2012-06-19 11:21:29 +02:00
|
|
|
/*
|
|
|
|
* Copyright (C) 2012 The Android Open Source Project
|
|
|
|
* All rights reserved.
|
|
|
|
*
|
|
|
|
* Redistribution and use in source and binary forms, with or without
|
|
|
|
* modification, are permitted provided that the following conditions
|
|
|
|
* are met:
|
|
|
|
* * Redistributions of source code must retain the above copyright
|
|
|
|
* notice, this list of conditions and the following disclaimer.
|
|
|
|
* * Redistributions in binary form must reproduce the above copyright
|
|
|
|
* notice, this list of conditions and the following disclaimer in
|
|
|
|
* the documentation and/or other materials provided with the
|
|
|
|
* distribution.
|
|
|
|
*
|
|
|
|
* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
|
|
|
|
* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
|
|
|
|
* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
|
|
|
|
* FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
|
|
|
|
* COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
|
|
|
|
* INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
|
|
|
|
* BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
|
|
|
|
* OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
|
|
|
|
* AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
|
|
|
|
* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
|
|
|
|
* OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
|
|
|
* SUCH DAMAGE.
|
|
|
|
*/
|
|
|
|
|
2013-03-06 03:47:58 +01:00
|
|
|
#include "linker_phdr.h"
|
|
|
|
|
2012-06-19 11:21:29 +02:00
|
|
|
#include <errno.h>
|
2015-01-29 03:02:33 +01:00
|
|
|
#include <string.h>
|
2012-06-19 11:21:29 +02:00
|
|
|
#include <sys/mman.h>
|
2018-08-22 19:36:23 +02:00
|
|
|
#include <sys/prctl.h>
|
2014-02-27 14:18:00 +01:00
|
|
|
#include <sys/types.h>
|
|
|
|
#include <sys/stat.h>
|
|
|
|
#include <unistd.h>
|
2012-06-19 11:21:29 +02:00
|
|
|
|
2013-03-06 03:47:58 +01:00
|
|
|
#include "linker.h"
|
2016-11-16 01:54:16 +01:00
|
|
|
#include "linker_dlwarning.h"
|
2016-08-04 20:50:36 +02:00
|
|
|
#include "linker_globals.h"
|
2023-12-06 19:54:45 +01:00
|
|
|
#include "linker_debug.h"
|
2015-11-21 02:28:12 +01:00
|
|
|
#include "linker_utils.h"
|
2012-06-19 11:21:29 +02:00
|
|
|
|
2024-02-01 05:23:39 +01:00
|
|
|
#include "private/bionic_asm_note.h"
|
2016-07-06 22:20:59 +02:00
|
|
|
#include "private/CFIShadow.h" // For kLibraryAlignment
|
2024-02-01 05:23:39 +01:00
|
|
|
#include "private/elf_note.h"
|
2016-01-28 03:12:03 +01:00
|
|
|
|
2024-03-13 21:35:49 +01:00
|
|
|
#include <procinfo/process_map.h>
|
|
|
|
|
2014-12-03 01:16:29 +01:00
|
|
|
static int GetTargetElfMachine() {
|
|
|
|
#if defined(__arm__)
|
|
|
|
return EM_ARM;
|
|
|
|
#elif defined(__aarch64__)
|
|
|
|
return EM_AARCH64;
|
|
|
|
#elif defined(__i386__)
|
|
|
|
return EM_386;
|
2022-10-10 21:21:44 +02:00
|
|
|
#elif defined(__riscv)
|
|
|
|
return EM_RISCV;
|
2014-12-03 01:16:29 +01:00
|
|
|
#elif defined(__x86_64__)
|
|
|
|
return EM_X86_64;
|
|
|
|
#endif
|
|
|
|
}
|
|
|
|
|
2012-06-19 11:21:29 +02:00
|
|
|
/**
|
|
|
|
TECHNICAL NOTE ON ELF LOADING.
|
|
|
|
|
|
|
|
An ELF file's program header table contains one or more PT_LOAD
|
|
|
|
segments, which corresponds to portions of the file that need to
|
|
|
|
be mapped into the process' address space.
|
|
|
|
|
|
|
|
Each loadable segment has the following important properties:
|
|
|
|
|
|
|
|
p_offset -> segment file offset
|
|
|
|
p_filesz -> segment file size
|
|
|
|
p_memsz -> segment memory size (always >= p_filesz)
|
|
|
|
p_vaddr -> segment's virtual address
|
|
|
|
p_flags -> segment flags (e.g. readable, writable, executable)
|
2021-03-24 18:17:39 +01:00
|
|
|
p_align -> segment's in-memory and in-file alignment
|
2012-06-19 11:21:29 +02:00
|
|
|
|
2021-03-24 18:17:39 +01:00
|
|
|
We will ignore the p_paddr field of ElfW(Phdr) for now.
|
2012-06-19 11:21:29 +02:00
|
|
|
|
|
|
|
The loadable segments can be seen as a list of [p_vaddr ... p_vaddr+p_memsz)
|
|
|
|
ranges of virtual addresses. A few rules apply:
|
|
|
|
|
|
|
|
- the virtual address ranges should not overlap.
|
|
|
|
|
|
|
|
- if a segment's p_filesz is smaller than its p_memsz, the extra bytes
|
|
|
|
between them should always be initialized to 0.
|
|
|
|
|
|
|
|
- ranges do not necessarily start or end at page boundaries. Two distinct
|
|
|
|
segments can have their start and end on the same page. In this case, the
|
|
|
|
page inherits the mapping flags of the latter segment.
|
|
|
|
|
|
|
|
Finally, the real load addrs of each segment is not p_vaddr. Instead the
|
|
|
|
loader decides where to load the first segment, then will load all others
|
|
|
|
relative to the first one to respect the initial range layout.
|
|
|
|
|
|
|
|
For example, consider the following list:
|
|
|
|
|
|
|
|
[ offset:0, filesz:0x4000, memsz:0x4000, vaddr:0x30000 ],
|
|
|
|
[ offset:0x4000, filesz:0x2000, memsz:0x8000, vaddr:0x40000 ],
|
|
|
|
|
|
|
|
This corresponds to two segments that cover these virtual address ranges:
|
|
|
|
|
|
|
|
0x30000...0x34000
|
|
|
|
0x40000...0x48000
|
|
|
|
|
|
|
|
If the loader decides to load the first segment at address 0xa0000000
|
|
|
|
then the segments' load address ranges will be:
|
|
|
|
|
|
|
|
0xa0030000...0xa0034000
|
|
|
|
0xa0040000...0xa0048000
|
|
|
|
|
|
|
|
In other words, all segments must be loaded at an address that has the same
|
|
|
|
constant offset from their p_vaddr value. This offset is computed as the
|
|
|
|
difference between the first segment's load address, and its p_vaddr value.
|
|
|
|
|
|
|
|
However, in practice, segments do _not_ start at page boundaries. Since we
|
|
|
|
can only memory-map at page boundaries, this means that the bias is
|
|
|
|
computed as:
|
|
|
|
|
2022-05-02 21:26:16 +02:00
|
|
|
load_bias = phdr0_load_address - page_start(phdr0->p_vaddr)
|
2012-06-19 11:21:29 +02:00
|
|
|
|
|
|
|
(NOTE: The value must be used as a 32-bit unsigned integer, to deal with
|
|
|
|
possible wrap around UINT32_MAX for possible large p_vaddr values).
|
|
|
|
|
|
|
|
And that the phdr0_load_address must start at a page boundary, with
|
|
|
|
the segment's real content starting at:
|
|
|
|
|
2022-05-02 21:26:16 +02:00
|
|
|
phdr0_load_address + page_offset(phdr0->p_vaddr)
|
2012-06-19 11:21:29 +02:00
|
|
|
|
|
|
|
Note that ELF requires the following condition to make the mmap()-ing work:
|
|
|
|
|
2022-05-02 21:26:16 +02:00
|
|
|
page_offset(phdr0->p_vaddr) == page_offset(phdr0->p_offset)
|
2012-06-19 11:21:29 +02:00
|
|
|
|
|
|
|
The load_bias must be added to any p_vaddr value read from the ELF file to
|
|
|
|
determine the corresponding memory address.
|
|
|
|
|
|
|
|
**/
|
|
|
|
|
2014-02-12 01:59:37 +01:00
|
|
|
#define MAYBE_MAP_FLAG(x, from, to) (((x) & (from)) ? (to) : 0)
|
2012-06-19 11:21:29 +02:00
|
|
|
#define PFLAGS_TO_PROT(x) (MAYBE_MAP_FLAG((x), PF_X, PROT_EXEC) | \
|
|
|
|
MAYBE_MAP_FLAG((x), PF_R, PROT_READ) | \
|
|
|
|
MAYBE_MAP_FLAG((x), PF_W, PROT_WRITE))
|
|
|
|
|
2024-02-01 09:14:36 +01:00
|
|
|
static const size_t kPageSize = page_size();
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Generic PMD size calculation:
|
|
|
|
* - Each page table (PT) is of size 1 page.
|
|
|
|
* - Each page table entry (PTE) is of size 64 bits.
|
|
|
|
* - Each PTE locates one physical page frame (PFN) of size 1 page.
|
|
|
|
* - A PMD entry locates 1 page table (PT)
|
|
|
|
*
|
|
|
|
* PMD size = Num entries in a PT * page_size
|
|
|
|
*/
|
|
|
|
static const size_t kPmdSize = (kPageSize / sizeof(uint64_t)) * kPageSize;
|
2021-03-24 18:17:39 +01:00
|
|
|
|
2015-10-15 21:07:25 +02:00
|
|
|
ElfReader::ElfReader()
|
|
|
|
: did_read_(false), did_load_(false), fd_(-1), file_offset_(0), file_size_(0), phdr_num_(0),
|
|
|
|
phdr_table_(nullptr), shdr_table_(nullptr), shdr_num_(0), dynamic_(nullptr), strtab_(nullptr),
|
2016-01-15 20:13:35 +01:00
|
|
|
strtab_size_(0), load_start_(nullptr), load_size_(0), load_bias_(0), loaded_phdr_(nullptr),
|
|
|
|
mapped_by_caller_(false) {
|
2015-10-15 21:07:25 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
bool ElfReader::Read(const char* name, int fd, off64_t file_offset, off64_t file_size) {
|
2017-05-19 18:01:24 +02:00
|
|
|
if (did_read_) {
|
|
|
|
return true;
|
|
|
|
}
|
2015-10-15 21:07:25 +02:00
|
|
|
name_ = name;
|
|
|
|
fd_ = fd;
|
|
|
|
file_offset_ = file_offset;
|
|
|
|
file_size_ = file_size;
|
|
|
|
|
|
|
|
if (ReadElfHeader() &&
|
|
|
|
VerifyElfHeader() &&
|
|
|
|
ReadProgramHeaders() &&
|
|
|
|
ReadSectionHeaders() &&
|
2024-02-01 05:23:39 +01:00
|
|
|
ReadDynamicSection() &&
|
|
|
|
ReadPadSegmentNote()) {
|
2015-10-15 21:07:25 +02:00
|
|
|
did_read_ = true;
|
|
|
|
}
|
|
|
|
|
|
|
|
return did_read_;
|
2013-03-06 03:47:58 +01:00
|
|
|
}
|
2012-06-19 11:21:29 +02:00
|
|
|
|
2018-10-17 21:59:38 +02:00
|
|
|
bool ElfReader::Load(address_space_params* address_space) {
|
2015-10-15 21:07:25 +02:00
|
|
|
CHECK(did_read_);
|
2017-05-19 18:01:24 +02:00
|
|
|
if (did_load_) {
|
|
|
|
return true;
|
|
|
|
}
|
2022-12-27 12:38:41 +01:00
|
|
|
bool reserveSuccess = ReserveAddressSpace(address_space);
|
|
|
|
if (reserveSuccess && LoadSegments() && FindPhdr() &&
|
2020-02-24 14:15:25 +01:00
|
|
|
FindGnuPropertySection()) {
|
2015-10-15 21:07:25 +02:00
|
|
|
did_load_ = true;
|
2020-02-24 14:15:25 +01:00
|
|
|
#if defined(__aarch64__)
|
|
|
|
// For Armv8.5-A loaded executable segments may require PROT_BTI.
|
|
|
|
if (note_gnu_property_.IsBTICompatible()) {
|
|
|
|
did_load_ = (phdr_table_protect_segments(phdr_table_, phdr_num_, load_bias_,
|
2024-03-13 21:35:49 +01:00
|
|
|
should_pad_segments_, ¬e_gnu_property_) == 0);
|
2020-02-24 14:15:25 +01:00
|
|
|
}
|
|
|
|
#endif
|
2015-10-15 21:07:25 +02:00
|
|
|
}
|
2022-12-27 12:38:41 +01:00
|
|
|
if (reserveSuccess && !did_load_) {
|
|
|
|
if (load_start_ != nullptr && load_size_ != 0) {
|
|
|
|
if (!mapped_by_caller_) {
|
|
|
|
munmap(load_start_, load_size_);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
2015-10-15 21:07:25 +02:00
|
|
|
|
|
|
|
return did_load_;
|
|
|
|
}
|
|
|
|
|
|
|
|
const char* ElfReader::get_string(ElfW(Word) index) const {
|
|
|
|
CHECK(strtab_ != nullptr);
|
|
|
|
CHECK(index < strtab_size_);
|
|
|
|
|
|
|
|
return strtab_ + index;
|
2013-03-06 03:47:58 +01:00
|
|
|
}
|
2012-06-19 11:21:29 +02:00
|
|
|
|
2013-03-06 03:47:58 +01:00
|
|
|
bool ElfReader::ReadElfHeader() {
|
2014-10-21 21:09:18 +02:00
|
|
|
ssize_t rc = TEMP_FAILURE_RETRY(pread64(fd_, &header_, sizeof(header_), file_offset_));
|
2013-03-06 03:47:58 +01:00
|
|
|
if (rc < 0) {
|
2015-10-15 21:07:25 +02:00
|
|
|
DL_ERR("can't read file \"%s\": %s", name_.c_str(), strerror(errno));
|
2013-03-06 03:47:58 +01:00
|
|
|
return false;
|
|
|
|
}
|
2014-10-21 21:09:18 +02:00
|
|
|
|
2013-03-06 03:47:58 +01:00
|
|
|
if (rc != sizeof(header_)) {
|
2015-10-15 21:07:25 +02:00
|
|
|
DL_ERR("\"%s\" is too small to be an ELF executable: only found %zd bytes", name_.c_str(),
|
2013-10-01 03:43:46 +02:00
|
|
|
static_cast<size_t>(rc));
|
2013-03-06 03:47:58 +01:00
|
|
|
return false;
|
|
|
|
}
|
|
|
|
return true;
|
2012-06-19 11:21:29 +02:00
|
|
|
}
|
|
|
|
|
2017-04-20 02:44:57 +02:00
|
|
|
static const char* EM_to_string(int em) {
|
|
|
|
if (em == EM_386) return "EM_386";
|
|
|
|
if (em == EM_AARCH64) return "EM_AARCH64";
|
|
|
|
if (em == EM_ARM) return "EM_ARM";
|
2022-11-15 15:39:44 +01:00
|
|
|
if (em == EM_RISCV) return "EM_RISCV";
|
2017-04-20 02:44:57 +02:00
|
|
|
if (em == EM_X86_64) return "EM_X86_64";
|
|
|
|
return "EM_???";
|
|
|
|
}
|
|
|
|
|
2013-03-06 03:47:58 +01:00
|
|
|
bool ElfReader::VerifyElfHeader() {
|
2014-07-16 01:53:13 +02:00
|
|
|
if (memcmp(header_.e_ident, ELFMAG, SELFMAG) != 0) {
|
2018-06-27 23:39:06 +02:00
|
|
|
DL_ERR("\"%s\" has bad ELF magic: %02x%02x%02x%02x", name_.c_str(),
|
|
|
|
header_.e_ident[0], header_.e_ident[1], header_.e_ident[2], header_.e_ident[3]);
|
2013-03-06 03:47:58 +01:00
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
2013-10-05 02:01:33 +02:00
|
|
|
// Try to give a clear diagnostic for ELF class mismatches, since they're
|
|
|
|
// an easy mistake to make during the 32-bit/64-bit transition period.
|
|
|
|
int elf_class = header_.e_ident[EI_CLASS];
|
|
|
|
#if defined(__LP64__)
|
|
|
|
if (elf_class != ELFCLASS64) {
|
|
|
|
if (elf_class == ELFCLASS32) {
|
2015-10-15 21:07:25 +02:00
|
|
|
DL_ERR("\"%s\" is 32-bit instead of 64-bit", name_.c_str());
|
2013-10-05 02:01:33 +02:00
|
|
|
} else {
|
2015-10-15 21:07:25 +02:00
|
|
|
DL_ERR("\"%s\" has unknown ELF class: %d", name_.c_str(), elf_class);
|
2013-10-05 02:01:33 +02:00
|
|
|
}
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
#else
|
|
|
|
if (elf_class != ELFCLASS32) {
|
|
|
|
if (elf_class == ELFCLASS64) {
|
2015-10-15 21:07:25 +02:00
|
|
|
DL_ERR("\"%s\" is 64-bit instead of 32-bit", name_.c_str());
|
2013-10-05 02:01:33 +02:00
|
|
|
} else {
|
2015-10-15 21:07:25 +02:00
|
|
|
DL_ERR("\"%s\" has unknown ELF class: %d", name_.c_str(), elf_class);
|
2013-10-05 02:01:33 +02:00
|
|
|
}
|
2013-03-06 03:47:58 +01:00
|
|
|
return false;
|
|
|
|
}
|
2013-10-05 02:01:33 +02:00
|
|
|
#endif
|
|
|
|
|
2013-03-06 03:47:58 +01:00
|
|
|
if (header_.e_ident[EI_DATA] != ELFDATA2LSB) {
|
2015-10-15 21:07:25 +02:00
|
|
|
DL_ERR("\"%s\" not little-endian: %d", name_.c_str(), header_.e_ident[EI_DATA]);
|
2013-03-06 03:47:58 +01:00
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (header_.e_type != ET_DYN) {
|
2015-10-15 21:07:25 +02:00
|
|
|
DL_ERR("\"%s\" has unexpected e_type: %d", name_.c_str(), header_.e_type);
|
2013-03-06 03:47:58 +01:00
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (header_.e_version != EV_CURRENT) {
|
2015-10-15 21:07:25 +02:00
|
|
|
DL_ERR("\"%s\" has unexpected e_version: %d", name_.c_str(), header_.e_version);
|
2013-03-06 03:47:58 +01:00
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
2014-12-03 01:16:29 +01:00
|
|
|
if (header_.e_machine != GetTargetElfMachine()) {
|
2018-09-18 00:50:09 +02:00
|
|
|
DL_ERR("\"%s\" is for %s (%d) instead of %s (%d)",
|
|
|
|
name_.c_str(),
|
|
|
|
EM_to_string(header_.e_machine), header_.e_machine,
|
|
|
|
EM_to_string(GetTargetElfMachine()), GetTargetElfMachine());
|
2013-03-06 03:47:58 +01:00
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
2016-07-22 21:50:59 +02:00
|
|
|
if (header_.e_shentsize != sizeof(ElfW(Shdr))) {
|
2016-11-16 21:29:37 +01:00
|
|
|
// Fail if app is targeting Android O or above
|
2019-12-20 22:26:14 +01:00
|
|
|
if (get_application_target_sdk_version() >= 26) {
|
2016-11-16 21:29:37 +01:00
|
|
|
DL_ERR_AND_LOG("\"%s\" has unsupported e_shentsize: 0x%x (expected 0x%zx)",
|
|
|
|
name_.c_str(), header_.e_shentsize, sizeof(ElfW(Shdr)));
|
|
|
|
return false;
|
|
|
|
}
|
2019-12-20 22:26:14 +01:00
|
|
|
DL_WARN_documented_change(26,
|
2018-02-28 20:29:45 +01:00
|
|
|
"invalid-elf-header_section-headers-enforced-for-api-level-26",
|
|
|
|
"\"%s\" has unsupported e_shentsize 0x%x (expected 0x%zx)",
|
|
|
|
name_.c_str(), header_.e_shentsize, sizeof(ElfW(Shdr)));
|
2016-11-16 21:29:37 +01:00
|
|
|
add_dlwarning(name_.c_str(), "has invalid ELF header");
|
2016-07-22 21:50:59 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
if (header_.e_shstrndx == 0) {
|
2016-11-16 21:29:37 +01:00
|
|
|
// Fail if app is targeting Android O or above
|
2019-12-20 22:26:14 +01:00
|
|
|
if (get_application_target_sdk_version() >= 26) {
|
2016-11-16 21:29:37 +01:00
|
|
|
DL_ERR_AND_LOG("\"%s\" has invalid e_shstrndx", name_.c_str());
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
2019-12-20 22:26:14 +01:00
|
|
|
DL_WARN_documented_change(26,
|
2018-02-28 20:29:45 +01:00
|
|
|
"invalid-elf-header_section-headers-enforced-for-api-level-26",
|
|
|
|
"\"%s\" has invalid e_shstrndx", name_.c_str());
|
2016-11-16 21:29:37 +01:00
|
|
|
add_dlwarning(name_.c_str(), "has invalid ELF header");
|
2016-07-22 21:50:59 +02:00
|
|
|
}
|
|
|
|
|
2013-03-06 03:47:58 +01:00
|
|
|
return true;
|
2012-06-19 11:21:29 +02:00
|
|
|
}
|
|
|
|
|
2016-08-09 02:12:18 +02:00
|
|
|
bool ElfReader::CheckFileRange(ElfW(Addr) offset, size_t size, size_t alignment) {
|
2015-11-21 02:28:12 +01:00
|
|
|
off64_t range_start;
|
|
|
|
off64_t range_end;
|
|
|
|
|
2016-07-14 02:06:36 +02:00
|
|
|
// Only header can be located at the 0 offset... This function called to
|
|
|
|
// check DYNSYM and DYNAMIC sections and phdr/shdr - none of them can be
|
2016-07-14 20:15:44 +02:00
|
|
|
// at offset 0.
|
2016-07-14 02:06:36 +02:00
|
|
|
|
|
|
|
return offset > 0 &&
|
|
|
|
safe_add(&range_start, file_offset_, offset) &&
|
2015-11-21 02:28:12 +01:00
|
|
|
safe_add(&range_end, range_start, size) &&
|
2016-08-09 02:12:18 +02:00
|
|
|
(range_start < file_size_) &&
|
|
|
|
(range_end <= file_size_) &&
|
|
|
|
((offset % alignment) == 0);
|
2015-11-21 02:28:12 +01:00
|
|
|
}
|
|
|
|
|
2013-03-06 03:47:58 +01:00
|
|
|
// Loads the program header table from an ELF file into a read-only private
|
|
|
|
// anonymous mmap-ed block.
|
2015-10-15 21:07:25 +02:00
|
|
|
bool ElfReader::ReadProgramHeaders() {
|
2013-03-06 03:47:58 +01:00
|
|
|
phdr_num_ = header_.e_phnum;
|
|
|
|
|
|
|
|
// Like the kernel, we only accept program header tables that
|
|
|
|
// are smaller than 64KiB.
|
2014-02-11 02:46:57 +01:00
|
|
|
if (phdr_num_ < 1 || phdr_num_ > 65536/sizeof(ElfW(Phdr))) {
|
2015-10-15 21:07:25 +02:00
|
|
|
DL_ERR("\"%s\" has invalid e_phnum: %zd", name_.c_str(), phdr_num_);
|
2013-03-06 03:47:58 +01:00
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
2015-11-21 02:28:12 +01:00
|
|
|
// Boundary checks
|
|
|
|
size_t size = phdr_num_ * sizeof(ElfW(Phdr));
|
2016-08-09 02:12:18 +02:00
|
|
|
if (!CheckFileRange(header_.e_phoff, size, alignof(ElfW(Phdr)))) {
|
|
|
|
DL_ERR_AND_LOG("\"%s\" has invalid phdr offset/size: %zu/%zu",
|
|
|
|
name_.c_str(),
|
|
|
|
static_cast<size_t>(header_.e_phoff),
|
|
|
|
size);
|
2015-11-21 02:28:12 +01:00
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (!phdr_fragment_.Map(fd_, file_offset_, header_.e_phoff, size)) {
|
2015-10-15 21:07:25 +02:00
|
|
|
DL_ERR("\"%s\" phdr mmap failed: %s", name_.c_str(), strerror(errno));
|
2013-03-06 03:47:58 +01:00
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
2015-10-20 01:57:46 +02:00
|
|
|
phdr_table_ = static_cast<ElfW(Phdr)*>(phdr_fragment_.data());
|
2013-03-06 03:47:58 +01:00
|
|
|
return true;
|
|
|
|
}
|
2012-06-19 11:21:29 +02:00
|
|
|
|
2015-10-15 21:07:25 +02:00
|
|
|
bool ElfReader::ReadSectionHeaders() {
|
|
|
|
shdr_num_ = header_.e_shnum;
|
|
|
|
|
2015-11-20 19:42:02 +01:00
|
|
|
if (shdr_num_ == 0) {
|
2016-08-09 02:12:18 +02:00
|
|
|
DL_ERR_AND_LOG("\"%s\" has no section headers", name_.c_str());
|
2015-11-20 19:42:02 +01:00
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
2015-11-21 02:28:12 +01:00
|
|
|
size_t size = shdr_num_ * sizeof(ElfW(Shdr));
|
2016-08-09 02:12:18 +02:00
|
|
|
if (!CheckFileRange(header_.e_shoff, size, alignof(const ElfW(Shdr)))) {
|
|
|
|
DL_ERR_AND_LOG("\"%s\" has invalid shdr offset/size: %zu/%zu",
|
|
|
|
name_.c_str(),
|
|
|
|
static_cast<size_t>(header_.e_shoff),
|
|
|
|
size);
|
2015-11-21 02:28:12 +01:00
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (!shdr_fragment_.Map(fd_, file_offset_, header_.e_shoff, size)) {
|
2015-10-15 21:07:25 +02:00
|
|
|
DL_ERR("\"%s\" shdr mmap failed: %s", name_.c_str(), strerror(errno));
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
|
|
|
shdr_table_ = static_cast<const ElfW(Shdr)*>(shdr_fragment_.data());
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
|
|
|
bool ElfReader::ReadDynamicSection() {
|
|
|
|
// 1. Find .dynamic section (in section headers)
|
|
|
|
const ElfW(Shdr)* dynamic_shdr = nullptr;
|
|
|
|
for (size_t i = 0; i < shdr_num_; ++i) {
|
|
|
|
if (shdr_table_[i].sh_type == SHT_DYNAMIC) {
|
|
|
|
dynamic_shdr = &shdr_table_ [i];
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
if (dynamic_shdr == nullptr) {
|
2016-08-09 02:12:18 +02:00
|
|
|
DL_ERR_AND_LOG("\"%s\" .dynamic section header was not found", name_.c_str());
|
2015-10-15 21:07:25 +02:00
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
2016-07-14 02:06:36 +02:00
|
|
|
// Make sure dynamic_shdr offset and size matches PT_DYNAMIC phdr
|
|
|
|
size_t pt_dynamic_offset = 0;
|
|
|
|
size_t pt_dynamic_filesz = 0;
|
|
|
|
for (size_t i = 0; i < phdr_num_; ++i) {
|
|
|
|
const ElfW(Phdr)* phdr = &phdr_table_[i];
|
|
|
|
if (phdr->p_type == PT_DYNAMIC) {
|
|
|
|
pt_dynamic_offset = phdr->p_offset;
|
|
|
|
pt_dynamic_filesz = phdr->p_filesz;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
if (pt_dynamic_offset != dynamic_shdr->sh_offset) {
|
2019-12-20 22:26:14 +01:00
|
|
|
if (get_application_target_sdk_version() >= 26) {
|
2016-12-29 01:21:49 +01:00
|
|
|
DL_ERR_AND_LOG("\"%s\" .dynamic section has invalid offset: 0x%zx, "
|
|
|
|
"expected to match PT_DYNAMIC offset: 0x%zx",
|
|
|
|
name_.c_str(),
|
|
|
|
static_cast<size_t>(dynamic_shdr->sh_offset),
|
|
|
|
pt_dynamic_offset);
|
|
|
|
return false;
|
|
|
|
}
|
2019-12-20 22:26:14 +01:00
|
|
|
DL_WARN_documented_change(26,
|
2018-02-28 20:29:45 +01:00
|
|
|
"invalid-elf-header_section-headers-enforced-for-api-level-26",
|
|
|
|
"\"%s\" .dynamic section has invalid offset: 0x%zx "
|
|
|
|
"(expected to match PT_DYNAMIC offset 0x%zx)",
|
|
|
|
name_.c_str(),
|
|
|
|
static_cast<size_t>(dynamic_shdr->sh_offset),
|
|
|
|
pt_dynamic_offset);
|
2016-12-29 01:21:49 +01:00
|
|
|
add_dlwarning(name_.c_str(), "invalid .dynamic section");
|
2016-07-14 02:06:36 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
if (pt_dynamic_filesz != dynamic_shdr->sh_size) {
|
2019-12-20 22:26:14 +01:00
|
|
|
if (get_application_target_sdk_version() >= 26) {
|
2016-12-29 01:21:49 +01:00
|
|
|
DL_ERR_AND_LOG("\"%s\" .dynamic section has invalid size: 0x%zx, "
|
|
|
|
"expected to match PT_DYNAMIC filesz: 0x%zx",
|
|
|
|
name_.c_str(),
|
|
|
|
static_cast<size_t>(dynamic_shdr->sh_size),
|
|
|
|
pt_dynamic_filesz);
|
|
|
|
return false;
|
|
|
|
}
|
2019-12-20 22:26:14 +01:00
|
|
|
DL_WARN_documented_change(26,
|
2018-02-28 20:29:45 +01:00
|
|
|
"invalid-elf-header_section-headers-enforced-for-api-level-26",
|
|
|
|
"\"%s\" .dynamic section has invalid size: 0x%zx "
|
|
|
|
"(expected to match PT_DYNAMIC filesz 0x%zx)",
|
|
|
|
name_.c_str(),
|
|
|
|
static_cast<size_t>(dynamic_shdr->sh_size),
|
|
|
|
pt_dynamic_filesz);
|
2016-12-29 01:21:49 +01:00
|
|
|
add_dlwarning(name_.c_str(), "invalid .dynamic section");
|
2016-07-14 02:06:36 +02:00
|
|
|
}
|
|
|
|
|
2015-10-15 21:07:25 +02:00
|
|
|
if (dynamic_shdr->sh_link >= shdr_num_) {
|
2016-08-09 02:12:18 +02:00
|
|
|
DL_ERR_AND_LOG("\"%s\" .dynamic section has invalid sh_link: %d",
|
|
|
|
name_.c_str(),
|
|
|
|
dynamic_shdr->sh_link);
|
2015-10-15 21:07:25 +02:00
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
|
|
|
const ElfW(Shdr)* strtab_shdr = &shdr_table_[dynamic_shdr->sh_link];
|
|
|
|
|
|
|
|
if (strtab_shdr->sh_type != SHT_STRTAB) {
|
2016-08-09 02:12:18 +02:00
|
|
|
DL_ERR_AND_LOG("\"%s\" .dynamic section has invalid link(%d) sh_type: %d (expected SHT_STRTAB)",
|
|
|
|
name_.c_str(), dynamic_shdr->sh_link, strtab_shdr->sh_type);
|
2015-10-15 21:07:25 +02:00
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
2016-08-09 02:12:18 +02:00
|
|
|
if (!CheckFileRange(dynamic_shdr->sh_offset, dynamic_shdr->sh_size, alignof(const ElfW(Dyn)))) {
|
|
|
|
DL_ERR_AND_LOG("\"%s\" has invalid offset/size of .dynamic section", name_.c_str());
|
2015-11-21 02:28:12 +01:00
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
2015-10-15 21:07:25 +02:00
|
|
|
if (!dynamic_fragment_.Map(fd_, file_offset_, dynamic_shdr->sh_offset, dynamic_shdr->sh_size)) {
|
|
|
|
DL_ERR("\"%s\" dynamic section mmap failed: %s", name_.c_str(), strerror(errno));
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
|
|
|
dynamic_ = static_cast<const ElfW(Dyn)*>(dynamic_fragment_.data());
|
|
|
|
|
2016-08-09 02:12:18 +02:00
|
|
|
if (!CheckFileRange(strtab_shdr->sh_offset, strtab_shdr->sh_size, alignof(const char))) {
|
|
|
|
DL_ERR_AND_LOG("\"%s\" has invalid offset/size of the .strtab section linked from .dynamic section",
|
|
|
|
name_.c_str());
|
2015-11-21 02:28:12 +01:00
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
2015-10-15 21:07:25 +02:00
|
|
|
if (!strtab_fragment_.Map(fd_, file_offset_, strtab_shdr->sh_offset, strtab_shdr->sh_size)) {
|
|
|
|
DL_ERR("\"%s\" strtab section mmap failed: %s", name_.c_str(), strerror(errno));
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
|
|
|
strtab_ = static_cast<const char*>(strtab_fragment_.data());
|
|
|
|
strtab_size_ = strtab_fragment_.size();
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
2013-01-11 01:39:58 +01:00
|
|
|
/* Returns the size of the extent of all the possibly non-contiguous
|
|
|
|
* loadable segments in an ELF program header table. This corresponds
|
|
|
|
* to the page-aligned size in bytes that needs to be reserved in the
|
|
|
|
* process' address space. If there are no loadable segments, 0 is
|
|
|
|
* returned.
|
2012-06-19 11:21:29 +02:00
|
|
|
*
|
2014-08-29 21:02:36 +02:00
|
|
|
* If out_min_vaddr or out_max_vaddr are not null, they will be
|
2013-01-11 01:39:58 +01:00
|
|
|
* set to the minimum and maximum addresses of pages to be reserved,
|
|
|
|
* or 0 if there is nothing to load.
|
2012-06-19 11:21:29 +02:00
|
|
|
*/
|
2014-02-11 02:46:57 +01:00
|
|
|
size_t phdr_table_get_load_size(const ElfW(Phdr)* phdr_table, size_t phdr_count,
|
|
|
|
ElfW(Addr)* out_min_vaddr,
|
|
|
|
ElfW(Addr)* out_max_vaddr) {
|
|
|
|
ElfW(Addr) min_vaddr = UINTPTR_MAX;
|
|
|
|
ElfW(Addr) max_vaddr = 0;
|
2012-06-19 11:21:29 +02:00
|
|
|
|
2014-02-11 02:46:57 +01:00
|
|
|
bool found_pt_load = false;
|
|
|
|
for (size_t i = 0; i < phdr_count; ++i) {
|
|
|
|
const ElfW(Phdr)* phdr = &phdr_table[i];
|
2012-06-19 11:21:29 +02:00
|
|
|
|
2014-02-11 02:46:57 +01:00
|
|
|
if (phdr->p_type != PT_LOAD) {
|
|
|
|
continue;
|
2013-01-11 01:39:58 +01:00
|
|
|
}
|
2014-02-11 02:46:57 +01:00
|
|
|
found_pt_load = true;
|
|
|
|
|
|
|
|
if (phdr->p_vaddr < min_vaddr) {
|
|
|
|
min_vaddr = phdr->p_vaddr;
|
2013-01-11 01:39:58 +01:00
|
|
|
}
|
2014-02-11 02:46:57 +01:00
|
|
|
|
|
|
|
if (phdr->p_vaddr + phdr->p_memsz > max_vaddr) {
|
|
|
|
max_vaddr = phdr->p_vaddr + phdr->p_memsz;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if (!found_pt_load) {
|
|
|
|
min_vaddr = 0;
|
|
|
|
}
|
|
|
|
|
2022-05-02 21:26:16 +02:00
|
|
|
min_vaddr = page_start(min_vaddr);
|
|
|
|
max_vaddr = page_end(max_vaddr);
|
2014-02-11 02:46:57 +01:00
|
|
|
|
2014-08-29 21:02:36 +02:00
|
|
|
if (out_min_vaddr != nullptr) {
|
2014-02-11 02:46:57 +01:00
|
|
|
*out_min_vaddr = min_vaddr;
|
|
|
|
}
|
2014-08-29 21:02:36 +02:00
|
|
|
if (out_max_vaddr != nullptr) {
|
2014-02-11 02:46:57 +01:00
|
|
|
*out_max_vaddr = max_vaddr;
|
|
|
|
}
|
|
|
|
return max_vaddr - min_vaddr;
|
2012-06-19 11:21:29 +02:00
|
|
|
}
|
|
|
|
|
2021-03-24 18:17:39 +01:00
|
|
|
// Returns the maximum p_align associated with a loadable segment in the ELF
|
|
|
|
// program header table. Used to determine whether the file should be loaded at
|
|
|
|
// a specific virtual address alignment for use with huge pages.
|
|
|
|
size_t phdr_table_get_maximum_alignment(const ElfW(Phdr)* phdr_table, size_t phdr_count) {
|
2022-05-02 21:26:16 +02:00
|
|
|
size_t maximum_alignment = page_size();
|
2021-03-24 18:17:39 +01:00
|
|
|
|
|
|
|
for (size_t i = 0; i < phdr_count; ++i) {
|
|
|
|
const ElfW(Phdr)* phdr = &phdr_table[i];
|
|
|
|
|
|
|
|
// p_align must be 0, 1, or a positive, integral power of two.
|
|
|
|
if (phdr->p_type != PT_LOAD || ((phdr->p_align & (phdr->p_align - 1)) != 0)) {
|
|
|
|
continue;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (phdr->p_align > maximum_alignment) {
|
|
|
|
maximum_alignment = phdr->p_align;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
#if defined(__LP64__)
|
|
|
|
return maximum_alignment;
|
|
|
|
#else
|
2022-05-02 21:26:16 +02:00
|
|
|
return page_size();
|
2021-03-24 18:17:39 +01:00
|
|
|
#endif
|
|
|
|
}
|
|
|
|
|
Align-up and randomize shared libraries.
This change implements the following property:
Any 2**N aligned memory region on size 2**N contains no more than one DSO.
The value N can be configured, with 16 or 18 looking like a good choice.
Additionally, DSOs are loaded at random page-aligned address inside these large
regions.
This change has dual purpose:
1. Larger values of N allow a lot more compact CFI shadow implementation.
See change I14dfea630de468eb5620e7f55f92b1397ba06217.
For example, CFI shadow for the system_server process has the following size (RSS, KB):
152 for N = 12, 32 for N = 16, 16 for N = 18.
2. Extra randomization is good for security.
This change does not result in extra RAM usage, because everything is still page-aligned.
It does result in a bit more VM fragmentation because of the gaps between shared libraries.
As it turns out, this fragmentation is barely noticeable because the kernel creates new mapping
at the highest possible address, and we do enough small mappings to almost completely fill the
gaps (ex. in the Zygote the gaps are filled with .ttf file mappings and thread stacks).
I've measured VM fragmentation as the sum of all VM gaps (unmapped regions) that are larger
than 1MB according to /proc/$PID/maps. On aosp_angler-userdebug, the numbers are (in GB):
| N = 12 | N = 18
system_server | 521.9 | 521.1
zygote64 | 522.1 | 521.3
zygote32 | 2.55 | 2.55
mediaserver | 4.00 | 4.00
Change-Id: Ia6df840dd409c82837efd1f263be420d9723c84a
2016-07-16 01:31:42 +02:00
|
|
|
// Reserve a virtual address range such that if it's limits were extended to the next 2**align
|
|
|
|
// boundary, it would not overlap with any existing mappings.
|
2021-03-24 18:17:39 +01:00
|
|
|
static void* ReserveWithAlignmentPadding(size_t size, size_t mapping_align, size_t start_align,
|
|
|
|
void** out_gap_start, size_t* out_gap_size) {
|
Align-up and randomize shared libraries.
This change implements the following property:
Any 2**N aligned memory region on size 2**N contains no more than one DSO.
The value N can be configured, with 16 or 18 looking like a good choice.
Additionally, DSOs are loaded at random page-aligned address inside these large
regions.
This change has dual purpose:
1. Larger values of N allow a lot more compact CFI shadow implementation.
See change I14dfea630de468eb5620e7f55f92b1397ba06217.
For example, CFI shadow for the system_server process has the following size (RSS, KB):
152 for N = 12, 32 for N = 16, 16 for N = 18.
2. Extra randomization is good for security.
This change does not result in extra RAM usage, because everything is still page-aligned.
It does result in a bit more VM fragmentation because of the gaps between shared libraries.
As it turns out, this fragmentation is barely noticeable because the kernel creates new mapping
at the highest possible address, and we do enough small mappings to almost completely fill the
gaps (ex. in the Zygote the gaps are filled with .ttf file mappings and thread stacks).
I've measured VM fragmentation as the sum of all VM gaps (unmapped regions) that are larger
than 1MB according to /proc/$PID/maps. On aosp_angler-userdebug, the numbers are (in GB):
| N = 12 | N = 18
system_server | 521.9 | 521.1
zygote64 | 522.1 | 521.3
zygote32 | 2.55 | 2.55
mediaserver | 4.00 | 4.00
Change-Id: Ia6df840dd409c82837efd1f263be420d9723c84a
2016-07-16 01:31:42 +02:00
|
|
|
int mmap_flags = MAP_PRIVATE | MAP_ANONYMOUS;
|
2021-03-24 18:17:39 +01:00
|
|
|
// Reserve enough space to properly align the library's start address.
|
|
|
|
mapping_align = std::max(mapping_align, start_align);
|
2022-05-02 21:26:16 +02:00
|
|
|
if (mapping_align == page_size()) {
|
2018-11-05 22:34:36 +01:00
|
|
|
void* mmap_ptr = mmap(nullptr, size, PROT_NONE, mmap_flags, -1, 0);
|
Align-up and randomize shared libraries.
This change implements the following property:
Any 2**N aligned memory region on size 2**N contains no more than one DSO.
The value N can be configured, with 16 or 18 looking like a good choice.
Additionally, DSOs are loaded at random page-aligned address inside these large
regions.
This change has dual purpose:
1. Larger values of N allow a lot more compact CFI shadow implementation.
See change I14dfea630de468eb5620e7f55f92b1397ba06217.
For example, CFI shadow for the system_server process has the following size (RSS, KB):
152 for N = 12, 32 for N = 16, 16 for N = 18.
2. Extra randomization is good for security.
This change does not result in extra RAM usage, because everything is still page-aligned.
It does result in a bit more VM fragmentation because of the gaps between shared libraries.
As it turns out, this fragmentation is barely noticeable because the kernel creates new mapping
at the highest possible address, and we do enough small mappings to almost completely fill the
gaps (ex. in the Zygote the gaps are filled with .ttf file mappings and thread stacks).
I've measured VM fragmentation as the sum of all VM gaps (unmapped regions) that are larger
than 1MB according to /proc/$PID/maps. On aosp_angler-userdebug, the numbers are (in GB):
| N = 12 | N = 18
system_server | 521.9 | 521.1
zygote64 | 522.1 | 521.3
zygote32 | 2.55 | 2.55
mediaserver | 4.00 | 4.00
Change-Id: Ia6df840dd409c82837efd1f263be420d9723c84a
2016-07-16 01:31:42 +02:00
|
|
|
if (mmap_ptr == MAP_FAILED) {
|
|
|
|
return nullptr;
|
|
|
|
}
|
|
|
|
return mmap_ptr;
|
|
|
|
}
|
|
|
|
|
2020-07-15 01:44:57 +02:00
|
|
|
// Minimum alignment of shared library gap. For efficiency, this should match the second level
|
|
|
|
// page size of the platform.
|
|
|
|
#if defined(__LP64__)
|
|
|
|
constexpr size_t kGapAlignment = 1ul << 21; // 2MB
|
|
|
|
#else
|
|
|
|
constexpr size_t kGapAlignment = 0;
|
|
|
|
#endif
|
|
|
|
// Maximum gap size, in the units of kGapAlignment.
|
|
|
|
constexpr size_t kMaxGapUnits = 32;
|
Align-up and randomize shared libraries.
This change implements the following property:
Any 2**N aligned memory region on size 2**N contains no more than one DSO.
The value N can be configured, with 16 or 18 looking like a good choice.
Additionally, DSOs are loaded at random page-aligned address inside these large
regions.
This change has dual purpose:
1. Larger values of N allow a lot more compact CFI shadow implementation.
See change I14dfea630de468eb5620e7f55f92b1397ba06217.
For example, CFI shadow for the system_server process has the following size (RSS, KB):
152 for N = 12, 32 for N = 16, 16 for N = 18.
2. Extra randomization is good for security.
This change does not result in extra RAM usage, because everything is still page-aligned.
It does result in a bit more VM fragmentation because of the gaps between shared libraries.
As it turns out, this fragmentation is barely noticeable because the kernel creates new mapping
at the highest possible address, and we do enough small mappings to almost completely fill the
gaps (ex. in the Zygote the gaps are filled with .ttf file mappings and thread stacks).
I've measured VM fragmentation as the sum of all VM gaps (unmapped regions) that are larger
than 1MB according to /proc/$PID/maps. On aosp_angler-userdebug, the numbers are (in GB):
| N = 12 | N = 18
system_server | 521.9 | 521.1
zygote64 | 522.1 | 521.3
zygote32 | 2.55 | 2.55
mediaserver | 4.00 | 4.00
Change-Id: Ia6df840dd409c82837efd1f263be420d9723c84a
2016-07-16 01:31:42 +02:00
|
|
|
// Allocate enough space so that the end of the desired region aligned up is still inside the
|
|
|
|
// mapping.
|
2022-05-02 21:26:16 +02:00
|
|
|
size_t mmap_size = align_up(size, mapping_align) + mapping_align - page_size();
|
Align-up and randomize shared libraries.
This change implements the following property:
Any 2**N aligned memory region on size 2**N contains no more than one DSO.
The value N can be configured, with 16 or 18 looking like a good choice.
Additionally, DSOs are loaded at random page-aligned address inside these large
regions.
This change has dual purpose:
1. Larger values of N allow a lot more compact CFI shadow implementation.
See change I14dfea630de468eb5620e7f55f92b1397ba06217.
For example, CFI shadow for the system_server process has the following size (RSS, KB):
152 for N = 12, 32 for N = 16, 16 for N = 18.
2. Extra randomization is good for security.
This change does not result in extra RAM usage, because everything is still page-aligned.
It does result in a bit more VM fragmentation because of the gaps between shared libraries.
As it turns out, this fragmentation is barely noticeable because the kernel creates new mapping
at the highest possible address, and we do enough small mappings to almost completely fill the
gaps (ex. in the Zygote the gaps are filled with .ttf file mappings and thread stacks).
I've measured VM fragmentation as the sum of all VM gaps (unmapped regions) that are larger
than 1MB according to /proc/$PID/maps. On aosp_angler-userdebug, the numbers are (in GB):
| N = 12 | N = 18
system_server | 521.9 | 521.1
zygote64 | 522.1 | 521.3
zygote32 | 2.55 | 2.55
mediaserver | 4.00 | 4.00
Change-Id: Ia6df840dd409c82837efd1f263be420d9723c84a
2016-07-16 01:31:42 +02:00
|
|
|
uint8_t* mmap_ptr =
|
|
|
|
reinterpret_cast<uint8_t*>(mmap(nullptr, mmap_size, PROT_NONE, mmap_flags, -1, 0));
|
|
|
|
if (mmap_ptr == MAP_FAILED) {
|
|
|
|
return nullptr;
|
|
|
|
}
|
2020-07-15 01:44:57 +02:00
|
|
|
size_t gap_size = 0;
|
2021-03-24 18:17:39 +01:00
|
|
|
size_t first_byte = reinterpret_cast<size_t>(align_up(mmap_ptr, mapping_align));
|
|
|
|
size_t last_byte = reinterpret_cast<size_t>(align_down(mmap_ptr + mmap_size, mapping_align) - 1);
|
2020-07-15 01:44:57 +02:00
|
|
|
if (kGapAlignment && first_byte / kGapAlignment != last_byte / kGapAlignment) {
|
|
|
|
// This library crosses a 2MB boundary and will fragment a new huge page.
|
|
|
|
// Lets take advantage of that and insert a random number of inaccessible huge pages before that
|
|
|
|
// to improve address randomization and make it harder to locate this library code by probing.
|
|
|
|
munmap(mmap_ptr, mmap_size);
|
2021-03-24 18:17:39 +01:00
|
|
|
mapping_align = std::max(mapping_align, kGapAlignment);
|
2020-07-15 01:44:57 +02:00
|
|
|
gap_size =
|
|
|
|
kGapAlignment * (is_first_stage_init() ? 1 : arc4random_uniform(kMaxGapUnits - 1) + 1);
|
2022-05-02 21:26:16 +02:00
|
|
|
mmap_size = align_up(size + gap_size, mapping_align) + mapping_align - page_size();
|
2020-07-15 01:44:57 +02:00
|
|
|
mmap_ptr = reinterpret_cast<uint8_t*>(mmap(nullptr, mmap_size, PROT_NONE, mmap_flags, -1, 0));
|
|
|
|
if (mmap_ptr == MAP_FAILED) {
|
|
|
|
return nullptr;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
uint8_t *gap_end, *gap_start;
|
|
|
|
if (gap_size) {
|
|
|
|
gap_end = align_down(mmap_ptr + mmap_size, kGapAlignment);
|
|
|
|
gap_start = gap_end - gap_size;
|
|
|
|
} else {
|
|
|
|
gap_start = gap_end = mmap_ptr + mmap_size;
|
|
|
|
}
|
Align-up and randomize shared libraries.
This change implements the following property:
Any 2**N aligned memory region on size 2**N contains no more than one DSO.
The value N can be configured, with 16 or 18 looking like a good choice.
Additionally, DSOs are loaded at random page-aligned address inside these large
regions.
This change has dual purpose:
1. Larger values of N allow a lot more compact CFI shadow implementation.
See change I14dfea630de468eb5620e7f55f92b1397ba06217.
For example, CFI shadow for the system_server process has the following size (RSS, KB):
152 for N = 12, 32 for N = 16, 16 for N = 18.
2. Extra randomization is good for security.
This change does not result in extra RAM usage, because everything is still page-aligned.
It does result in a bit more VM fragmentation because of the gaps between shared libraries.
As it turns out, this fragmentation is barely noticeable because the kernel creates new mapping
at the highest possible address, and we do enough small mappings to almost completely fill the
gaps (ex. in the Zygote the gaps are filled with .ttf file mappings and thread stacks).
I've measured VM fragmentation as the sum of all VM gaps (unmapped regions) that are larger
than 1MB according to /proc/$PID/maps. On aosp_angler-userdebug, the numbers are (in GB):
| N = 12 | N = 18
system_server | 521.9 | 521.1
zygote64 | 522.1 | 521.3
zygote32 | 2.55 | 2.55
mediaserver | 4.00 | 4.00
Change-Id: Ia6df840dd409c82837efd1f263be420d9723c84a
2016-07-16 01:31:42 +02:00
|
|
|
|
2021-03-24 18:17:39 +01:00
|
|
|
uint8_t* first = align_up(mmap_ptr, mapping_align);
|
|
|
|
uint8_t* last = align_down(gap_start, mapping_align) - size;
|
2018-06-01 12:18:56 +02:00
|
|
|
|
2018-11-08 22:40:52 +01:00
|
|
|
// arc4random* is not available in first stage init because /dev/urandom hasn't yet been
|
2018-06-01 12:18:56 +02:00
|
|
|
// created. Don't randomize then.
|
2021-03-24 18:17:39 +01:00
|
|
|
size_t n = is_first_stage_init() ? 0 : arc4random_uniform((last - first) / start_align + 1);
|
|
|
|
uint8_t* start = first + n * start_align;
|
2020-07-15 01:44:57 +02:00
|
|
|
// Unmap the extra space around the allocation.
|
|
|
|
// Keep it mapped PROT_NONE on 64-bit targets where address space is plentiful to make it harder
|
|
|
|
// to defeat ASLR by probing for readable memory mappings.
|
Align-up and randomize shared libraries.
This change implements the following property:
Any 2**N aligned memory region on size 2**N contains no more than one DSO.
The value N can be configured, with 16 or 18 looking like a good choice.
Additionally, DSOs are loaded at random page-aligned address inside these large
regions.
This change has dual purpose:
1. Larger values of N allow a lot more compact CFI shadow implementation.
See change I14dfea630de468eb5620e7f55f92b1397ba06217.
For example, CFI shadow for the system_server process has the following size (RSS, KB):
152 for N = 12, 32 for N = 16, 16 for N = 18.
2. Extra randomization is good for security.
This change does not result in extra RAM usage, because everything is still page-aligned.
It does result in a bit more VM fragmentation because of the gaps between shared libraries.
As it turns out, this fragmentation is barely noticeable because the kernel creates new mapping
at the highest possible address, and we do enough small mappings to almost completely fill the
gaps (ex. in the Zygote the gaps are filled with .ttf file mappings and thread stacks).
I've measured VM fragmentation as the sum of all VM gaps (unmapped regions) that are larger
than 1MB according to /proc/$PID/maps. On aosp_angler-userdebug, the numbers are (in GB):
| N = 12 | N = 18
system_server | 521.9 | 521.1
zygote64 | 522.1 | 521.3
zygote32 | 2.55 | 2.55
mediaserver | 4.00 | 4.00
Change-Id: Ia6df840dd409c82837efd1f263be420d9723c84a
2016-07-16 01:31:42 +02:00
|
|
|
munmap(mmap_ptr, start - mmap_ptr);
|
2020-07-15 01:44:57 +02:00
|
|
|
munmap(start + size, gap_start - (start + size));
|
|
|
|
if (gap_end != mmap_ptr + mmap_size) {
|
|
|
|
munmap(gap_end, mmap_ptr + mmap_size - gap_end);
|
|
|
|
}
|
|
|
|
*out_gap_start = gap_start;
|
|
|
|
*out_gap_size = gap_size;
|
Align-up and randomize shared libraries.
This change implements the following property:
Any 2**N aligned memory region on size 2**N contains no more than one DSO.
The value N can be configured, with 16 or 18 looking like a good choice.
Additionally, DSOs are loaded at random page-aligned address inside these large
regions.
This change has dual purpose:
1. Larger values of N allow a lot more compact CFI shadow implementation.
See change I14dfea630de468eb5620e7f55f92b1397ba06217.
For example, CFI shadow for the system_server process has the following size (RSS, KB):
152 for N = 12, 32 for N = 16, 16 for N = 18.
2. Extra randomization is good for security.
This change does not result in extra RAM usage, because everything is still page-aligned.
It does result in a bit more VM fragmentation because of the gaps between shared libraries.
As it turns out, this fragmentation is barely noticeable because the kernel creates new mapping
at the highest possible address, and we do enough small mappings to almost completely fill the
gaps (ex. in the Zygote the gaps are filled with .ttf file mappings and thread stacks).
I've measured VM fragmentation as the sum of all VM gaps (unmapped regions) that are larger
than 1MB according to /proc/$PID/maps. On aosp_angler-userdebug, the numbers are (in GB):
| N = 12 | N = 18
system_server | 521.9 | 521.1
zygote64 | 522.1 | 521.3
zygote32 | 2.55 | 2.55
mediaserver | 4.00 | 4.00
Change-Id: Ia6df840dd409c82837efd1f263be420d9723c84a
2016-07-16 01:31:42 +02:00
|
|
|
return start;
|
|
|
|
}
|
|
|
|
|
2013-03-06 03:47:58 +01:00
|
|
|
// Reserve a virtual address range big enough to hold all loadable
|
|
|
|
// segments of a program header table. This is done by creating a
|
|
|
|
// private anonymous mmap() with PROT_NONE.
|
2018-10-17 21:59:38 +02:00
|
|
|
bool ElfReader::ReserveAddressSpace(address_space_params* address_space) {
|
2014-02-11 02:46:57 +01:00
|
|
|
ElfW(Addr) min_vaddr;
|
2013-01-11 01:39:58 +01:00
|
|
|
load_size_ = phdr_table_get_load_size(phdr_table_, phdr_num_, &min_vaddr);
|
2013-03-06 03:47:58 +01:00
|
|
|
if (load_size_ == 0) {
|
2015-10-15 21:07:25 +02:00
|
|
|
DL_ERR("\"%s\" has no loadable segments", name_.c_str());
|
2013-03-06 03:47:58 +01:00
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
2013-01-11 01:39:58 +01:00
|
|
|
uint8_t* addr = reinterpret_cast<uint8_t*>(min_vaddr);
|
2014-02-06 15:34:21 +01:00
|
|
|
void* start;
|
|
|
|
|
2018-10-17 21:59:38 +02:00
|
|
|
if (load_size_ > address_space->reserved_size) {
|
|
|
|
if (address_space->must_use_address) {
|
2014-02-06 15:34:21 +01:00
|
|
|
DL_ERR("reserved address space %zd smaller than %zd bytes needed for \"%s\"",
|
2018-10-17 21:59:38 +02:00
|
|
|
load_size_ - address_space->reserved_size, load_size_, name_.c_str());
|
2014-02-06 15:34:21 +01:00
|
|
|
return false;
|
|
|
|
}
|
2022-05-02 21:26:16 +02:00
|
|
|
size_t start_alignment = page_size();
|
2021-03-24 18:17:39 +01:00
|
|
|
if (get_transparent_hugepages_supported() && get_application_target_sdk_version() >= 31) {
|
|
|
|
size_t maximum_alignment = phdr_table_get_maximum_alignment(phdr_table_, phdr_num_);
|
|
|
|
// Limit alignment to PMD size as other alignments reduce the number of
|
|
|
|
// bits available for ASLR for no benefit.
|
2022-05-02 21:26:16 +02:00
|
|
|
start_alignment = maximum_alignment == kPmdSize ? kPmdSize : page_size();
|
2021-03-24 18:17:39 +01:00
|
|
|
}
|
|
|
|
start = ReserveWithAlignmentPadding(load_size_, kLibraryAlignment, start_alignment, &gap_start_,
|
|
|
|
&gap_size_);
|
Align-up and randomize shared libraries.
This change implements the following property:
Any 2**N aligned memory region on size 2**N contains no more than one DSO.
The value N can be configured, with 16 or 18 looking like a good choice.
Additionally, DSOs are loaded at random page-aligned address inside these large
regions.
This change has dual purpose:
1. Larger values of N allow a lot more compact CFI shadow implementation.
See change I14dfea630de468eb5620e7f55f92b1397ba06217.
For example, CFI shadow for the system_server process has the following size (RSS, KB):
152 for N = 12, 32 for N = 16, 16 for N = 18.
2. Extra randomization is good for security.
This change does not result in extra RAM usage, because everything is still page-aligned.
It does result in a bit more VM fragmentation because of the gaps between shared libraries.
As it turns out, this fragmentation is barely noticeable because the kernel creates new mapping
at the highest possible address, and we do enough small mappings to almost completely fill the
gaps (ex. in the Zygote the gaps are filled with .ttf file mappings and thread stacks).
I've measured VM fragmentation as the sum of all VM gaps (unmapped regions) that are larger
than 1MB according to /proc/$PID/maps. On aosp_angler-userdebug, the numbers are (in GB):
| N = 12 | N = 18
system_server | 521.9 | 521.1
zygote64 | 522.1 | 521.3
zygote32 | 2.55 | 2.55
mediaserver | 4.00 | 4.00
Change-Id: Ia6df840dd409c82837efd1f263be420d9723c84a
2016-07-16 01:31:42 +02:00
|
|
|
if (start == nullptr) {
|
2015-10-15 21:07:25 +02:00
|
|
|
DL_ERR("couldn't reserve %zd bytes of address space for \"%s\"", load_size_, name_.c_str());
|
2014-02-06 15:34:21 +01:00
|
|
|
return false;
|
|
|
|
}
|
|
|
|
} else {
|
2018-10-17 21:59:38 +02:00
|
|
|
start = address_space->start_addr;
|
2020-07-15 01:44:57 +02:00
|
|
|
gap_start_ = nullptr;
|
|
|
|
gap_size_ = 0;
|
2016-01-15 20:13:35 +01:00
|
|
|
mapped_by_caller_ = true;
|
2018-10-17 21:59:38 +02:00
|
|
|
|
|
|
|
// Update the reserved address space to subtract the space used by this library.
|
|
|
|
address_space->start_addr = reinterpret_cast<uint8_t*>(address_space->start_addr) + load_size_;
|
|
|
|
address_space->reserved_size -= load_size_;
|
2013-03-06 03:47:58 +01:00
|
|
|
}
|
|
|
|
|
|
|
|
load_start_ = start;
|
2013-01-11 01:39:58 +01:00
|
|
|
load_bias_ = reinterpret_cast<uint8_t*>(start) - addr;
|
2013-03-06 03:47:58 +01:00
|
|
|
return true;
|
2012-06-19 11:21:29 +02:00
|
|
|
}
|
|
|
|
|
2024-02-01 05:23:39 +01:00
|
|
|
// Find the ELF note of type NT_ANDROID_TYPE_PAD_SEGMENT and check that the desc value is 1.
|
|
|
|
bool ElfReader::ReadPadSegmentNote() {
|
|
|
|
// The ELF can have multiple PT_NOTE's, check them all
|
|
|
|
for (size_t i = 0; i < phdr_num_; ++i) {
|
|
|
|
const ElfW(Phdr)* phdr = &phdr_table_[i];
|
|
|
|
|
|
|
|
if (phdr->p_type != PT_NOTE) {
|
|
|
|
continue;
|
|
|
|
}
|
|
|
|
|
2024-02-08 23:58:04 +01:00
|
|
|
// Some obfuscated ELFs may contain "empty" PT_NOTE program headers that don't
|
|
|
|
// point to any part of the ELF (p_memsz == 0). Skip these since there is
|
|
|
|
// nothing to decode. See: b/324468126
|
|
|
|
if (phdr->p_memsz == 0) {
|
|
|
|
continue;
|
|
|
|
}
|
|
|
|
|
2024-02-01 05:23:39 +01:00
|
|
|
// note_fragment is scoped to within the loop so that there is
|
|
|
|
// at most 1 PT_NOTE mapped at anytime during this search.
|
|
|
|
MappedFileFragment note_fragment;
|
|
|
|
if (!note_fragment.Map(fd_, file_offset_, phdr->p_offset, phdr->p_memsz)) {
|
2024-02-14 03:37:12 +01:00
|
|
|
DL_ERR("\"%s\": PT_NOTE mmap(nullptr, %p, PROT_READ, MAP_PRIVATE, %d, %p) failed: %m",
|
|
|
|
name_.c_str(), reinterpret_cast<void*>(phdr->p_memsz), fd_,
|
|
|
|
reinterpret_cast<void*>(page_start(file_offset_ + phdr->p_offset)));
|
2024-02-08 23:58:04 +01:00
|
|
|
return false;
|
2024-02-01 05:23:39 +01:00
|
|
|
}
|
|
|
|
|
|
|
|
const ElfW(Nhdr)* note_hdr = nullptr;
|
|
|
|
const char* note_desc = nullptr;
|
|
|
|
if (!__get_elf_note(NT_ANDROID_TYPE_PAD_SEGMENT, "Android",
|
|
|
|
reinterpret_cast<ElfW(Addr)>(note_fragment.data()),
|
|
|
|
phdr, ¬e_hdr, ¬e_desc)) {
|
|
|
|
continue;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (note_hdr->n_descsz != sizeof(ElfW(Word))) {
|
|
|
|
DL_ERR("\"%s\" NT_ANDROID_TYPE_PAD_SEGMENT note has unexpected n_descsz: %u",
|
|
|
|
name_.c_str(), reinterpret_cast<unsigned int>(note_hdr->n_descsz));
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
|
|
|
// 1 == enabled, 0 == disabled
|
|
|
|
should_pad_segments_ = *reinterpret_cast<const ElfW(Word)*>(note_desc) == 1;
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
2024-03-13 21:35:49 +01:00
|
|
|
static inline void _extend_load_segment_vma(const ElfW(Phdr)* phdr_table, size_t phdr_count,
|
|
|
|
size_t phdr_idx, ElfW(Addr)* p_memsz,
|
|
|
|
ElfW(Addr)* p_filesz, bool should_pad_segments) {
|
|
|
|
const ElfW(Phdr)* phdr = &phdr_table[phdr_idx];
|
|
|
|
const ElfW(Phdr)* next = nullptr;
|
|
|
|
size_t next_idx = phdr_idx + 1;
|
|
|
|
|
|
|
|
if (phdr->p_align == kPageSize || !should_pad_segments) {
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (next_idx < phdr_count && phdr_table[next_idx].p_type == PT_LOAD) {
|
|
|
|
next = &phdr_table[next_idx];
|
|
|
|
}
|
|
|
|
|
|
|
|
// If this is the last LOAD segment, no extension is needed
|
|
|
|
if (!next || *p_memsz != *p_filesz) {
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
|
|
|
ElfW(Addr) next_start = page_start(next->p_vaddr);
|
|
|
|
ElfW(Addr) curr_end = page_end(phdr->p_vaddr + *p_memsz);
|
|
|
|
|
|
|
|
// If adjacent segment mappings overlap, no extension is needed.
|
|
|
|
if (curr_end >= next_start) {
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
|
|
|
// Extend the LOAD segment mapping to be contiguous with that of
|
|
|
|
// the next LOAD segment.
|
|
|
|
ElfW(Addr) extend = next_start - curr_end;
|
|
|
|
*p_memsz += extend;
|
|
|
|
*p_filesz += extend;
|
|
|
|
}
|
|
|
|
|
2013-03-06 03:47:58 +01:00
|
|
|
bool ElfReader::LoadSegments() {
|
|
|
|
for (size_t i = 0; i < phdr_num_; ++i) {
|
2014-02-11 02:46:57 +01:00
|
|
|
const ElfW(Phdr)* phdr = &phdr_table_[i];
|
2012-06-19 11:21:29 +02:00
|
|
|
|
2013-03-06 03:47:58 +01:00
|
|
|
if (phdr->p_type != PT_LOAD) {
|
|
|
|
continue;
|
|
|
|
}
|
2012-06-19 11:21:29 +02:00
|
|
|
|
2024-03-13 21:35:49 +01:00
|
|
|
ElfW(Addr) p_memsz = phdr->p_memsz;
|
|
|
|
ElfW(Addr) p_filesz = phdr->p_filesz;
|
|
|
|
_extend_load_segment_vma(phdr_table_, phdr_num_, i, &p_memsz, &p_filesz, should_pad_segments_);
|
|
|
|
|
2013-03-06 03:47:58 +01:00
|
|
|
// Segment addresses in memory.
|
2014-02-11 02:46:57 +01:00
|
|
|
ElfW(Addr) seg_start = phdr->p_vaddr + load_bias_;
|
2024-03-13 21:35:49 +01:00
|
|
|
ElfW(Addr) seg_end = seg_start + p_memsz;
|
2012-06-19 11:21:29 +02:00
|
|
|
|
2022-05-02 21:26:16 +02:00
|
|
|
ElfW(Addr) seg_page_start = page_start(seg_start);
|
|
|
|
ElfW(Addr) seg_page_end = page_end(seg_end);
|
2012-06-19 11:21:29 +02:00
|
|
|
|
2024-03-13 21:35:49 +01:00
|
|
|
ElfW(Addr) seg_file_end = seg_start + p_filesz;
|
2012-06-19 11:21:29 +02:00
|
|
|
|
2013-03-06 03:47:58 +01:00
|
|
|
// File offsets.
|
2014-02-11 02:46:57 +01:00
|
|
|
ElfW(Addr) file_start = phdr->p_offset;
|
2024-03-13 21:35:49 +01:00
|
|
|
ElfW(Addr) file_end = file_start + p_filesz;
|
2012-06-19 11:21:29 +02:00
|
|
|
|
2022-05-02 21:26:16 +02:00
|
|
|
ElfW(Addr) file_page_start = page_start(file_start);
|
2014-02-11 02:46:57 +01:00
|
|
|
ElfW(Addr) file_length = file_end - file_page_start;
|
2013-05-22 01:49:24 +02:00
|
|
|
|
2015-06-26 00:51:41 +02:00
|
|
|
if (file_size_ <= 0) {
|
2015-10-15 21:07:25 +02:00
|
|
|
DL_ERR("\"%s\" invalid file size: %" PRId64, name_.c_str(), file_size_);
|
2015-06-26 00:51:41 +02:00
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
2024-03-13 21:35:49 +01:00
|
|
|
if (file_start + phdr->p_filesz > static_cast<size_t>(file_size_)) {
|
2015-06-26 00:51:41 +02:00
|
|
|
DL_ERR("invalid ELF file \"%s\" load segment[%zd]:"
|
|
|
|
" p_offset (%p) + p_filesz (%p) ( = %p) past end of file (0x%" PRIx64 ")",
|
2015-10-15 21:07:25 +02:00
|
|
|
name_.c_str(), i, reinterpret_cast<void*>(phdr->p_offset),
|
2015-06-26 00:51:41 +02:00
|
|
|
reinterpret_cast<void*>(phdr->p_filesz),
|
2024-03-13 21:35:49 +01:00
|
|
|
reinterpret_cast<void*>(file_start + phdr->p_filesz), file_size_);
|
2015-06-26 00:51:41 +02:00
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
2013-05-22 01:49:24 +02:00
|
|
|
if (file_length != 0) {
|
2016-08-11 03:54:06 +02:00
|
|
|
int prot = PFLAGS_TO_PROT(phdr->p_flags);
|
|
|
|
if ((prot & (PROT_EXEC | PROT_WRITE)) == (PROT_EXEC | PROT_WRITE)) {
|
2016-11-16 01:54:16 +01:00
|
|
|
// W + E PT_LOAD segments are not allowed in O.
|
2019-12-20 22:26:14 +01:00
|
|
|
if (get_application_target_sdk_version() >= 26) {
|
2018-02-28 20:29:45 +01:00
|
|
|
DL_ERR_AND_LOG("\"%s\": W+E load segments are not allowed", name_.c_str());
|
2016-11-16 01:54:16 +01:00
|
|
|
return false;
|
|
|
|
}
|
2019-12-20 22:26:14 +01:00
|
|
|
DL_WARN_documented_change(26,
|
2018-02-28 20:29:45 +01:00
|
|
|
"writable-and-executable-segments-enforced-for-api-level-26",
|
|
|
|
"\"%s\" has load segments that are both writable and executable",
|
|
|
|
name_.c_str());
|
2016-11-16 01:54:16 +01:00
|
|
|
add_dlwarning(name_.c_str(), "W+E load segments");
|
2016-08-11 03:54:06 +02:00
|
|
|
}
|
|
|
|
|
2014-10-04 02:52:44 +02:00
|
|
|
void* seg_addr = mmap64(reinterpret_cast<void*>(seg_page_start),
|
2013-05-22 01:49:24 +02:00
|
|
|
file_length,
|
2016-08-11 03:54:06 +02:00
|
|
|
prot,
|
2013-05-22 01:49:24 +02:00
|
|
|
MAP_FIXED|MAP_PRIVATE,
|
|
|
|
fd_,
|
2014-10-04 02:52:44 +02:00
|
|
|
file_offset_ + file_page_start);
|
2013-05-22 01:49:24 +02:00
|
|
|
if (seg_addr == MAP_FAILED) {
|
2015-10-15 21:07:25 +02:00
|
|
|
DL_ERR("couldn't map \"%s\" segment %zd: %s", name_.c_str(), i, strerror(errno));
|
2013-05-22 01:49:24 +02:00
|
|
|
return false;
|
|
|
|
}
|
2021-03-24 18:17:39 +01:00
|
|
|
|
|
|
|
// Mark segments as huge page eligible if they meet the requirements
|
|
|
|
// (executable and PMD aligned).
|
|
|
|
if ((phdr->p_flags & PF_X) && phdr->p_align == kPmdSize &&
|
|
|
|
get_transparent_hugepages_supported()) {
|
|
|
|
madvise(seg_addr, file_length, MADV_HUGEPAGE);
|
|
|
|
}
|
2013-03-06 03:47:58 +01:00
|
|
|
}
|
2012-06-19 11:21:29 +02:00
|
|
|
|
2024-03-13 21:35:49 +01:00
|
|
|
// if the segment is writable, and its memory map extends beyond
|
|
|
|
// the segment contents on file (p_filesz); zero-fill it until the
|
|
|
|
// end of the mapping backed by the file, rounded to the next
|
|
|
|
// page boundary; as this portion of the mapping corresponds to either
|
|
|
|
// garbage (partial page at the end) or data from other segments.
|
|
|
|
//
|
|
|
|
// If any part of the mapping extends beyond the file size there is
|
|
|
|
// no need to zero it since that region is not touchable by userspace
|
|
|
|
// and attempting to do so will causes the kernel to throw a SIGBUS.
|
|
|
|
//
|
|
|
|
// See: system/libprocinfo/include/procinfo/process_map_size.h
|
|
|
|
uint64_t file_backed_size = ::android::procinfo::MappedFileSize(seg_page_start,
|
|
|
|
page_end(seg_page_start + file_length),
|
|
|
|
file_offset_ + file_page_start, file_size_);
|
|
|
|
// _seg_file_end = unextended seg_file_end
|
|
|
|
uint64_t _seg_file_end = seg_start + phdr->p_filesz;
|
|
|
|
uint64_t zero_fill_len = file_backed_size - (_seg_file_end - seg_page_start);
|
|
|
|
if ((phdr->p_flags & PF_W) != 0 && zero_fill_len > 0) {
|
|
|
|
memset(reinterpret_cast<void*>(_seg_file_end), 0, zero_fill_len);
|
2013-03-06 03:47:58 +01:00
|
|
|
}
|
2012-06-19 11:21:29 +02:00
|
|
|
|
2022-05-02 21:26:16 +02:00
|
|
|
seg_file_end = page_end(seg_file_end);
|
2013-03-06 03:47:58 +01:00
|
|
|
|
|
|
|
// seg_file_end is now the first page address after the file
|
|
|
|
// content. If seg_end is larger, we need to zero anything
|
|
|
|
// between them. This is done by using a private anonymous
|
|
|
|
// map for all extra pages.
|
|
|
|
if (seg_page_end > seg_file_end) {
|
2016-01-28 03:12:03 +01:00
|
|
|
size_t zeromap_size = seg_page_end - seg_file_end;
|
2014-02-12 01:59:37 +01:00
|
|
|
void* zeromap = mmap(reinterpret_cast<void*>(seg_file_end),
|
2016-01-28 03:12:03 +01:00
|
|
|
zeromap_size,
|
2013-03-06 03:47:58 +01:00
|
|
|
PFLAGS_TO_PROT(phdr->p_flags),
|
|
|
|
MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE,
|
|
|
|
-1,
|
|
|
|
0);
|
|
|
|
if (zeromap == MAP_FAILED) {
|
2015-10-15 21:07:25 +02:00
|
|
|
DL_ERR("couldn't zero fill \"%s\" gap: %s", name_.c_str(), strerror(errno));
|
2013-03-06 03:47:58 +01:00
|
|
|
return false;
|
|
|
|
}
|
2016-01-28 03:12:03 +01:00
|
|
|
|
|
|
|
prctl(PR_SET_VMA, PR_SET_VMA_ANON_NAME, zeromap, zeromap_size, ".bss");
|
2012-06-19 11:21:29 +02:00
|
|
|
}
|
2013-03-06 03:47:58 +01:00
|
|
|
}
|
|
|
|
return true;
|
2012-06-19 11:21:29 +02:00
|
|
|
}
|
|
|
|
|
2015-04-01 23:18:48 +02:00
|
|
|
/* Used internally. Used to set the protection bits of all loaded segments
|
|
|
|
* with optional extra flags (i.e. really PROT_WRITE). Used by
|
|
|
|
* phdr_table_protect_segments and phdr_table_unprotect_segments.
|
|
|
|
*/
|
|
|
|
static int _phdr_table_set_load_prot(const ElfW(Phdr)* phdr_table, size_t phdr_count,
|
2024-03-13 21:35:49 +01:00
|
|
|
ElfW(Addr) load_bias, int extra_prot_flags,
|
|
|
|
bool should_pad_segments) {
|
|
|
|
for (size_t i = 0; i < phdr_count; ++i) {
|
|
|
|
const ElfW(Phdr)* phdr = &phdr_table[i];
|
2015-04-01 23:18:48 +02:00
|
|
|
|
|
|
|
if (phdr->p_type != PT_LOAD || (phdr->p_flags & PF_W) != 0) {
|
|
|
|
continue;
|
|
|
|
}
|
|
|
|
|
2024-03-13 21:35:49 +01:00
|
|
|
ElfW(Addr) p_memsz = phdr->p_memsz;
|
|
|
|
ElfW(Addr) p_filesz = phdr->p_filesz;
|
|
|
|
_extend_load_segment_vma(phdr_table, phdr_count, i, &p_memsz, &p_filesz, should_pad_segments);
|
|
|
|
|
|
|
|
ElfW(Addr) seg_page_start = page_start(phdr->p_vaddr + load_bias);
|
|
|
|
ElfW(Addr) seg_page_end = page_end(phdr->p_vaddr + p_memsz + load_bias);
|
2015-04-01 23:18:48 +02:00
|
|
|
|
2020-02-24 14:15:25 +01:00
|
|
|
int prot = PFLAGS_TO_PROT(phdr->p_flags) | extra_prot_flags;
|
|
|
|
if ((prot & PROT_WRITE) != 0) {
|
linker: never mark pages simultaneously writable / executable
When the Android dynamic linker handles a text relocation,
it first relaxes the permissions on the segment being modified,
performs the modifications, and then restores the page permissions.
The relaxation worked by adding PROT_WRITE to whatever protection
bits were set in the section. In effect, the pages were getting set
to PROT_READ|PROT_WRITE|PROT_EXEC, modified, then restored to
PROT_READ|PROT_EXEC
The SELinux kernel code differentiates between 4 different kinds
of executable memory:
* Executable stack (execstack)
* Executable heap (execheap)
* File-based executable code which has been modified (execmod)
* All other executable memory (execmem)
The execmod capability is only triggered by the kernel when a
dirty but non-executable mmap()ed page becomes executable. When that
occurs, an SELinux policy check is done to see if the execmod capability
is provided by policy.
However, if the page is already executable, and PROT_WRITE is added
to the page, it's considered an execmem permission check, not an execmod
permission check.
There are certain circumstances where we may want to distinguish between
execmod and execmem. This change adjusts the dynamic linker to avoid
using RWX pages, so that an RX -> RW -> RX transition will properly
be detected as an execmod permission check instead of an execmem permission
check.
Bug: 20013628
Change-Id: I14d7be29170b156942f9809023f3b2fc1f37846c
2015-04-02 01:57:50 +02:00
|
|
|
// make sure we're never simultaneously writable / executable
|
|
|
|
prot &= ~PROT_EXEC;
|
|
|
|
}
|
2020-02-24 14:15:25 +01:00
|
|
|
#if defined(__aarch64__)
|
|
|
|
if ((prot & PROT_EXEC) == 0) {
|
|
|
|
// Though it is not specified don't add PROT_BTI if segment is not
|
|
|
|
// executable.
|
|
|
|
prot &= ~PROT_BTI;
|
|
|
|
}
|
|
|
|
#endif
|
linker: never mark pages simultaneously writable / executable
When the Android dynamic linker handles a text relocation,
it first relaxes the permissions on the segment being modified,
performs the modifications, and then restores the page permissions.
The relaxation worked by adding PROT_WRITE to whatever protection
bits were set in the section. In effect, the pages were getting set
to PROT_READ|PROT_WRITE|PROT_EXEC, modified, then restored to
PROT_READ|PROT_EXEC
The SELinux kernel code differentiates between 4 different kinds
of executable memory:
* Executable stack (execstack)
* Executable heap (execheap)
* File-based executable code which has been modified (execmod)
* All other executable memory (execmem)
The execmod capability is only triggered by the kernel when a
dirty but non-executable mmap()ed page becomes executable. When that
occurs, an SELinux policy check is done to see if the execmod capability
is provided by policy.
However, if the page is already executable, and PROT_WRITE is added
to the page, it's considered an execmem permission check, not an execmod
permission check.
There are certain circumstances where we may want to distinguish between
execmod and execmem. This change adjusts the dynamic linker to avoid
using RWX pages, so that an RX -> RW -> RX transition will properly
be detected as an execmod permission check instead of an execmem permission
check.
Bug: 20013628
Change-Id: I14d7be29170b156942f9809023f3b2fc1f37846c
2015-04-02 01:57:50 +02:00
|
|
|
|
2020-02-24 14:15:25 +01:00
|
|
|
int ret =
|
|
|
|
mprotect(reinterpret_cast<void*>(seg_page_start), seg_page_end - seg_page_start, prot);
|
2015-04-01 23:18:48 +02:00
|
|
|
if (ret < 0) {
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Restore the original protection modes for all loadable segments.
|
|
|
|
* You should only call this after phdr_table_unprotect_segments and
|
|
|
|
* applying all relocations.
|
|
|
|
*
|
2020-02-24 14:15:25 +01:00
|
|
|
* AArch64: also called from linker_main and ElfReader::Load to apply
|
|
|
|
* PROT_BTI for loaded main so and other so-s.
|
|
|
|
*
|
2015-04-01 23:18:48 +02:00
|
|
|
* Input:
|
|
|
|
* phdr_table -> program header table
|
|
|
|
* phdr_count -> number of entries in tables
|
|
|
|
* load_bias -> load bias
|
2024-03-13 21:35:49 +01:00
|
|
|
* should_pad_segments -> Are segments extended to avoid gaps in the memory map
|
2020-02-24 14:15:25 +01:00
|
|
|
* prop -> GnuPropertySection or nullptr
|
2015-04-01 23:18:48 +02:00
|
|
|
* Return:
|
2023-10-20 15:32:33 +02:00
|
|
|
* 0 on success, -1 on failure (error code in errno).
|
2015-04-01 23:18:48 +02:00
|
|
|
*/
|
2020-02-24 14:15:25 +01:00
|
|
|
int phdr_table_protect_segments(const ElfW(Phdr)* phdr_table, size_t phdr_count,
|
2024-03-13 21:35:49 +01:00
|
|
|
ElfW(Addr) load_bias, bool should_pad_segments,
|
|
|
|
const GnuPropertySection* prop __unused) {
|
2020-02-24 14:15:25 +01:00
|
|
|
int prot = 0;
|
|
|
|
#if defined(__aarch64__)
|
|
|
|
if ((prop != nullptr) && prop->IsBTICompatible()) {
|
|
|
|
prot |= PROT_BTI;
|
|
|
|
}
|
|
|
|
#endif
|
2024-03-13 21:35:49 +01:00
|
|
|
return _phdr_table_set_load_prot(phdr_table, phdr_count, load_bias, prot, should_pad_segments);
|
2015-04-01 23:18:48 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
/* Change the protection of all loaded segments in memory to writable.
|
|
|
|
* This is useful before performing relocations. Once completed, you
|
|
|
|
* will have to call phdr_table_protect_segments to restore the original
|
|
|
|
* protection flags on all segments.
|
|
|
|
*
|
|
|
|
* Note that some writable segments can also have their content turned
|
|
|
|
* to read-only by calling phdr_table_protect_gnu_relro. This is no
|
|
|
|
* performed here.
|
|
|
|
*
|
|
|
|
* Input:
|
|
|
|
* phdr_table -> program header table
|
|
|
|
* phdr_count -> number of entries in tables
|
|
|
|
* load_bias -> load bias
|
2024-03-13 21:35:49 +01:00
|
|
|
* should_pad_segments -> Are segments extended to avoid gaps in the memory map
|
2015-04-01 23:18:48 +02:00
|
|
|
* Return:
|
2023-10-20 15:32:33 +02:00
|
|
|
* 0 on success, -1 on failure (error code in errno).
|
2015-04-01 23:18:48 +02:00
|
|
|
*/
|
|
|
|
int phdr_table_unprotect_segments(const ElfW(Phdr)* phdr_table,
|
2024-03-13 21:35:49 +01:00
|
|
|
size_t phdr_count, ElfW(Addr) load_bias,
|
|
|
|
bool should_pad_segments) {
|
|
|
|
return _phdr_table_set_load_prot(phdr_table, phdr_count, load_bias, PROT_WRITE,
|
|
|
|
should_pad_segments);
|
2015-04-01 23:18:48 +02:00
|
|
|
}
|
|
|
|
|
2024-03-13 21:38:04 +01:00
|
|
|
static inline void _extend_gnu_relro_prot_end(const ElfW(Phdr)* relro_phdr,
|
|
|
|
const ElfW(Phdr)* phdr_table, size_t phdr_count,
|
|
|
|
ElfW(Addr) load_bias, ElfW(Addr)* seg_page_end,
|
|
|
|
bool should_pad_segments) {
|
|
|
|
// Find the index and phdr of the LOAD containing the GNU_RELRO segment
|
|
|
|
for (size_t index = 0; index < phdr_count; ++index) {
|
|
|
|
const ElfW(Phdr)* phdr = &phdr_table[index];
|
|
|
|
|
|
|
|
if (phdr->p_type == PT_LOAD && phdr->p_vaddr == relro_phdr->p_vaddr) {
|
|
|
|
// If the PT_GNU_RELRO mem size is not at least as large as the corresponding
|
|
|
|
// LOAD segment mem size, we need to protect only a partial region of the
|
|
|
|
// LOAD segment and therefore cannot avoid a VMA split.
|
|
|
|
//
|
|
|
|
// Note: Don't check the page-aligned mem sizes since the extended protection
|
|
|
|
// may incorrectly write protect non-relocation data.
|
|
|
|
//
|
|
|
|
// Example:
|
|
|
|
//
|
|
|
|
// |---- 3K ----|-- 1K --|---- 3K ---- |-- 1K --|
|
|
|
|
// ----------------------------------------------------------------
|
|
|
|
// | | | | |
|
|
|
|
// SEG X | RO | RO | RW | | SEG Y
|
|
|
|
// | | | | |
|
|
|
|
// ----------------------------------------------------------------
|
|
|
|
// | | |
|
|
|
|
// | | |
|
|
|
|
// | | |
|
|
|
|
// relro_vaddr relro_vaddr relro_vaddr
|
|
|
|
// (load_vaddr) + +
|
|
|
|
// relro_memsz load_memsz
|
|
|
|
//
|
|
|
|
// ----------------------------------------------------------------
|
|
|
|
// | PAGE | PAGE |
|
|
|
|
// ----------------------------------------------------------------
|
|
|
|
// | Potential |
|
|
|
|
// |----- Extended RO ----|
|
|
|
|
// | Protection |
|
|
|
|
//
|
|
|
|
// If the check below uses page aligned mem sizes it will cause incorrect write
|
|
|
|
// protection of the 3K RW part of the LOAD segment containing the GNU_RELRO.
|
|
|
|
if (relro_phdr->p_memsz < phdr->p_memsz) {
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
|
|
|
ElfW(Addr) p_memsz = phdr->p_memsz;
|
|
|
|
ElfW(Addr) p_filesz = phdr->p_filesz;
|
|
|
|
|
|
|
|
// Attempt extending the VMA (mprotect range). Without extending the range,
|
|
|
|
// mprotect will only RO protect a part of the extended RW LOAD segment, which
|
|
|
|
// will leave an extra split RW VMA (the gap).
|
|
|
|
_extend_load_segment_vma(phdr_table, phdr_count, index, &p_memsz, &p_filesz,
|
|
|
|
should_pad_segments);
|
|
|
|
|
|
|
|
*seg_page_end = page_end(phdr->p_vaddr + p_memsz + load_bias);
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2012-06-19 11:21:29 +02:00
|
|
|
/* Used internally by phdr_table_protect_gnu_relro and
|
|
|
|
* phdr_table_unprotect_gnu_relro.
|
|
|
|
*/
|
2014-02-11 02:46:57 +01:00
|
|
|
static int _phdr_table_set_gnu_relro_prot(const ElfW(Phdr)* phdr_table, size_t phdr_count,
|
2024-03-13 21:38:04 +01:00
|
|
|
ElfW(Addr) load_bias, int prot_flags,
|
|
|
|
bool should_pad_segments) {
|
2014-02-11 02:46:57 +01:00
|
|
|
const ElfW(Phdr)* phdr = phdr_table;
|
|
|
|
const ElfW(Phdr)* phdr_limit = phdr + phdr_count;
|
|
|
|
|
|
|
|
for (phdr = phdr_table; phdr < phdr_limit; phdr++) {
|
|
|
|
if (phdr->p_type != PT_GNU_RELRO) {
|
|
|
|
continue;
|
2012-06-19 11:21:29 +02:00
|
|
|
}
|
2014-02-11 02:46:57 +01:00
|
|
|
|
|
|
|
// Tricky: what happens when the relro segment does not start
|
|
|
|
// or end at page boundaries? We're going to be over-protective
|
|
|
|
// here and put every page touched by the segment as read-only.
|
|
|
|
|
|
|
|
// This seems to match Ian Lance Taylor's description of the
|
|
|
|
// feature at http://www.airs.com/blog/archives/189.
|
|
|
|
|
|
|
|
// Extract:
|
|
|
|
// Note that the current dynamic linker code will only work
|
|
|
|
// correctly if the PT_GNU_RELRO segment starts on a page
|
|
|
|
// boundary. This is because the dynamic linker rounds the
|
|
|
|
// p_vaddr field down to the previous page boundary. If
|
|
|
|
// there is anything on the page which should not be read-only,
|
|
|
|
// the program is likely to fail at runtime. So in effect the
|
|
|
|
// linker must only emit a PT_GNU_RELRO segment if it ensures
|
|
|
|
// that it starts on a page boundary.
|
2024-02-14 01:04:10 +01:00
|
|
|
ElfW(Addr) seg_page_start = page_start(phdr->p_vaddr) + load_bias;
|
|
|
|
ElfW(Addr) seg_page_end = page_end(phdr->p_vaddr + phdr->p_memsz) + load_bias;
|
2024-03-13 21:38:04 +01:00
|
|
|
_extend_gnu_relro_prot_end(phdr, phdr_table, phdr_count, load_bias, &seg_page_end,
|
|
|
|
should_pad_segments);
|
2014-02-11 02:46:57 +01:00
|
|
|
|
2014-02-12 01:59:37 +01:00
|
|
|
int ret = mprotect(reinterpret_cast<void*>(seg_page_start),
|
2014-02-11 02:46:57 +01:00
|
|
|
seg_page_end - seg_page_start,
|
|
|
|
prot_flags);
|
|
|
|
if (ret < 0) {
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return 0;
|
2012-06-19 11:21:29 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
/* Apply GNU relro protection if specified by the program header. This will
|
|
|
|
* turn some of the pages of a writable PT_LOAD segment to read-only, as
|
|
|
|
* specified by one or more PT_GNU_RELRO segments. This must be always
|
|
|
|
* performed after relocations.
|
|
|
|
*
|
linker: avoid clobbering the .dynamic section of shared libs
This patch removes the DT_NEEDED hack which stores pointers
to soinfo structs in the .dynamic section of the library
being loaded.
Instead, it caches the soinfo struct pointers on the stack
during relocation time. After relocation time, i.e. when
calling constructors and destructors of the shared library
and its dependencies, uncached access is used instead,
doing lookups using the string table entries pointed to by
the DT_NEEDED entries.
By removing this hack, it is no longer needed to undo the
PT_GNURELRO protection, i.e., all non-writable mappings
can remain non-writable during their entire lifespan.
Even though, strictly speaking, the algorithmic complexity
has increased somewhat, the real-world adverse effect
is negligible on the systems I have tested.
Change-Id: I2361502560b96b5878f7f94a8e8a215350d70d64
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@gmail.com>
2012-08-14 12:30:09 +02:00
|
|
|
* The areas typically covered are .got and .data.rel.ro, these are
|
|
|
|
* read-only from the program's POV, but contain absolute addresses
|
|
|
|
* that need to be relocated before use.
|
2012-06-19 11:21:29 +02:00
|
|
|
*
|
|
|
|
* Input:
|
|
|
|
* phdr_table -> program header table
|
2012-08-16 01:56:00 +02:00
|
|
|
* phdr_count -> number of entries in tables
|
2012-06-19 11:21:29 +02:00
|
|
|
* load_bias -> load bias
|
2024-03-13 21:38:04 +01:00
|
|
|
* should_pad_segments -> Were segments extended to avoid gaps in the memory map
|
2012-06-19 11:21:29 +02:00
|
|
|
* Return:
|
2023-10-20 15:32:33 +02:00
|
|
|
* 0 on success, -1 on failure (error code in errno).
|
2012-06-19 11:21:29 +02:00
|
|
|
*/
|
2024-03-13 21:38:04 +01:00
|
|
|
int phdr_table_protect_gnu_relro(const ElfW(Phdr)* phdr_table, size_t phdr_count,
|
|
|
|
ElfW(Addr) load_bias, bool should_pad_segments) {
|
|
|
|
return _phdr_table_set_gnu_relro_prot(phdr_table, phdr_count, load_bias, PROT_READ,
|
|
|
|
should_pad_segments);
|
2012-06-19 11:21:29 +02:00
|
|
|
}
|
|
|
|
|
2014-02-27 14:18:00 +01:00
|
|
|
/* Serialize the GNU relro segments to the given file descriptor. This can be
|
|
|
|
* performed after relocations to allow another process to later share the
|
|
|
|
* relocated segment, if it was loaded at the same address.
|
|
|
|
*
|
|
|
|
* Input:
|
|
|
|
* phdr_table -> program header table
|
|
|
|
* phdr_count -> number of entries in tables
|
|
|
|
* load_bias -> load bias
|
|
|
|
* fd -> writable file descriptor to use
|
2019-04-02 23:04:42 +02:00
|
|
|
* file_offset -> pointer to offset into file descriptor to use/update
|
2014-02-27 14:18:00 +01:00
|
|
|
* Return:
|
2023-10-20 15:32:33 +02:00
|
|
|
* 0 on success, -1 on failure (error code in errno).
|
2014-02-27 14:18:00 +01:00
|
|
|
*/
|
2015-03-31 03:43:38 +02:00
|
|
|
int phdr_table_serialize_gnu_relro(const ElfW(Phdr)* phdr_table,
|
|
|
|
size_t phdr_count,
|
|
|
|
ElfW(Addr) load_bias,
|
2019-04-02 23:04:42 +02:00
|
|
|
int fd,
|
|
|
|
size_t* file_offset) {
|
2014-02-27 14:18:00 +01:00
|
|
|
const ElfW(Phdr)* phdr = phdr_table;
|
|
|
|
const ElfW(Phdr)* phdr_limit = phdr + phdr_count;
|
|
|
|
|
|
|
|
for (phdr = phdr_table; phdr < phdr_limit; phdr++) {
|
|
|
|
if (phdr->p_type != PT_GNU_RELRO) {
|
|
|
|
continue;
|
|
|
|
}
|
|
|
|
|
2022-05-02 21:26:16 +02:00
|
|
|
ElfW(Addr) seg_page_start = page_start(phdr->p_vaddr) + load_bias;
|
|
|
|
ElfW(Addr) seg_page_end = page_end(phdr->p_vaddr + phdr->p_memsz) + load_bias;
|
2014-02-27 14:18:00 +01:00
|
|
|
ssize_t size = seg_page_end - seg_page_start;
|
|
|
|
|
|
|
|
ssize_t written = TEMP_FAILURE_RETRY(write(fd, reinterpret_cast<void*>(seg_page_start), size));
|
|
|
|
if (written != size) {
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
void* map = mmap(reinterpret_cast<void*>(seg_page_start), size, PROT_READ,
|
2019-04-02 23:04:42 +02:00
|
|
|
MAP_PRIVATE|MAP_FIXED, fd, *file_offset);
|
2014-02-27 14:18:00 +01:00
|
|
|
if (map == MAP_FAILED) {
|
|
|
|
return -1;
|
|
|
|
}
|
2019-04-02 23:04:42 +02:00
|
|
|
*file_offset += size;
|
2014-02-27 14:18:00 +01:00
|
|
|
}
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Where possible, replace the GNU relro segments with mappings of the given
|
|
|
|
* file descriptor. This can be performed after relocations to allow a file
|
|
|
|
* previously created by phdr_table_serialize_gnu_relro in another process to
|
|
|
|
* replace the dirty relocated pages, saving memory, if it was loaded at the
|
|
|
|
* same address. We have to compare the data before we map over it, since some
|
|
|
|
* parts of the relro segment may not be identical due to other libraries in
|
|
|
|
* the process being loaded at different addresses.
|
|
|
|
*
|
|
|
|
* Input:
|
|
|
|
* phdr_table -> program header table
|
|
|
|
* phdr_count -> number of entries in tables
|
|
|
|
* load_bias -> load bias
|
|
|
|
* fd -> readable file descriptor to use
|
2018-10-17 21:59:38 +02:00
|
|
|
* file_offset -> pointer to offset into file descriptor to use/update
|
2014-02-27 14:18:00 +01:00
|
|
|
* Return:
|
2023-10-20 15:32:33 +02:00
|
|
|
* 0 on success, -1 on failure (error code in errno).
|
2014-02-27 14:18:00 +01:00
|
|
|
*/
|
2015-03-31 03:43:38 +02:00
|
|
|
int phdr_table_map_gnu_relro(const ElfW(Phdr)* phdr_table,
|
|
|
|
size_t phdr_count,
|
|
|
|
ElfW(Addr) load_bias,
|
2018-10-17 21:59:38 +02:00
|
|
|
int fd,
|
|
|
|
size_t* file_offset) {
|
2014-02-27 14:18:00 +01:00
|
|
|
// Map the file at a temporary location so we can compare its contents.
|
|
|
|
struct stat file_stat;
|
|
|
|
if (TEMP_FAILURE_RETRY(fstat(fd, &file_stat)) != 0) {
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
off_t file_size = file_stat.st_size;
|
2014-08-29 21:02:36 +02:00
|
|
|
void* temp_mapping = nullptr;
|
2014-04-30 16:48:40 +02:00
|
|
|
if (file_size > 0) {
|
2014-08-29 21:02:36 +02:00
|
|
|
temp_mapping = mmap(nullptr, file_size, PROT_READ, MAP_PRIVATE, fd, 0);
|
2014-04-30 16:48:40 +02:00
|
|
|
if (temp_mapping == MAP_FAILED) {
|
|
|
|
return -1;
|
|
|
|
}
|
2014-02-27 14:18:00 +01:00
|
|
|
}
|
|
|
|
|
|
|
|
// Iterate over the relro segments and compare/remap the pages.
|
|
|
|
const ElfW(Phdr)* phdr = phdr_table;
|
|
|
|
const ElfW(Phdr)* phdr_limit = phdr + phdr_count;
|
|
|
|
|
|
|
|
for (phdr = phdr_table; phdr < phdr_limit; phdr++) {
|
|
|
|
if (phdr->p_type != PT_GNU_RELRO) {
|
|
|
|
continue;
|
|
|
|
}
|
|
|
|
|
2022-05-02 21:26:16 +02:00
|
|
|
ElfW(Addr) seg_page_start = page_start(phdr->p_vaddr) + load_bias;
|
|
|
|
ElfW(Addr) seg_page_end = page_end(phdr->p_vaddr + phdr->p_memsz) + load_bias;
|
2014-02-27 14:18:00 +01:00
|
|
|
|
2018-10-17 21:59:38 +02:00
|
|
|
char* file_base = static_cast<char*>(temp_mapping) + *file_offset;
|
2014-02-27 14:18:00 +01:00
|
|
|
char* mem_base = reinterpret_cast<char*>(seg_page_start);
|
|
|
|
size_t match_offset = 0;
|
|
|
|
size_t size = seg_page_end - seg_page_start;
|
|
|
|
|
2018-10-17 21:59:38 +02:00
|
|
|
if (file_size - *file_offset < size) {
|
2014-04-30 16:48:40 +02:00
|
|
|
// File is too short to compare to this segment. The contents are likely
|
|
|
|
// different as well (it's probably for a different library version) so
|
|
|
|
// just don't bother checking.
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
2014-02-27 14:18:00 +01:00
|
|
|
while (match_offset < size) {
|
|
|
|
// Skip over dissimilar pages.
|
|
|
|
while (match_offset < size &&
|
2022-05-02 21:26:16 +02:00
|
|
|
memcmp(mem_base + match_offset, file_base + match_offset, page_size()) != 0) {
|
|
|
|
match_offset += page_size();
|
2014-02-27 14:18:00 +01:00
|
|
|
}
|
|
|
|
|
|
|
|
// Count similar pages.
|
|
|
|
size_t mismatch_offset = match_offset;
|
|
|
|
while (mismatch_offset < size &&
|
2022-05-02 21:26:16 +02:00
|
|
|
memcmp(mem_base + mismatch_offset, file_base + mismatch_offset, page_size()) == 0) {
|
|
|
|
mismatch_offset += page_size();
|
2014-02-27 14:18:00 +01:00
|
|
|
}
|
|
|
|
|
|
|
|
// Map over similar pages.
|
|
|
|
if (mismatch_offset > match_offset) {
|
|
|
|
void* map = mmap(mem_base + match_offset, mismatch_offset - match_offset,
|
2018-10-17 21:59:38 +02:00
|
|
|
PROT_READ, MAP_PRIVATE|MAP_FIXED, fd, *file_offset + match_offset);
|
2014-02-27 14:18:00 +01:00
|
|
|
if (map == MAP_FAILED) {
|
|
|
|
munmap(temp_mapping, file_size);
|
|
|
|
return -1;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
match_offset = mismatch_offset;
|
|
|
|
}
|
|
|
|
|
|
|
|
// Add to the base file offset in case there are multiple relro segments.
|
2018-10-17 21:59:38 +02:00
|
|
|
*file_offset += size;
|
2014-02-27 14:18:00 +01:00
|
|
|
}
|
|
|
|
munmap(temp_mapping, file_size);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
|
2013-10-26 02:38:02 +02:00
|
|
|
#if defined(__arm__)
|
2012-06-19 11:21:29 +02:00
|
|
|
|
|
|
|
# ifndef PT_ARM_EXIDX
|
|
|
|
# define PT_ARM_EXIDX 0x70000001 /* .ARM.exidx segment */
|
|
|
|
# endif
|
|
|
|
|
|
|
|
/* Return the address and size of the .ARM.exidx section in memory,
|
|
|
|
* if present.
|
|
|
|
*
|
|
|
|
* Input:
|
|
|
|
* phdr_table -> program header table
|
2012-08-16 01:56:00 +02:00
|
|
|
* phdr_count -> number of entries in tables
|
2012-06-19 11:21:29 +02:00
|
|
|
* load_bias -> load bias
|
|
|
|
* Output:
|
2014-08-29 21:02:36 +02:00
|
|
|
* arm_exidx -> address of table in memory (null on failure).
|
2012-06-19 11:21:29 +02:00
|
|
|
* arm_exidx_count -> number of items in table (0 on failure).
|
|
|
|
* Return:
|
2023-10-20 15:32:33 +02:00
|
|
|
* 0 on success, -1 on failure (_no_ error code in errno)
|
2012-06-19 11:21:29 +02:00
|
|
|
*/
|
2014-02-11 02:46:57 +01:00
|
|
|
int phdr_table_get_arm_exidx(const ElfW(Phdr)* phdr_table, size_t phdr_count,
|
|
|
|
ElfW(Addr) load_bias,
|
2015-01-23 01:04:25 +01:00
|
|
|
ElfW(Addr)** arm_exidx, size_t* arm_exidx_count) {
|
2014-02-11 02:46:57 +01:00
|
|
|
const ElfW(Phdr)* phdr = phdr_table;
|
|
|
|
const ElfW(Phdr)* phdr_limit = phdr + phdr_count;
|
|
|
|
|
|
|
|
for (phdr = phdr_table; phdr < phdr_limit; phdr++) {
|
|
|
|
if (phdr->p_type != PT_ARM_EXIDX) {
|
|
|
|
continue;
|
2012-06-19 11:21:29 +02:00
|
|
|
}
|
2014-02-11 02:46:57 +01:00
|
|
|
|
|
|
|
*arm_exidx = reinterpret_cast<ElfW(Addr)*>(load_bias + phdr->p_vaddr);
|
2015-01-23 01:04:25 +01:00
|
|
|
*arm_exidx_count = phdr->p_memsz / 8;
|
2014-02-11 02:46:57 +01:00
|
|
|
return 0;
|
|
|
|
}
|
2014-08-29 21:02:36 +02:00
|
|
|
*arm_exidx = nullptr;
|
2014-02-11 02:46:57 +01:00
|
|
|
*arm_exidx_count = 0;
|
|
|
|
return -1;
|
2012-06-19 11:21:29 +02:00
|
|
|
}
|
2013-10-26 02:38:02 +02:00
|
|
|
#endif
|
2012-06-19 11:21:29 +02:00
|
|
|
|
linker: avoid clobbering the .dynamic section of shared libs
This patch removes the DT_NEEDED hack which stores pointers
to soinfo structs in the .dynamic section of the library
being loaded.
Instead, it caches the soinfo struct pointers on the stack
during relocation time. After relocation time, i.e. when
calling constructors and destructors of the shared library
and its dependencies, uncached access is used instead,
doing lookups using the string table entries pointed to by
the DT_NEEDED entries.
By removing this hack, it is no longer needed to undo the
PT_GNURELRO protection, i.e., all non-writable mappings
can remain non-writable during their entire lifespan.
Even though, strictly speaking, the algorithmic complexity
has increased somewhat, the real-world adverse effect
is negligible on the systems I have tested.
Change-Id: I2361502560b96b5878f7f94a8e8a215350d70d64
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@gmail.com>
2012-08-14 12:30:09 +02:00
|
|
|
/* Return the address and size of the ELF file's .dynamic section in memory,
|
2014-08-29 21:02:36 +02:00
|
|
|
* or null if missing.
|
2012-06-19 11:21:29 +02:00
|
|
|
*
|
|
|
|
* Input:
|
|
|
|
* phdr_table -> program header table
|
2012-08-16 01:56:00 +02:00
|
|
|
* phdr_count -> number of entries in tables
|
2012-06-19 11:21:29 +02:00
|
|
|
* load_bias -> load bias
|
linker: avoid clobbering the .dynamic section of shared libs
This patch removes the DT_NEEDED hack which stores pointers
to soinfo structs in the .dynamic section of the library
being loaded.
Instead, it caches the soinfo struct pointers on the stack
during relocation time. After relocation time, i.e. when
calling constructors and destructors of the shared library
and its dependencies, uncached access is used instead,
doing lookups using the string table entries pointed to by
the DT_NEEDED entries.
By removing this hack, it is no longer needed to undo the
PT_GNURELRO protection, i.e., all non-writable mappings
can remain non-writable during their entire lifespan.
Even though, strictly speaking, the algorithmic complexity
has increased somewhat, the real-world adverse effect
is negligible on the systems I have tested.
Change-Id: I2361502560b96b5878f7f94a8e8a215350d70d64
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@gmail.com>
2012-08-14 12:30:09 +02:00
|
|
|
* Output:
|
2014-08-29 21:02:36 +02:00
|
|
|
* dynamic -> address of table in memory (null on failure).
|
2014-09-16 09:22:10 +02:00
|
|
|
* dynamic_flags -> protection flags for section (unset on failure)
|
2012-06-19 11:21:29 +02:00
|
|
|
* Return:
|
linker: avoid clobbering the .dynamic section of shared libs
This patch removes the DT_NEEDED hack which stores pointers
to soinfo structs in the .dynamic section of the library
being loaded.
Instead, it caches the soinfo struct pointers on the stack
during relocation time. After relocation time, i.e. when
calling constructors and destructors of the shared library
and its dependencies, uncached access is used instead,
doing lookups using the string table entries pointed to by
the DT_NEEDED entries.
By removing this hack, it is no longer needed to undo the
PT_GNURELRO protection, i.e., all non-writable mappings
can remain non-writable during their entire lifespan.
Even though, strictly speaking, the algorithmic complexity
has increased somewhat, the real-world adverse effect
is negligible on the systems I have tested.
Change-Id: I2361502560b96b5878f7f94a8e8a215350d70d64
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@gmail.com>
2012-08-14 12:30:09 +02:00
|
|
|
* void
|
2012-06-19 11:21:29 +02:00
|
|
|
*/
|
2014-02-11 02:46:57 +01:00
|
|
|
void phdr_table_get_dynamic_section(const ElfW(Phdr)* phdr_table, size_t phdr_count,
|
2014-09-16 09:22:10 +02:00
|
|
|
ElfW(Addr) load_bias, ElfW(Dyn)** dynamic,
|
|
|
|
ElfW(Word)* dynamic_flags) {
|
2014-09-05 23:57:59 +02:00
|
|
|
*dynamic = nullptr;
|
2015-03-31 03:43:38 +02:00
|
|
|
for (size_t i = 0; i<phdr_count; ++i) {
|
|
|
|
const ElfW(Phdr)& phdr = phdr_table[i];
|
|
|
|
if (phdr.p_type == PT_DYNAMIC) {
|
|
|
|
*dynamic = reinterpret_cast<ElfW(Dyn)*>(load_bias + phdr.p_vaddr);
|
2014-09-16 09:22:10 +02:00
|
|
|
if (dynamic_flags) {
|
2015-03-31 03:43:38 +02:00
|
|
|
*dynamic_flags = phdr.p_flags;
|
2014-09-16 09:22:10 +02:00
|
|
|
}
|
2014-09-06 01:42:53 +02:00
|
|
|
return;
|
|
|
|
}
|
2014-02-11 02:46:57 +01:00
|
|
|
}
|
2012-06-19 11:21:29 +02:00
|
|
|
}
|
|
|
|
|
2015-07-11 02:54:01 +02:00
|
|
|
/* Return the program interpreter string, or nullptr if missing.
|
|
|
|
*
|
|
|
|
* Input:
|
|
|
|
* phdr_table -> program header table
|
|
|
|
* phdr_count -> number of entries in tables
|
|
|
|
* load_bias -> load bias
|
|
|
|
* Return:
|
|
|
|
* pointer to the program interpreter string.
|
|
|
|
*/
|
2020-02-24 14:15:25 +01:00
|
|
|
const char* phdr_table_get_interpreter_name(const ElfW(Phdr)* phdr_table, size_t phdr_count,
|
2015-07-11 02:54:01 +02:00
|
|
|
ElfW(Addr) load_bias) {
|
|
|
|
for (size_t i = 0; i<phdr_count; ++i) {
|
|
|
|
const ElfW(Phdr)& phdr = phdr_table[i];
|
|
|
|
if (phdr.p_type == PT_INTERP) {
|
|
|
|
return reinterpret_cast<const char*>(load_bias + phdr.p_vaddr);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return nullptr;
|
|
|
|
}
|
|
|
|
|
2014-10-15 23:32:19 +02:00
|
|
|
// Sets loaded_phdr_ to the address of the program header table as it appears
|
|
|
|
// in the loaded segments in memory. This is in contrast with phdr_table_,
|
|
|
|
// which is temporary and will be released before the library is relocated.
|
2013-03-06 03:47:58 +01:00
|
|
|
bool ElfReader::FindPhdr() {
|
2014-02-11 02:46:57 +01:00
|
|
|
const ElfW(Phdr)* phdr_limit = phdr_table_ + phdr_num_;
|
2012-06-19 11:21:29 +02:00
|
|
|
|
2013-03-06 03:47:58 +01:00
|
|
|
// If there is a PT_PHDR, use it directly.
|
2014-02-11 02:46:57 +01:00
|
|
|
for (const ElfW(Phdr)* phdr = phdr_table_; phdr < phdr_limit; ++phdr) {
|
2013-03-06 03:47:58 +01:00
|
|
|
if (phdr->p_type == PT_PHDR) {
|
|
|
|
return CheckPhdr(load_bias_ + phdr->p_vaddr);
|
2012-06-19 11:21:29 +02:00
|
|
|
}
|
2013-03-06 03:47:58 +01:00
|
|
|
}
|
|
|
|
|
|
|
|
// Otherwise, check the first loadable segment. If its file offset
|
|
|
|
// is 0, it starts with the ELF header, and we can trivially find the
|
|
|
|
// loaded program header from it.
|
2014-02-11 02:46:57 +01:00
|
|
|
for (const ElfW(Phdr)* phdr = phdr_table_; phdr < phdr_limit; ++phdr) {
|
2013-03-06 03:47:58 +01:00
|
|
|
if (phdr->p_type == PT_LOAD) {
|
|
|
|
if (phdr->p_offset == 0) {
|
2014-02-11 02:46:57 +01:00
|
|
|
ElfW(Addr) elf_addr = load_bias_ + phdr->p_vaddr;
|
2014-02-12 01:59:37 +01:00
|
|
|
const ElfW(Ehdr)* ehdr = reinterpret_cast<const ElfW(Ehdr)*>(elf_addr);
|
2014-02-11 02:46:57 +01:00
|
|
|
ElfW(Addr) offset = ehdr->e_phoff;
|
2015-01-23 01:04:25 +01:00
|
|
|
return CheckPhdr(reinterpret_cast<ElfW(Addr)>(ehdr) + offset);
|
2013-03-06 03:47:58 +01:00
|
|
|
}
|
|
|
|
break;
|
2012-06-19 11:21:29 +02:00
|
|
|
}
|
2013-03-06 03:47:58 +01:00
|
|
|
}
|
2012-06-19 11:21:29 +02:00
|
|
|
|
2015-10-15 21:07:25 +02:00
|
|
|
DL_ERR("can't find loaded phdr for \"%s\"", name_.c_str());
|
2013-03-06 03:47:58 +01:00
|
|
|
return false;
|
|
|
|
}
|
2012-06-19 11:21:29 +02:00
|
|
|
|
2020-02-24 14:15:25 +01:00
|
|
|
// Tries to find .note.gnu.property section.
|
|
|
|
// It is not considered an error if such section is missing.
|
|
|
|
bool ElfReader::FindGnuPropertySection() {
|
|
|
|
#if defined(__aarch64__)
|
|
|
|
note_gnu_property_ = GnuPropertySection(phdr_table_, phdr_num_, load_start(), name_.c_str());
|
|
|
|
#endif
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
2013-03-06 03:47:58 +01:00
|
|
|
// Ensures that our program header is actually within a loadable
|
|
|
|
// segment. This should help catch badly-formed ELF files that
|
|
|
|
// would cause the linker to crash later when trying to access it.
|
2014-02-11 02:46:57 +01:00
|
|
|
bool ElfReader::CheckPhdr(ElfW(Addr) loaded) {
|
|
|
|
const ElfW(Phdr)* phdr_limit = phdr_table_ + phdr_num_;
|
|
|
|
ElfW(Addr) loaded_end = loaded + (phdr_num_ * sizeof(ElfW(Phdr)));
|
2015-10-20 01:57:46 +02:00
|
|
|
for (const ElfW(Phdr)* phdr = phdr_table_; phdr < phdr_limit; ++phdr) {
|
2013-03-06 03:47:58 +01:00
|
|
|
if (phdr->p_type != PT_LOAD) {
|
|
|
|
continue;
|
|
|
|
}
|
2014-02-11 02:46:57 +01:00
|
|
|
ElfW(Addr) seg_start = phdr->p_vaddr + load_bias_;
|
|
|
|
ElfW(Addr) seg_end = phdr->p_filesz + seg_start;
|
2013-03-06 03:47:58 +01:00
|
|
|
if (seg_start <= loaded && loaded_end <= seg_end) {
|
2014-02-11 02:46:57 +01:00
|
|
|
loaded_phdr_ = reinterpret_cast<const ElfW(Phdr)*>(loaded);
|
2013-03-06 03:47:58 +01:00
|
|
|
return true;
|
2012-06-19 11:21:29 +02:00
|
|
|
}
|
2013-03-06 03:47:58 +01:00
|
|
|
}
|
2015-10-15 21:07:25 +02:00
|
|
|
DL_ERR("\"%s\" loaded phdr %p not in loadable segment",
|
|
|
|
name_.c_str(), reinterpret_cast<void*>(loaded));
|
2013-03-06 03:47:58 +01:00
|
|
|
return false;
|
2012-06-19 11:21:29 +02:00
|
|
|
}
|