2008-10-21 16:00:00 +02:00
|
|
|
/*
|
|
|
|
* Copyright (C) 2007 The Android Open Source Project
|
|
|
|
*
|
|
|
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
|
|
* you may not use this file except in compliance with the License.
|
|
|
|
* You may obtain a copy of the License at
|
|
|
|
*
|
|
|
|
* http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
*
|
|
|
|
* Unless required by applicable law or agreed to in writing, software
|
|
|
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
|
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
|
|
* See the License for the specific language governing permissions and
|
|
|
|
* limitations under the License.
|
|
|
|
*/
|
|
|
|
|
Add the recoverable GWP-ASan feature.
GWP-ASan's recoverable mode was landed upstream in
https://reviews.llvm.org/D140173.
This mode allows for a use-after-free or a buffer-overflow bug to be
detected by GWP-ASan, a crash report dumped, but then GWP-ASan (through
the preCrashReport() and postCrashReportRecoverableOnly() hooks) will
patch up the memory so that the process can continue, in spite of the
memory safety bug.
This is desirable, as it allows us to consider migrating non-system apps
from opt-in GWP-ASan to opt-out GWP-ASan. The major concern was "if we
make it opt-out, then bad apps will start crashing". If we don't crash,
problem solved :). Obviously, we'll need to do this with an amount of
process sampling to mitigate against the 70KiB memory overhead.
The biggest problem is that the debuggerd signal handler isn't the first
signal handler for apps, it's the sigchain handler inside of libart.
Clearly, the sigchain handler needs to ask us whether the crash is
GWP-ASan's fault, and if so, please patch up the allocator. Because of
linker namespace restrictions, libart can't directly ask the linker
(which is where debuggerd lies), so we provide a proxy function in libc.
Test: Build the platform, run sanitizer-status and various test apps
with recoverable gwp-asan. Assert that it doesn't crash, and we get a
debuggerd report.
Bug: 247012630
Change-Id: I86d5e27a9ca5531c8942e62647fd377c3cd36dfd
2023-01-19 21:47:22 +01:00
|
|
|
#include <android/dlext.h>
|
2009-12-31 19:17:40 +01:00
|
|
|
#include <dlfcn.h>
|
2014-01-15 02:25:13 +01:00
|
|
|
#include <link.h>
|
Add the recoverable GWP-ASan feature.
GWP-ASan's recoverable mode was landed upstream in
https://reviews.llvm.org/D140173.
This mode allows for a use-after-free or a buffer-overflow bug to be
detected by GWP-ASan, a crash report dumped, but then GWP-ASan (through
the preCrashReport() and postCrashReportRecoverableOnly() hooks) will
patch up the memory so that the process can continue, in spite of the
memory safety bug.
This is desirable, as it allows us to consider migrating non-system apps
from opt-in GWP-ASan to opt-out GWP-ASan. The major concern was "if we
make it opt-out, then bad apps will start crashing". If we don't crash,
problem solved :). Obviously, we'll need to do this with an amount of
process sampling to mitigate against the 70KiB memory overhead.
The biggest problem is that the debuggerd signal handler isn't the first
signal handler for apps, it's the sigchain handler inside of libart.
Clearly, the sigchain handler needs to ask us whether the crash is
GWP-ASan's fault, and if so, please patch up the allocator. Because of
linker namespace restrictions, libart can't directly ask the linker
(which is where debuggerd lies), so we provide a proxy function in libc.
Test: Build the platform, run sanitizer-status and various test apps
with recoverable gwp-asan. Assert that it doesn't crash, and we get a
debuggerd report.
Bug: 247012630
Change-Id: I86d5e27a9ca5531c8942e62647fd377c3cd36dfd
2023-01-19 21:47:22 +01:00
|
|
|
#include <signal.h>
|
2014-01-14 01:37:47 +01:00
|
|
|
#include <stdlib.h>
|
|
|
|
|
2016-11-23 01:55:25 +01:00
|
|
|
// These functions are exported by the loader
|
|
|
|
// TODO(dimitry): replace these with reference to libc.so
|
2012-12-20 23:42:14 +01:00
|
|
|
|
2017-10-13 20:56:55 +02:00
|
|
|
extern "C" {
|
|
|
|
|
2019-03-29 05:34:33 +01:00
|
|
|
__attribute__((__weak__, visibility("default")))
|
|
|
|
void __loader_android_get_LD_LIBRARY_PATH(char* buffer, size_t buffer_size);
|
|
|
|
|
2016-11-23 01:55:25 +01:00
|
|
|
__attribute__((__weak__, visibility("default")))
|
|
|
|
void* __loader_dlopen(const char* filename, int flags, const void* caller_addr);
|
2015-12-11 23:22:24 +01:00
|
|
|
|
2016-11-23 01:55:25 +01:00
|
|
|
__attribute__((__weak__, visibility("default")))
|
2017-10-13 20:56:55 +02:00
|
|
|
char* __loader_dlerror();
|
2015-12-11 23:22:24 +01:00
|
|
|
|
2016-11-23 01:55:25 +01:00
|
|
|
__attribute__((__weak__, visibility("default")))
|
|
|
|
void* __loader_dlsym(void* handle, const char* symbol, const void* caller_addr);
|
2015-12-11 23:22:24 +01:00
|
|
|
|
2016-11-23 01:55:25 +01:00
|
|
|
__attribute__((__weak__, visibility("default")))
|
|
|
|
void* __loader_dlvsym(void* handle,
|
|
|
|
const char* symbol,
|
|
|
|
const char* version,
|
|
|
|
const void* caller_addr);
|
|
|
|
|
|
|
|
__attribute__((__weak__, visibility("default")))
|
|
|
|
int __loader_dladdr(const void* addr, Dl_info* info);
|
|
|
|
|
|
|
|
__attribute__((__weak__, visibility("default")))
|
|
|
|
int __loader_dlclose(void* handle);
|
|
|
|
|
|
|
|
#if defined(__arm__)
|
|
|
|
__attribute__((__weak__, visibility("default")))
|
|
|
|
_Unwind_Ptr __loader_dl_unwind_find_exidx(_Unwind_Ptr pc, int* pcount);
|
|
|
|
#endif
|
|
|
|
|
|
|
|
__attribute__((__weak__, visibility("default")))
|
|
|
|
int __loader_dl_iterate_phdr(int (*cb)(struct dl_phdr_info* info, size_t size, void* data),
|
|
|
|
void* data);
|
|
|
|
|
|
|
|
__attribute__((__weak__, visibility("default")))
|
|
|
|
void __loader_android_get_LD_LIBRARY_PATH(char* buffer, size_t buffer_size);
|
|
|
|
|
|
|
|
__attribute__((__weak__, visibility("default")))
|
|
|
|
void __loader_android_update_LD_LIBRARY_PATH(const char* ld_library_path);
|
|
|
|
|
|
|
|
__attribute__((__weak__, visibility("default")))
|
|
|
|
void* __loader_android_dlopen_ext(const char* filename,
|
|
|
|
int flag,
|
|
|
|
const android_dlextinfo* extinfo,
|
|
|
|
const void* caller_addr);
|
|
|
|
|
|
|
|
__attribute__((__weak__, visibility("default")))
|
2018-11-13 01:01:37 +01:00
|
|
|
int __loader_android_get_application_target_sdk_version();
|
2016-11-23 01:55:25 +01:00
|
|
|
|
Add the recoverable GWP-ASan feature.
GWP-ASan's recoverable mode was landed upstream in
https://reviews.llvm.org/D140173.
This mode allows for a use-after-free or a buffer-overflow bug to be
detected by GWP-ASan, a crash report dumped, but then GWP-ASan (through
the preCrashReport() and postCrashReportRecoverableOnly() hooks) will
patch up the memory so that the process can continue, in spite of the
memory safety bug.
This is desirable, as it allows us to consider migrating non-system apps
from opt-in GWP-ASan to opt-out GWP-ASan. The major concern was "if we
make it opt-out, then bad apps will start crashing". If we don't crash,
problem solved :). Obviously, we'll need to do this with an amount of
process sampling to mitigate against the 70KiB memory overhead.
The biggest problem is that the debuggerd signal handler isn't the first
signal handler for apps, it's the sigchain handler inside of libart.
Clearly, the sigchain handler needs to ask us whether the crash is
GWP-ASan's fault, and if so, please patch up the allocator. Because of
linker namespace restrictions, libart can't directly ask the linker
(which is where debuggerd lies), so we provide a proxy function in libc.
Test: Build the platform, run sanitizer-status and various test apps
with recoverable gwp-asan. Assert that it doesn't crash, and we get a
debuggerd report.
Bug: 247012630
Change-Id: I86d5e27a9ca5531c8942e62647fd377c3cd36dfd
2023-01-19 21:47:22 +01:00
|
|
|
__attribute__((__weak__, visibility("default"))) bool __loader_android_handle_signal(
|
|
|
|
int signal_number, siginfo_t* info, void* context);
|
|
|
|
|
2016-11-23 01:55:25 +01:00
|
|
|
// Proxy calls to bionic loader
|
2019-03-29 05:34:33 +01:00
|
|
|
__attribute__((__weak__))
|
|
|
|
void android_get_LD_LIBRARY_PATH(char* buffer, size_t buffer_size) {
|
|
|
|
__loader_android_get_LD_LIBRARY_PATH(buffer, buffer_size);
|
|
|
|
}
|
|
|
|
|
2017-10-05 17:23:10 +02:00
|
|
|
__attribute__((__weak__))
|
2016-11-23 01:55:25 +01:00
|
|
|
void* dlopen(const char* filename, int flag) {
|
|
|
|
const void* caller_addr = __builtin_return_address(0);
|
|
|
|
return __loader_dlopen(filename, flag, caller_addr);
|
|
|
|
}
|
|
|
|
|
2017-10-05 17:23:10 +02:00
|
|
|
__attribute__((__weak__))
|
2016-11-23 01:55:25 +01:00
|
|
|
char* dlerror() {
|
|
|
|
return __loader_dlerror();
|
|
|
|
}
|
|
|
|
|
2017-10-05 17:23:10 +02:00
|
|
|
__attribute__((__weak__))
|
2016-11-23 01:55:25 +01:00
|
|
|
void* dlsym(void* handle, const char* symbol) {
|
|
|
|
const void* caller_addr = __builtin_return_address(0);
|
|
|
|
return __loader_dlsym(handle, symbol, caller_addr);
|
2015-12-11 23:22:24 +01:00
|
|
|
}
|
|
|
|
|
2017-10-05 17:23:10 +02:00
|
|
|
__attribute__((__weak__))
|
2016-11-23 01:55:25 +01:00
|
|
|
void* dlvsym(void* handle, const char* symbol, const char* version) {
|
|
|
|
const void* caller_addr = __builtin_return_address(0);
|
|
|
|
return __loader_dlvsym(handle, symbol, version, caller_addr);
|
|
|
|
}
|
2015-12-11 23:22:24 +01:00
|
|
|
|
2017-10-05 17:23:10 +02:00
|
|
|
__attribute__((__weak__))
|
2016-11-23 01:55:25 +01:00
|
|
|
int dladdr(const void* addr, Dl_info* info) {
|
|
|
|
return __loader_dladdr(addr, info);
|
|
|
|
}
|
|
|
|
|
2017-10-05 17:23:10 +02:00
|
|
|
__attribute__((__weak__))
|
2016-11-23 01:55:25 +01:00
|
|
|
int dlclose(void* handle) {
|
|
|
|
return __loader_dlclose(handle);
|
|
|
|
}
|
2012-10-12 19:50:21 +02:00
|
|
|
|
2014-01-15 02:25:13 +01:00
|
|
|
#if defined(__arm__)
|
2017-10-05 17:23:10 +02:00
|
|
|
__attribute__((__weak__))
|
2016-11-23 01:55:25 +01:00
|
|
|
_Unwind_Ptr dl_unwind_find_exidx(_Unwind_Ptr pc, int* pcount) {
|
|
|
|
return __loader_dl_unwind_find_exidx(pc, pcount);
|
|
|
|
}
|
2013-08-20 02:45:09 +02:00
|
|
|
#endif
|
2012-10-12 19:50:21 +02:00
|
|
|
|
2017-04-26 00:42:42 +02:00
|
|
|
/*
|
|
|
|
* This needs to be defined as weak because it is also defined in libc.a.
|
|
|
|
* Without this, static executables will have a multiple definition error.
|
|
|
|
*/
|
|
|
|
__attribute__((__weak__))
|
2016-11-23 01:55:25 +01:00
|
|
|
int dl_iterate_phdr(int (*cb)(struct dl_phdr_info* info, size_t size, void* data), void* data) {
|
|
|
|
return __loader_dl_iterate_phdr(cb, data);
|
2015-10-30 01:01:24 +01:00
|
|
|
}
|
2014-02-06 15:34:21 +01:00
|
|
|
|
2017-10-05 17:23:10 +02:00
|
|
|
__attribute__((__weak__))
|
2016-11-23 01:55:25 +01:00
|
|
|
void* android_dlopen_ext(const char* filename, int flag, const android_dlextinfo* extinfo) {
|
|
|
|
const void* caller_addr = __builtin_return_address(0);
|
|
|
|
return __loader_android_dlopen_ext(filename, flag, extinfo, caller_addr);
|
2015-10-30 01:01:24 +01:00
|
|
|
}
|
2015-05-22 02:43:49 +02:00
|
|
|
|
2017-10-05 17:23:10 +02:00
|
|
|
__attribute__((__weak__))
|
2018-11-13 01:01:37 +01:00
|
|
|
int android_get_application_target_sdk_version() {
|
2016-11-23 01:55:25 +01:00
|
|
|
return __loader_android_get_application_target_sdk_version();
|
|
|
|
}
|
2015-10-30 01:01:24 +01:00
|
|
|
|
Add the recoverable GWP-ASan feature.
GWP-ASan's recoverable mode was landed upstream in
https://reviews.llvm.org/D140173.
This mode allows for a use-after-free or a buffer-overflow bug to be
detected by GWP-ASan, a crash report dumped, but then GWP-ASan (through
the preCrashReport() and postCrashReportRecoverableOnly() hooks) will
patch up the memory so that the process can continue, in spite of the
memory safety bug.
This is desirable, as it allows us to consider migrating non-system apps
from opt-in GWP-ASan to opt-out GWP-ASan. The major concern was "if we
make it opt-out, then bad apps will start crashing". If we don't crash,
problem solved :). Obviously, we'll need to do this with an amount of
process sampling to mitigate against the 70KiB memory overhead.
The biggest problem is that the debuggerd signal handler isn't the first
signal handler for apps, it's the sigchain handler inside of libart.
Clearly, the sigchain handler needs to ask us whether the crash is
GWP-ASan's fault, and if so, please patch up the allocator. Because of
linker namespace restrictions, libart can't directly ask the linker
(which is where debuggerd lies), so we provide a proxy function in libc.
Test: Build the platform, run sanitizer-status and various test apps
with recoverable gwp-asan. Assert that it doesn't crash, and we get a
debuggerd report.
Bug: 247012630
Change-Id: I86d5e27a9ca5531c8942e62647fd377c3cd36dfd
2023-01-19 21:47:22 +01:00
|
|
|
// Returns true if this function handled the signal, false if the caller should handle the signal
|
|
|
|
// itself. This function returns true if the sigchain handler should immediately return, which
|
|
|
|
// happens when the signal came from GWP-ASan, and we've dumped a debuggerd report and patched up
|
|
|
|
// the GWP-ASan allocator to recover from the fault, and regular execution of the program can
|
|
|
|
// continue.
|
|
|
|
__attribute__((__weak__)) bool android_handle_signal(int signal_number, siginfo_t* info,
|
|
|
|
void* context) {
|
|
|
|
return __loader_android_handle_signal(signal_number, info, context);
|
|
|
|
}
|
|
|
|
|
2017-10-13 20:56:55 +02:00
|
|
|
} // extern "C"
|