The AT_RANDOM changes broke setuid / setgid executables
such as "ping". When the linker executes a setuid program,
it cleans the environment, removing any invalid environment
entries, and adding "NULL"s to the end of the environment
array for each removed variable. Later on, we try to determine
the location of the aux environment variable, and get tripped
up by these extra NULLs.
Reverting this patch will get setuid executables working again,
but getauxval() is still broken for setuid programs because of
this bug.
This reverts commit e3a49a8661.
Change-Id: I05c58a896b1fe32cfb5d95d43b096045cda0aa4a
Populate the stack canaries from the kernel supplied
AT_RANDOM value, which doesn't involve any system calls.
This is slightly faster (6 fewer syscalls) and avoids
unnecessarily reading /dev/urandom, which depletes entropy.
Bug: 7959813
Change-Id: If2b43100a2a9929666df3de56b6139fed969e0f1
When executing a setuid executable, filter out ANDROID_PROPERTY_WORKSPACE
from the environment. Some applications implicitly trust the property
space and don't realize that it's passed by an environment variable
which can be modified by the caller.
Change-Id: I3e3a98941f0a1f249a2ff983ecbcfe1278aa9159
This is primarily for MIPS exutables that do not have a
DT_MIPS_RLD_MAP entry.
Change-Id: I4c221d92debcfed961eeee2515123f3fb21ec8e6
Signed-off-by: Chris Dearman <chris@mips.com>
This patch replaces .S versions of x86 crtfiles with .c which are much
easier to support. Some of the files are matching .c version of Arm
crtfiles. x86 files required some cleanup anyway and this cleanup actually
led to matching Arm files.
I didn't change anything to share the same crt*.c between x86 and Arm. I
prefer to keep them separate for a while in case any change is required
for one of the arch, but it's good thing to do in the following patches.
Change-Id: Ibcf033f8d15aa5b10c05c879fd4b79a64dfc70f3
Signed-off-by: Pavel Chupin <pavel.v.chupin@intel.com>
If you need to build your own linker to get debugging, the debugging
is never available when you need it.
Change-Id: I5ff7e55753459d49a2990f25d9aa155e0b8602e0
According ELF spec re. DT_SYMBOLIC:
This element's presence in a shared object library alters the dynamic
linker's symbol resolution algorithm for references within the library.
Instead of starting a symbol search with the executable file, the
dynamic linker starts from the shared object itself. If the shared
object fails to supply the referenced symbol, the dynamic linker then
searches the executable file and other shared objects as usual.
This change implements the last part.
Change-Id: Iae95d53d455313a4306f11733941bcd3596ac85f
Signed-off-by: Pavel Chupin <pavel.v.chupin@intel.com>
NVIDIA binary blobs construct strings to pass to dlopen(3) that
contain '/' but require that we fall back to LD_LIBRARY_PATH.
Change-Id: Iad831899986baace6962f4b335eeb288250a1e22
We'll need a lot more refactoring of this code before we can reduce
the granularity, but this is a step forward.
Change-Id: I07061720e734b571a8399c1d5b4f2f35cd681307
Request memory from the system when needed instead of having a fixed
array for soinfo structs. Note that malloc() et al can't be used in
linker, so use mmap() instead.
Change-Id: I4b495995931d7752b0e8c944e64d1fe41b9f7144
Also ensure that dlopen(3) errors always include the name of the library we
failed to open.
Also fix a bug where we'd fall back to searching LD_LIBRARY_PATH and the
built-in paths for names that include slashes.
Bug: http://code.google.com/p/android/issues/detail?id=38479
Change-Id: Ib2c009ed083344a7a012749d58f8679db2f26c78
If an executable contain copy relocations, other references
to the symbol it points to should be preempted and made to
point to the copy instead.
Also, the linker should make sure the target area has
sufficient space to contain the copy. It also checks
whether the library that supplies the symbol is built
with -Bsymbolic, and errors out if this is the case.
Change-Id: If135c83590092741cfd8f82f54816f363a4a4a3b
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@gmail.com>
I still want to break linker_format out into its own library so we can reuse
it for malloc debugging and so forth. (There are many similar pieces of code
in bionic, but the linker's one seems to be the most complete/functional.)
Change-Id: If3721853d28937c8e821ca1d23cf200e228a409a
error: C99 designator 'name' outside aggregate initializer
G++ 4.7+ can't handle some of C99 designated initializers.
Most likely it's just not implemented yet. Other possible workarounds is
to compile this as C not C++ or define name as char* instead of char[SIZE].
Appeared after this change https://android-review.googlesource.com/#/c/44470
Change-Id: Ib28157848ce759b8bb5dbb2ac0d9a768fa4e5107
Signed-off-by: Pavel Chupin <pavel.v.chupin@intel.com>
I gave up trying to use the usual thread-local buffer idiom; calls to
calloc(3) and free(3) from any of the "dl" functions -- which live in
the dynamic linker -- end up resolving to the dynamic linker's stubs.
I tried to work around that, but was just making things more complicated.
This alternative costs us a well-known TLS slot (instead of the
dynamically-allocated TLS slot we'd have used otherwise, so no difference
there), plus an extra buffer inside every pthread_internal_t.
Bug: 5404023
Change-Id: Ie9614edd05b6d1eeaf7bf9172792d616c6361767
Add unit tests for dlerror(3) in various situations. I think We're at least
as good as glibc now.
Also factor out the ScopedPthreadMutexLock and use it here too.
Bug: http://code.google.com/p/android/issues/detail?id=38398
Change-Id: I040938b4366ab836e3df46d1d8055b92f4ea6ed8
Now we use private variables in transform-o-to-executable to support
build executables against the NDK.
Bug: 7170098
Change-Id: I6e505b33001b76f4b11fcbbb1d35392c4ddf4c70
Our debugger signal catcher expects to receive three args, but if
somebody cleared SA_SIGINFO we only get one, and bad things happen
when we try to use the second one. Test to see if SA_SIGINFO is
still set before we try to use the argument.
(cherry-pick of f84bc8d6f6368f1c846124a8168761ee8cc589c0.)
Bug: 7272866
Change-Id: I69a65c25e833aea70acb78f9ba40ed93308583e6
Our debugger signal catcher expects to receive three args, but if
somebody cleared SA_SIGINFO we only get one, and bad things happen
when we try to use the second one. Test to see if SA_SIGINFO is
still set before we try to use the argument.
Bug: 7272866
Change-Id: If682a2262fe8a575f3802fb0c60a53eea3082456
Now we use private variables in transform-o-to-executable to support
build executables against the NDK.
Bug: 7170098
Change-Id: I6e505b33001b76f4b11fcbbb1d35392c4ddf4c70
Currently, linker doesn't update the map->l_addr for execution.
Which could break the Unwind_Backtrace with PT_GNU_EH_FRAME enabled
in new toolchain.
Change-Id: Ifbd853134da64a962f7e4c4105e56a3f20def1b2
Author: Fengwei Yin <fengwei.yin@intel.com>
Signed-off-by: Jack Ren <jack.ren@intel.com>
Author-tracking-BZ: 57077
Lose the pid, only show the name of the function (not its whole signature),
and include the name of the library we failed to load. (I hadn't noticed
that the library name was missing before because in Java we add that into
the UnsatisfiedLinkError detail message.)
The new output looks like this:
Cannot load library: soinfo_relocate(linker.cpp:968): cannot locate symbol "__libc_malloc_default_dispatch" referenced by "libc_malloc_debug_leak.so"...
Change-Id: I3bb5c9780d9aaf3a9e4418ea55bc98122a81f80f
Per http://infocenter.arm.com/help/topic/com.arm.doc.ihi0044d/IHI0044D_aaelf.pdf
Section 4.7.1.10, ARM_R_COPY relocations are only suppose to reference shared
libraries, not the executable itself. When resolving an R_ARM_COPY symbol,
ensure we don't look in our own symbol.
This partially addresses
http://code.google.com/p/android/issues/detail?id=28598 . After this
patch, the printfs generated by the test program are:
global = 0x42 (0x401c7000)
global = 0x42 (0x11000)
before, the output was:
global = 0x42 (0x40071000)
global = 0x0 (0x11000)
I'm still not very happy with this patch, but I think it's an improvement
over where we were at before.
This change was modeled after https://android-review.googlesource.com/38871
Change-Id: Id7ad921e58395e76a36875bcc742ec5eeba53f08
This header is used on bionic build and should be propagated into
sysroot on toolchain rebuild. Discussion re. this header is here:
http://gcc.gnu.org/ml/gcc-patches/2012-08/msg00936.html
It is available already in mips NDK platforms:
development/ndk/platforms/android-9/arch-mips/include/link.h
Change-Id: I39ff467cdac9f448e31c11ee3e14a6200e82ab57
Signed-off-by: Pavel Chupin <pavel.v.chupin@intel.com>
This patch removes the DT_NEEDED hack which stores pointers
to soinfo structs in the .dynamic section of the library
being loaded.
Instead, it caches the soinfo struct pointers on the stack
during relocation time. After relocation time, i.e. when
calling constructors and destructors of the shared library
and its dependencies, uncached access is used instead,
doing lookups using the string table entries pointed to by
the DT_NEEDED entries.
By removing this hack, it is no longer needed to undo the
PT_GNURELRO protection, i.e., all non-writable mappings
can remain non-writable during their entire lifespan.
Even though, strictly speaking, the algorithmic complexity
has increased somewhat, the real-world adverse effect
is negligible on the systems I have tested.
Change-Id: I2361502560b96b5878f7f94a8e8a215350d70d64
Signed-off-by: Ard Biesheuvel <ard.biesheuvel@gmail.com>
This should help prevent broken builds next time I'm messing with
assembler/compiler/linker flags...
Change-Id: I30f15a3ce3c3f3c60cad7bc59aaba9f42d792224
The linker only needs to mark the text segment as
writable iff the file has text relocations. Unnecessarily
calling mprotect when it isn't necessary is slow, and some
security enhanced kernels don't like it. Pages which are
simultaneously writable and executable are considered a no-no.
The vast majority of executables / shared libraries on Android
do NOT have text relocations.
Change-Id: Ic38ce30a99b7e33ecf21efd9c108547a58eafa35
Otherwise gdb will print a spurious warning each time gdb is used:
warning: .dynamic section for "/system/bin/linker" is not at the expected
address (wrong library or version mismatch?)
BUG:6946614
Change-Id: Ib21b8db0615751189c1601140deb43bc089289b6
Remove the hand-collated ones, and switch to a script that pulls the
copyright headers out of every file and collects the unique ones.
Change-Id: Ied3b98b3f56241df97166c410ff81de4e0157c9d
Also make the errors more readable, since none of us seemed to know
what they actually meant. The new style is still as verbose as the
old, but that's probably necessary in the absence of chained exceptions
in C. Here's what you'd see if you try to boot after removing
libsurfaceflinger.so:
32267 32267 E AndroidRuntime: java.lang.UnsatisfiedLinkError: Cannot load library: (linker.c:1629, pid 32259) soinfo_link_image: could not load library "libsystem_server.so" needed by "libandroid_servers.so"; caused by (linker.c:1629, pid 32259) soinfo_link_image: could not load library "libsurfaceflinger.so" needed by "libsystem_server.so"; caused by (linker.c:709, pid 32259) load_library: library "libsurfaceflinger.so" not found
This patch also fixes almost all of the compiler warnings.
Change-Id: I64bb59aed6d4e039c15ea45be2367f319ef879f8
Given that _elf_lookup (and thus, _do_lookup) cannot possibly return an
undefined symbol (due to the check for SHN_UNDEF in _elf_lookup), there's
no need for spurious checks for SHN_UNDEF on its return value.
Conflicts:
linker/linker.c
Change-Id: Ic73cf439924b45f72d4d9ba3f64a888c96cbbd9b
GDB needs the runtime linker's base address in order to
locate the latter's ".text" and ".plt" sections, for the
purpose of detecting solib trampolines. It also can
potentially use this to calculate the relocated address
of rtld_db_dlactivity.
Bug: http://code.google.com/p/android/issues/detail?id=34856
Change-Id: I63d3e7ae4e20a684ceb25967f2241e7d58dd685d
Signed-off-by: Ryan V. Bissell <ryan@bissell.org>
Since linker is built with -fvisibility=hidden rtld_db_dlactivity()
if hidden from gdb. Unhide it otherwise gdb may not know linker
activity and rescan solib
Change-Id: Ia8cd8d9738c6ea5696ba2ef0ebf2cf783f9ca70a
Use the functions in linker_phdr.c to load the PT_LOAD segments
in memory, and toggle their mapping's writable protection bit
as needed. In particular:
- when loading a library, load the segments then unprotected
them to allow relocations to work.
- when relocating the linker of the executable, unprotect
the segments loaded by the kernel to make relocations work
too.
- after all relocations are done, re-protect the segments,
and apply GNU RELRO protection if needed.
- just before calling the destructors, undo the GNU RELRO
protection.
Change-Id: I50e709f03958204b8d6140c0f51ebe24fe089a1b
This moves the code that determines where the .dynamic and .ARM.exidx
sections are to a single place in soinfo_link_image().
Change-Id: I98adcb440577bed86442349f03f3c629c945efec
This patch changes the definition of the 'load_offset' field
in struct soinfo. The field is renamed because it is not the
basic load bias to add to every p_vaddr value read from the ELF
file to get the corresponding memory address.
This also slightly simplifies the relocation code.
+ Fix for proper load_bias computation for relocatable executables.
Change-Id: I72502c75a70751cba324deee7d313ae61f96609e
This patch changes the load_library() function in the
dynamic linker to avoid reserving a huge read-only
address-space range just to read the ELF header and
program header (which are typically very small and easily
fit in the first page).
Instead, we use the functions in linker_phdr.c to only
load the data that we need in a temporary mmap-allocated
page of memory, which we release when the function exits.
This avoids issues when loading very large libraries, or
simply debug versions that only need to load a tiny percentage
of their overall file content in RAM.
Change-Id: Id3a189fad2119a870a1b3d43dd81380c54ea6044
This patch introduces two new source files containing a set of functions
to manage the program header table in an ELF binary, including the ability
to load PT_LOAD segments, and apply PT_GNU_RELRO protection.
Note: the files are not used currently, this will appear in a series
of future patches that will gradually modify linker.c to use
the phdr_table_xxx functions properly.
Change-Id: Ia3d4c1ff5fc3e265d8258b64b492f4e643f51bdc
With -fstack-protector, x86 -m32 needs __stack_chk_fail_local
defined in crtbegin_*.o.
Include __stack_chk_fail_local.S in begin.S otherwise linker
(which is built w/o crt*) may not link.
Change-Id: Id242fcf3eff157264afe3b04f27288ab7991220a
This patch adds a trivial implementation of snprintf() that calls
our internal vsnprintf().
Inspection of the generated machine code showed that the linker
contained a full implementation of stdio's vfprintf. It was pulled
in because the pthread implementation uses snprintf() somewhere.
ProTip: It's possible to see why specific objects files are included
in a final binary by adding the following to your Android.mk, then
looking at the content of /tmp/MAP.TXT:
LOCAL_LDFLAGS += -Wl,-Map=/tmp/MAP.TXT
Change-Id: I325e71b0cad1d01116a2e00c09e30a80cb716aa3
This patch adds to make the linker a little bit easier to understand
by making all functions that acts on a sofino object with a soinfo_
prefix.
This is to more easily distinguish functions that operate on global
state, and those that operate on individual libraries.
This should be purely stylistic, i.e. no feature/behaviour change.
Change-Id: Ie510d13d743aa4317644caefa9910b8af7e84f44
Before changing mmap() permission to PROT_NONE in alloc_mem_region(),
such libraries once worked with a bug that uses mmap'ed region outside of
memory region allocated by alloc_mem_region(). This possibly incurs
SIGSEGV because it can overwrite memory region of previously loaded
library, but it sometimes worked, depending on loading order.
After PROT_NONE, this caused SIGSEGV earlier during calculation of
si->phdr in load_library(), but this was fixed by:
75917c84d1 Use mmap to read an ...
Now the behaviour is the same as before applying PROT_NONE in
alloc_mem_region().
This CL fixed the original issue, supporting shared libraries that have
non-zero p_vaddr in first (= with lowest p_vaddr) PT_LOAD segment.
Bug: 6561258
Change-Id: Ib6176dd3e44c4d99a340eb1cbd16fb037586b0bc
