Commit graph

819 commits

Author SHA1 Message Date
Evgenii Stepanov
082bec5b41 Merge "Runtime support for CFI" 2017-01-18 23:39:08 +00:00
Evgenii Stepanov
0a3637d3eb Runtime support for CFI
Control Flow Integrity support in bionic.

General design:
http://clang.llvm.org/docs/ControlFlowIntegrityDesign.html#shared-library-support

This CL implements subsections "CFI Shadow" and "CFI_SlowPath" in the above document.

Bug: 22033465
Test: bionic device tests
Change-Id: I14dfea630de468eb5620e7f55f92b1397ba06217
2017-01-18 13:13:52 -08:00
Josh Gao
2a3b4fa6ec Rename libdebuggerd_client to libdebuggerd_handler.
Bug: http://b/30705528
Test: debuggerd_test
Change-Id: I625a9a2e7304d172873ba9344b74efa57ad7bdad
2017-01-17 15:11:46 -08:00
Park Ju Hyung
ab2c5752c3 linker: convert 'mov pc' instruction to 'bx'
From Linux 3.17 6ebbf2ce437b33022d30badd49dc94d33ecfa498:

    ARMv6 and greater introduced a new instruction ("bx") which can be used
    to return from function calls.  Recent CPUs perform better when the
    "bx lr" instruction is used rather than the "mov pc, lr" instruction,
    and this sequence is strongly recommended to be used by the ARM
    architecture manual (section A.4.1.1).

Signed-off-by: Park Ju Hyung <qkrwngud825@gmail.com>

Test: No regressions detected
Test: Passes full CTS run

Change-Id: Ie268f9893e3df0f68fbfe82a13f3c7cc5c5909d8
Signed-off-by: Alex Naidis <alex.naidis@linux.com>
2017-01-14 14:40:07 +00:00
Elliott Hughes
607d307b1f Dynamic linker errors should go to stderr.
Also add the missing \n to the end of the error.

Addresses review comment.

Bug: N/A
Test: manual
Change-Id: I7c997a71e6e02381d21ac762595ba90370db9d05
2017-01-09 14:44:28 -08:00
Elliott Hughes
3bdb31b51b Exit rather than abort if asked to run a non-PIE executable.
Each release we're asked to investigate tombstones from code that hasn't
been allowed to run on Android since L. This is just wasting our time,
and clearly the "obviousness" of aborting rather than exiting hasn't ensured
that all app developers rebuild their old binaries. In some cases it seems
like they run them "just in case" and don't care if they fail.

Bug: http://b/34112178
Test: ran libsupervisor.so from com.ss.android.article.news
Change-Id: I8a3f196c4755601a3888281566fbb7b817f01dca
2017-01-07 10:38:20 -08:00
Dimitry Ivanov
e30c17fb6e Downgrade dynamic section checks to warning
For apps targeting pre-O releases print warn about
invalid dynamic section.

Bug: http://b/33842263
Test: Start an app in question and check logs for warning.
Test: Run bionic-unit-test --gtest_filter=dl*:Dl*
Change-Id: I80bd51f2133b956fc04e20a6538cccd50118c1b8
2016-12-28 16:21:49 -08:00
Dimitry Ivanov
cf00d86935 Add a way to track all dlsym calls (contd.)
The followup for 4742abdcb5

Changes in this file got lost in the process of cherry-picking
the change across repositories.

Bug: http://b/29458203
Test: flash, set debug.ld.all to dlsym and check
      if there are messages in logcat

Change-Id: I4613908e46e75c5d9ec66396767f10fc6d3e9777
2016-12-14 14:30:37 -08:00
Dimitry Ivanov
4742abdcb5 Add a way to track all dlsym calls
Add dlsym option to debug.ld.all and debug.ld.app.<appname> which
enables logging of dlsym calls.

Bug: http://b/29458203
Test: flash, set debug.ld.all to dlsym and check
      if there are messages in logcat

Change-Id: I9cb815a38b5b98aac9ebe3ac1540bcdedd2e8db0
2016-12-12 16:36:12 -08:00
Dimitry Ivanov
a6588e5d6f Fix android_dlwarning lookup
Bug: http://b/33530622
Test: mm
Change-Id: I3eefca58e91b7bbc41f6add9b8c756f1474a7f93
2016-12-12 13:12:59 -08:00
Dimitry Ivanov
d9e427cf41 Bionic loader is no longer hijacking libdl.so
Do not hijack libdl.so methods but make libdl proxy calls to
loader instead. This will be replaces by calls to libc.so
once loader functionality is migrated.

Also add a lock to dl_unwind_find_exidx function call.

Test: bionic-unit-tests --gtest_filter=dl*:Dl*
Bug: http://b/27106625
Change-Id: Ic33a7109a86f4262798d63a35f4c61d15b0068bb
2016-12-09 14:53:59 -08:00
Colin Cross
10fffb4939 Fix linker_asan64 symlink
Soong now appends the suffix to the symlink, so the multilib-specific
symlink is no longer necessary.

Test: m -j out/target/product/angler/system/bin/linker_asan64
Test: Examine LOCAL_MODULE_SYMLINKS in out/soong/Android-aosp_angler.mk
Change-Id: I913a318bb31de3e630eebd2d68041a55ce3eccaf
2016-12-08 09:57:35 -08:00
Dimitry Ivanov
fc0d48078a loader: stop linking libdl/c/m into the loader
This is to prevent situations when libgcc.a calls into incorrect
implementation of dl_iterate_phdr.

Bug: http://b/27106625
Test: build && run bionic-unit-tests --getst_filter=dl*:Dl*
Change-Id: I4cba8c4a156f91f17ba3d95c39cb80f9b70c9d8f
2016-12-06 11:15:24 -08:00
Dimitry Ivanov
6c14f86309 loader: asan path translation now works for symlinks
Bionic Loader now resolves real path for a library before running
asan path-translation. This fixes situations for bundled loading
libraries which are effectively symlinks to system library;
for example:

 $ adb shell ls -l /system/app/NfcNci/lib/arm64/libnfc_nci_jni.so
 /system/app/NfcNci/lib/arm64/libnfc_nci_jni.so -> /system/lib64/libnfc_nci_jni.so

Bug: http://b/33278445
Test: make and boot
Change-Id: If14a12087c92f8ca628504556332ba0cb67c9118
2016-12-05 13:46:24 -08:00
Dan Willemsen
7ec52b12ef Enable libc/libdl/libm/linker for host bionic
Disables debuggerd integration unless building for android.

Bug: 31559095
Test: Diff out/soong/build.ninja before/after, only change is moving
      linker's libdebuggerd_client static lib to the beginning of the
      list.
Test: lunch aosp_arm64-eng; mmma -j bionic
Change-Id: I62e725f7a9b98b7fe31637d0a835fd5846b0aff0
2016-11-29 21:09:05 +00:00
Dimitry Ivanov
ae4a0c186f Log call to elf-constructors
Log call to constructors when dlopen logging is enabled.

Bug: http://b/29458203
Test: bionic-unit-tests --gtest_filter=dl*:Dl*
Change-Id: I0cd591bf147f8f910ae9def1ac4089ef44099aff
2016-11-21 12:32:08 -08:00
Dimitry Ivanov
3613c20c59 Merge "Relax ELF header checks - warn for apps targeting pre-O" 2016-11-17 05:21:42 +00:00
Treehugger Robot
585838ba32 Merge "Remove unused includes/externals" 2016-11-17 02:48:41 +00:00
Dimitry Ivanov
12b918743d Relax ELF header checks - warn for apps targeting pre-O
Bug: http://b/32581440
Test: bionic-unit-tests --gtest_filter=dl*:Dl*
Change-Id: I2fe356c67eb9665c671758117679a29b207219e4
2016-11-16 18:43:06 -08:00
Elliott Hughes
5bc78c8bcd Add and use constants for the Android API levels.
Test: bionic tests still pass
Change-Id: If1b619cfc9db1d3f5d91f14f2ace71058dca0c4a
2016-11-16 16:55:42 -08:00
Dimitry Ivanov
ffa45a8682 Remove unused includes/externals
Test: mm
Change-Id: I4b88602b7d0a18664cbeddfa9854e589c2886e1a
2016-11-16 15:23:37 -08:00
Elliott Hughes
4cc5a60f91 Downgrade W+E load segments to a warning unless targeting O.
I don't think we're getting any value from more dupes of the same dodgy
middleware, and I worry that we're hiding other, more subtle, compatibility
issues behind this one.

Test: bionic tests
Change-Id: I556cf36eac96c90976bae32621d1c133bbb8fcc7
2016-11-15 16:59:33 -08:00
Dimitry Ivanov
e6ee960aef Replace .align with .balign for clarity
Test: run bionic-unit-tests
Change-Id: Icb43cc47e41d58fe3cb71986e05b3134022f895c
2016-10-27 05:11:56 -07:00
Treehugger Robot
bd839d100d Merge changes from topic 'ndk-headers-licenses'
* changes:
  Add license to ndk_headers modules.
  One NOTICE file to rule them all.
2016-10-20 22:12:40 +00:00
Dan Albert
c30862fdbc One NOTICE file to rule them all.
Generate a single NOTICE file rather than one per library. All the
headers come from libc these days anyway.

Test: tools/update_notice.sh
Bug: None
Change-Id: I127da185fdabc2815042e19aea74c507ec108f46
2016-10-20 11:48:55 -07:00
Dimitry Ivanov
816676e70d Add test for libraries with textrels
Make sure android fails to load them.

Bug: http://b/30795430
Test: bionic-unit-tests --gtest_filter=dlfcn.dlopen_invalid*
Test: cts-tradefed run singleCommand cts --skip-preconditions -m CtsBionicTestCases
Change-Id: Id0ebdf336b2f297007479ceb1bbccf778a7ca3f2
2016-10-19 14:21:42 -07:00
neo.chae
2589f9de64 Fix for default library path "/vendor/lib"
Android N restrict which libraries C/C++ code
can link against at runtime.

If device has a vendor partition
then /system/vendor symlink to /vendor.
Otherwise /vendor symlink to /system/vendor.

But is_system_library() is only checking /vendor/lib.
It will return false for /system/vendor/lib path.
It is need to add a real path to default library path.

Similarily, default ld library path is already checking.
parse_LD_LIBRARY_PATH()->parse_path()->resolve_paths()

Test: build bionic and run bionic-unit-tests
Bug: http://b/31919547
Change-Id: Ie6777e2b02729948ce77a94de32343d40358bf2c
Signed-off-by: Hyangseok Chae <neo.chae@lge.com>
2016-10-05 03:15:49 -07:00
Dimitry Ivanov
3f66057544 linker: Refactoring step 3 of many
Extract linker executable specific code to linker_main.cpp;
this part of code does not have a place in libdl.a/so.

Bug: http://b/14998480
Bug: http://b/30706810
Test: mm && run bionic-unit-tests
Change-Id: I90f7475e93a919b0f9525da22928089ad35b8f6c
2016-09-13 13:38:58 -07:00
Dimitry Ivanov
01fdb6ad57 Silently ignore empty path elements
resolve_paths function used to print a warning if an input path
was empty. This commit fixes this by explicitly skipping
empty paths during path resolution.

Test: Run adb shell LD_LIBRARY_PATH=: /system/bin/ping
Test: make sure there are no warnings
Bug: http://b/31346121
Change-Id: Ifd79040943dc62fc6e07d9828ff91d1050572809
2016-09-07 14:48:27 -07:00
Dimitry Ivanov
f4e3ebe1e3 linker: stat /proc/self/exe instead of executable_path
The absolute path to an executable may no longer be valid for
example when the file is unlinked immediately after exec.
Using /proc/self/exe instead of absolute path solves this problem.

Bug: http://b/31084669
Test: Run the app from http://b/31084669 make sure executable starts
Test: by checking ps and /proc/<pid>/exe
Change-Id: I5c819f39ef0fc4fc71b05de71e8af9ede611f04c
(cherry picked from commit 7da4bbbe87)
2016-08-25 19:41:23 -07:00
Bernhard Rosenkränzer
59ba65e086 Don't warn about DT_FLAGS_1 containing DF_1_PIE
DF_1_PIE is set in PIE code built with gcc 6.x. The flag is purely
informational and the linker doesn't need to do anything about it,
so Bionic handles it correctly - no need to warn.

Change-Id: If99c1742fe22f8842a84818909ed961716ef5ca5
Signed-off-by: Bernhard Rosenkränzer <Bernhard.Rosenkranzer@linaro.org>
2016-08-19 21:57:12 +02:00
Dimitry Ivanov
e8087022c1 Merge "linker: disallow W + E PT_LOAD segments" 2016-08-12 17:55:36 +00:00
Dimitry Ivanov
9700babc05 linker: disallow W + E PT_LOAD segments
No mapped segment from the elf file can be writable and
executable at the same time. This commit adds a check
for malformed PT_LOAD segments in the elf-files.

Bug: http://b/30146890
Test: run bionic-unit-tests --gtest_filter=dlfcn.*
Change-Id: Ia23acbe5a48780b65d7e4a50bbe024cd528079f4
2016-08-11 17:24:47 -07:00
Treehugger Robot
166f875eab Merge "dlerror returns char*, not const char*." 2016-08-11 23:16:59 +00:00
Elliott Hughes
5e071a18ce dlerror returns char*, not const char*.
http://pubs.opengroup.org/onlinepubs/9699919799/functions/dlerror.html:

    char *dlerror(void);
    ...
    The application shall not modify the string returned.

Change-Id: I5e684bfd3930c39a2a30ea6fd005a5d5d3e5b181
2016-08-11 15:02:45 -07:00
Dimitry Ivanov
4cf7024db7 linker: use stat(2) to check file existence
open(2) can be used to open directories; use stat to
check that the file exists and is a regular file.

Addresses review comments for 5aa67675f8

Bug: http://b/30320104
Change-Id: Ia944db2f2f779a87ea01dd41dcd171e59c9bef01
2016-08-11 11:11:52 -07:00
Dimitry Ivanov
45d25ca728 linker_asan: Translate absolute dlopen paths to use asan-libraries.
This patch enables absolute path translation to instrumented library
when linker_asan is in use.

Test: adb shell cat /proc/<rlid pid>/maps | grep libril-qc-qmi-1.so
      check that it is mapped from /data/vendor/lib64 and not /vendor/lib64
Bug: http://b/30320104
Change-Id: I3bc24754b192afc0a72d6f3801f7b42141ce715b
(cherry picked from commit 5aa67675f8)
2016-08-10 21:37:50 -07:00
Dimitry Ivanov
bd90675111 Check alignment along with range of mapped file fragments
Improve sanity-checks of elf-file by adding alignment check
of mapped sections and section headers.

Bug: http://b/30687964
Change-Id: I7f06ddaa56a13989ce7be847b3a73c352e32c008
(cherry picked from commit 7e2d49ae3e)
2016-08-10 10:52:55 -07:00
Dimitry Ivanov
576a375bc2 linker: fix mips build
Change-Id: I88c5ba7f33825ae9b36992b32d30579ec4a66915
Test: lunch aosp_mips-eng && mm
2016-08-09 06:58:55 -07:00
Treehugger Robot
8336b64442 Merge changes I868417f4,I57ac3667
* changes:
  Extract soinfo and globals to separate files.
  Move android_namespace_t to a separate file.
2016-08-09 00:31:46 +00:00
Dimitry Ivanov
48ec288d40 Extract soinfo and globals to separate files.
Move soinfo and globals out of linker.cpp to
separate files.

Breaking up huge linker.cpp into smaller peaces
in order to make it easier to extract part of the
code that belongs to libdl.so and remove parts of
the code that do not belong to linker

(refactoring part 2 of many)

Change-Id: I868417f4b8d2b84d0e8265e354bc7977161497e2
2016-08-08 16:12:53 -07:00
Dimitry Ivanov
b943f303a2 Move android_namespace_t to a separate file.
Breaking up huge linker.cpp into smaller peaces
in order to make it easier to extract part of the
code that belongs to libdl.so and remove parts of
the code that do not belong to linker

(refactoring part 1 of many)

Change-Id: I57ac36677a815800dc127c8c45c3ea806c37e247
Test: bionic-unit-tests --gtest_filter=dl*:Dl*
2016-08-08 16:12:52 -07:00
Elliott Hughes
77a3e28e2e Update NOTICE files.
Change-Id: I591dc91b54804aebc05ba6f9974ef9add660ecfe
2016-08-08 12:39:56 -07:00
Dimitry Ivanov
769b33fadf Sync linker with internal branch
This change includes dlwarning implementation and
the compatibility greylist for apps targeting pre-N.

Change-Id: Ibf02a07cc58cbbb1a5aef4ac34558c5d43e4305f
Test: Run bionic-unit-tests --gtest_filter=dl*:Dl*
2016-08-01 19:47:27 +00:00
Dimitry Ivanov
65707b696a Improvements to initialization of linker_allocator
Make linker_allocator independent of the order of global constructors.

Bug: http://b/30483811
Change-Id: I18a323175661b8e1c9e398f2d6112f7a08d2cceb
Test: boot the device with I3ac91758a1a043146c65f2ae0f36fcfbe372c30f
2016-07-29 14:05:39 -07:00
Dimitry Ivanov
c73eec159f Add sanity checks for e_shentsize and e_shstrndx
This helps us avoid situations when malformed elf-files
are mistakenly loaded, - which might result in unexpected
behavior.

Bug: http://b/30166532
Test: bionic-unit-tests --gtest_filter=dl*:Dl*
Change-Id: Idd6b4fa20e1d69a9f8d8391ba69c724d930fee51
2016-07-22 12:53:28 -07:00
Dimitry Ivanov
5543746934 Pass argc/argv/envp to dso constructors
The glibc implementation of the loader passes argc/argv/envp
to all elf constructors. This change makes bionic linker
behave in the same way.

Bug: http://b/30145768
Change-Id: I1c65c42aa5305a5b133c64b5748205bbde869e0e
Test: run bionic-unit-tests --gtest_filter=dl*:Dl*
2016-07-20 16:10:19 -07:00
Evgenii Stepanov
d13e9a603f Align-up and randomize shared libraries.
This change implements the following property:
  Any 2**N aligned memory region on size 2**N contains no more than one DSO.

The value N can be configured, with 16 or 18 looking like a good choice.
Additionally, DSOs are loaded at random page-aligned address inside these large
regions.

This change has dual purpose:
1. Larger values of N allow a lot more compact CFI shadow implementation.
   See change I14dfea630de468eb5620e7f55f92b1397ba06217.
   For example, CFI shadow for the system_server process has the following size (RSS, KB):
   152 for N = 12, 32 for N = 16, 16 for N = 18.
2. Extra randomization is good for security.

This change does not result in extra RAM usage, because everything is still page-aligned.
It does result in a bit more VM fragmentation because of the gaps between shared libraries.
As it turns out, this fragmentation is barely noticeable because the kernel creates new mapping
at the highest possible address, and we do enough small mappings to almost completely fill the
gaps (ex. in the Zygote the gaps are filled with .ttf file mappings and thread stacks).

I've measured VM fragmentation as the sum of all VM gaps (unmapped regions) that are larger
than 1MB according to /proc/$PID/maps. On aosp_angler-userdebug, the numbers are (in GB):

                |   N = 12  |  N = 18
system_server   |   521.9   |  521.1
zygote64        |   522.1   |  521.3
zygote32        |   2.55    |  2.55
mediaserver     |   4.00    |  4.00

Change-Id: Ia6df840dd409c82837efd1f263be420d9723c84a
2016-07-19 18:18:22 -07:00
Colin Cross
97f0aefe59 Convert linker from Android.mk to Android.bp
Change-Id: Ibf7da301defb2fd7e24fb3f4cd2e967a8f376497
2016-07-15 13:39:29 -07:00
Dimitry Ivanov
ebe5af7536 Fix typo in the comment
Addressing review comment from change I11bc2567b0cff89f48699ec74015991fee5b137b

Change-Id: I5d479ef61421c86fae06167815aa0a2681d9142d
2016-07-14 11:15:44 -07:00