041 if ((GLRO(dl_trace_prelink_map) == NULL
1042 || GLRO(dl_trace_prelink_map) == GL(dl_ns)[LM_ID_BASE]._ns_loaded)
1043 && undef_map != GL(dl_ns)[LM_ID_BASE]._ns_loaded)
1044 {
1045 const uint_fast32_t new_hash = dl_new_hash (undef_name);
1046 unsigned long int old_hash = 0xffffffff;
1047 struct unique_sym *saved_entries
1048 = GL(dl_ns)[LM_ID_BASE]._ns_unique_sym_table.entries;
1049
1050 GL(dl_ns)[LM_ID_BASE]._ns_unique_sym_table.entries = NULL;
1051 do_lookup_x (undef_name, new_hash, &old_hash, *ref, &val,
1052 undef_map->l_local_scope[0], 0, version, 0, NULL,
1053 type_class, undef_map);
1054 if (val.s != value->s || val.m != value->m)
1055 conflict = 1;
1056 else if (__glibc_unlikely (undef_map->l_symbolic_in_local_scope)
1057 && val.s
1058 && __glibc_unlikely (ELFW(ST_BIND) (val.s->st_info)
1059 == STB_GNU_UNIQUE))
1060 {
1061 /* If it is STB_GNU_UNIQUE and undef_map's l_local_scope
1062 contains any DT_SYMBOLIC libraries, unfortunately there
1063 can be conflicts even if the above is equal. As symbol
1064 resolution goes from the last library to the first and
1065 if a STB_GNU_UNIQUE symbol is found in some late DT_SYMBOLIC
1066 library, it would be the one that is looked up. */
1067 struct sym_val val2 = { NULL, NULL };
1068 size_t n;
1069 struct r_scope_elem *scope = undef_map->l_local_scope[0];
1070
1071 for (n = 0; n < scope->r_nlist; n++)
1072 if (scope->r_list[n] == val.m)
1073 break;
1074
1075 for (n++; n < scope->r_nlist; n++)
1076 if (scope->r_list[n]->l_info[DT_SYMBOLIC] != NULL
1077 && do_lookup_x (undef_name, new_hash, &old_hash, *ref,
1078 &val2,
1079 &scope->r_list[n]->l_symbolic_searchlist,
1080 0, version, 0, NULL, type_class,
1081 undef_map) > 0)
1082 {
1083 conflict = 1;
1084 val = val2;
1085 break;
1086 }
1087 }
1088 GL(dl_ns)[LM_ID_BASE]._ns_unique_sym_table.entries = saved_entries;
1089 }
1090
1091 if (value->s)
1092 {
1093 /* Keep only ELF_RTYPE_CLASS_PLT and ELF_RTYPE_CLASS_COPY
1094 bits since since prelink only uses them. */
1095 type_class &= ELF_RTYPE_CLASS_PLT | ELF_RTYPE_CLASS_COPY;
1096 if (__glibc_unlikely (ELFW(ST_TYPE) (value->s->st_info)
1097 == STT_TLS))
1098 /* Clear the RTYPE_CLASS_VALID bit in RTYPE_CLASS_TLS. */
1099 type_class = RTYPE_CLASS_TLS & ~RTYPE_CLASS_VALID;
1100 else if (__glibc_unlikely (ELFW(ST_TYPE) (value->s->st_info)
1101 == STT_GNU_IFUNC))
1102 /* Set the RTYPE_CLASS_VALID bit. */
1103 type_class |= RTYPE_CLASS_VALID;
1104 }
1105
1106 if (conflict
1107 || GLRO(dl_trace_prelink_map) == undef_map
1108 || GLRO(dl_trace_prelink_map) == NULL
1109 || type_class >= 4)
1110 {
1111 _dl_printf ("%s 0x%0*Zx 0x%0*Zx -> 0x%0*Zx 0x%0*Zx ",
1112 conflict ? "conflict" : "lookup",
1113 (int) sizeof (ElfW(Addr)) * 2,
1114 (size_t) undef_map->l_map_start,
1115 (int) sizeof (ElfW(Addr)) * 2,
1116 (size_t) (((ElfW(Addr)) *ref) - undef_map->l_map_start),
1117 (int) sizeof (ElfW(Addr)) * 2,
1118 (size_t) (value->s ? value->m->l_map_start : 0),
1119 (int) sizeof (ElfW(Addr)) * 2,
1120 (size_t) (value->s ? value->s->st_value : 0));
1121
1122 if (conflict)
1123 _dl_printf ("x 0x%0*Zx 0x%0*Zx ",
1124 (int) sizeof (ElfW(Addr)) * 2,
1125 (size_t) (val.s ? val.m->l_map_start : 0),
1126 (int) sizeof (ElfW(Addr)) * 2,
1127 (size_t) (val.s ? val.s->st_value : 0));
1128
1129 _dl_printf ("/%x %s\n", type_class, undef_name);
1130 }
1131 }
1132#endif
1133}
1134