#include <elf.h>
#include <sys/mman.h>
#include <limits.h>
-#include <stdint.h>
#include <fcntl.h>
#include <sys/stat.h>
#include <errno.h>
-#include <limits.h>
-#include <elf.h>
#include <link.h>
#include <setjmp.h>
#include <pthread.h>
Sym *syms;
uint32_t *hashtab;
uint32_t *ghashtab;
+ int16_t *versym;
char *strings;
unsigned char *map;
size_t map_len;
signed char global;
char relocated;
char constructed;
- struct dso **deps;
+ char kernel_mapped;
+ struct dso **deps, *needed_by;
+ char *rpath_orig, *rpath;
void *tls_image;
size_t tls_len, tls_size, tls_align, tls_id, tls_offset;
+ size_t relro_start, relro_end;
void **new_dtv;
unsigned char *new_tls;
int new_dtv_idx, new_tls_idx;
#include "reloc.h"
void __init_ssp(size_t *);
-void *__install_initial_tls(void *);
+int __init_tp(void *);
void __init_libc(char **, char *);
+const char *__libc_get_version(void);
+
static struct dso *head, *tail, *ldso, *fini_head;
-static char *env_path, *sys_path, *r_path;
+static char *env_path, *sys_path;
static unsigned long long gencnt;
static int ssp_used;
static int runtime;
static struct debug debug;
static size_t tls_cnt, tls_offset, tls_align = 4*sizeof(size_t);
static pthread_mutex_t init_fini_lock = { ._m_type = PTHREAD_MUTEX_RECURSIVE };
+static long long builtin_tls[(sizeof(struct pthread) + 64)/sizeof(long long)];
struct debug *_dl_debug_addr = &debug;
uint32_t *hashtab = dso->hashtab;
char *strings = dso->strings;
for (i=hashtab[2+h%hashtab[0]]; i; i=hashtab[2+hashtab[0]+i]) {
- if (!strcmp(s, strings+syms[i].st_name))
+ if ((!dso->versym || dso->versym[i] >= 0)
+ && (!strcmp(s, strings+syms[i].st_name)))
return syms+i;
}
return 0;
static Sym *gnu_lookup(const char *s, uint32_t h1, struct dso *dso)
{
- Sym *sym;
- char *strings;
+ Sym *syms = dso->syms;
+ char *strings = dso->strings;
uint32_t *hashtab = dso->ghashtab;
uint32_t nbuckets = hashtab[0];
uint32_t *buckets = hashtab + 4 + hashtab[2]*(sizeof(size_t)/4);
uint32_t h2;
uint32_t *hashval;
- uint32_t n = buckets[h1 % nbuckets];
+ uint32_t i = buckets[h1 % nbuckets];
- if (!n) return 0;
+ if (!i) return 0;
- strings = dso->strings;
- sym = dso->syms + n;
- hashval = buckets + nbuckets + (n - hashtab[1]);
+ hashval = buckets + nbuckets + (i - hashtab[1]);
- for (h1 |= 1; ; sym++) {
+ for (h1 |= 1; ; i++) {
h2 = *hashval++;
- if ((h1 == (h2|1)) && !strcmp(s, strings + sym->st_name))
- return sym;
+ if ((!dso->versym || dso->versym[i] >= 0)
+ && (h1 == (h2|1)) && !strcmp(s, strings + syms[i].st_name))
+ return syms+i;
if (h2 & 1) break;
}
name = strings + sym->st_name;
ctx = IS_COPY(type) ? head->next : head;
def = find_sym(ctx, name, IS_PLT(type));
- if (!def.sym && sym->st_info>>4 != STB_WEAK) {
+ if (!def.sym && (sym->st_shndx != SHN_UNDEF
+ || sym->st_info>>4 != STB_WEAK)) {
snprintf(errbuf, sizeof errbuf,
"Error relocating %s: %s: symbol not found",
dso->name, name);
* and "donate" them to the heap by setting up minimal malloc
* structures and then freeing them. */
-static void reclaim(unsigned char *base, size_t start, size_t end)
+static void reclaim(struct dso *dso, size_t start, size_t end)
{
size_t *a, *z;
+ if (start >= dso->relro_start && start < dso->relro_end) start = dso->relro_end;
+ if (end >= dso->relro_start && end < dso->relro_end) end = dso->relro_start;
start = start + 6*sizeof(size_t)-1 & -4*sizeof(size_t);
end = (end & -4*sizeof(size_t)) - 2*sizeof(size_t);
if (start>end || end-start < 4*sizeof(size_t)) return;
- a = (size_t *)(base + start);
- z = (size_t *)(base + end);
+ a = (size_t *)(dso->base + start);
+ z = (size_t *)(dso->base + end);
a[-2] = 1;
a[-1] = z[0] = end-start + 2*sizeof(size_t) | 1;
z[1] = 1;
free(a);
}
-static void reclaim_gaps(unsigned char *base, Phdr *ph, size_t phent, size_t phcnt)
+static void reclaim_gaps(struct dso *dso, Phdr *ph, size_t phent, size_t phcnt)
{
for (; phcnt--; ph=(void *)((char *)ph+phent)) {
if (ph->p_type!=PT_LOAD) continue;
if ((ph->p_flags&(PF_R|PF_W))!=(PF_R|PF_W)) continue;
- reclaim(base, ph->p_vaddr & -PAGE_SIZE, ph->p_vaddr);
- reclaim(base, ph->p_vaddr+ph->p_memsz,
+ reclaim(dso, ph->p_vaddr & -PAGE_SIZE, ph->p_vaddr);
+ reclaim(dso, ph->p_vaddr+ph->p_memsz,
ph->p_vaddr+ph->p_memsz+PAGE_SIZE-1 & -PAGE_SIZE);
}
}
for (i=eh->e_phnum; i; i--, ph=(void *)((char *)ph+eh->e_phentsize)) {
if (ph->p_type == PT_DYNAMIC)
dyn = ph->p_vaddr;
- if (ph->p_type == PT_TLS) {
+ else if (ph->p_type == PT_TLS) {
tls_image = ph->p_vaddr;
dso->tls_align = ph->p_align;
dso->tls_len = ph->p_filesz;
dso->tls_size = ph->p_memsz;
+ } else if (ph->p_type == PT_GNU_RELRO) {
+ dso->relro_start = ph->p_vaddr & -PAGE_SIZE;
+ dso->relro_end = (ph->p_vaddr + ph->p_memsz) & -PAGE_SIZE;
}
if (ph->p_type != PT_LOAD) continue;
if (ph->p_vaddr < addr_min) {
goto error;
break;
}
- if (!runtime) reclaim_gaps(base, ph0, eh->e_phentsize, eh->e_phnum);
dso->map = map;
dso->map_len = map_len;
dso->base = base;
dso->dynv = (void *)(base+dyn);
if (dso->tls_size) dso->tls_image = (void *)(base+tls_image);
+ if (!runtime) reclaim_gaps(dso, ph0, eh->e_phentsize, eh->e_phnum);
free(allocated_buf);
return map;
noexec:
}
}
+static int fixup_rpath(struct dso *p, char *buf, size_t buf_size)
+{
+ size_t n, l;
+ const char *s, *t, *origin;
+ char *d;
+ if (p->rpath) return 0;
+ if (!p->rpath_orig) return -1;
+ if (!strchr(p->rpath_orig, '$')) {
+ p->rpath = p->rpath_orig;
+ return 0;
+ }
+ n = 0;
+ s = p->rpath_orig;
+ while ((t=strchr(s, '$'))) {
+ if (strncmp(t, "$ORIGIN", 7) && strncmp(t, "${ORIGIN}", 9))
+ return -1;
+ s = t+1;
+ n++;
+ }
+ if (n > SSIZE_MAX/PATH_MAX) return -1;
+
+ if (p->kernel_mapped) {
+ /* $ORIGIN searches cannot be performed for the main program
+ * when it is suid/sgid/AT_SECURE. This is because the
+ * pathname is under the control of the caller of execve.
+ * For libraries, however, $ORIGIN can be processed safely
+ * since the library's pathname came from a trusted source
+ * (either system paths or a call to dlopen). */
+ if (libc.secure)
+ return -1;
+ l = readlink("/proc/self/exe", buf, buf_size);
+ if (l >= buf_size)
+ return -1;
+ buf[l] = 0;
+ origin = buf;
+ } else {
+ origin = p->name;
+ }
+ t = strrchr(origin, '/');
+ l = t ? t-origin : 0;
+ p->rpath = malloc(strlen(p->rpath_orig) + n*l + 1);
+ if (!p->rpath) return -1;
+
+ d = p->rpath;
+ s = p->rpath_orig;
+ while ((t=strchr(s, '$'))) {
+ memcpy(d, s, t-s);
+ d += t-s;
+ memcpy(d, origin, l);
+ d += l;
+ /* It was determined previously that the '$' is followed
+ * either by "ORIGIN" or "{ORIGIN}". */
+ s = t + 7 + 2*(t[1]=='{');
+ }
+ strcpy(d, s);
+ return 0;
+}
+
static void decode_dyn(struct dso *p)
{
size_t dyn[DYN_CNT] = {0};
p->strings = (void *)(p->base + dyn[DT_STRTAB]);
if (dyn[0]&(1<<DT_HASH))
p->hashtab = (void *)(p->base + dyn[DT_HASH]);
+ if (dyn[0]&(1<<DT_RPATH))
+ p->rpath_orig = (void *)(p->strings + dyn[DT_RPATH]);
if (search_vec(p->dynv, dyn, DT_GNU_HASH))
p->ghashtab = (void *)(p->base + *dyn);
+ if (search_vec(p->dynv, dyn, DT_VERSYM))
+ p->versym = (void *)(p->base + *dyn);
}
-static struct dso *load_library(const char *name)
+static struct dso *load_library(const char *name, struct dso *needed_by)
{
char buf[2*NAME_MAX+2];
const char *pathname;
if (strlen(name) > NAME_MAX) return 0;
fd = -1;
if (env_path) fd = path_open(name, env_path, buf, sizeof buf);
- if (fd < 0 && r_path) fd = path_open(name, r_path, buf, sizeof buf);
+ for (p=needed_by; fd < 0 && p; p=p->needed_by)
+ if (!fixup_rpath(p, buf, sizeof buf))
+ fd = path_open(name, p->rpath, buf, sizeof buf);
if (fd < 0) {
if (!sys_path) {
char *prefix = 0;
sys_path = "";
}
fclose(f);
+ } else if (errno != ENOENT) {
+ sys_path = "";
}
}
if (!sys_path) sys_path = "/lib:/usr/local/lib:/usr/lib";
p->dev = st.st_dev;
p->ino = st.st_ino;
p->refcnt = 1;
+ p->needed_by = needed_by;
p->name = p->buf;
strcpy(p->name, pathname);
/* Add a shortname only if name arg was not an explicit pathname. */
if (pathname != name) p->shortname = strrchr(p->name, '/')+1;
if (p->tls_image) {
- if (runtime && !__pthread_self_init()) {
+ if (runtime && !libc.has_thread_pointer) {
munmap(map, p->map_len);
free(p);
+ errno = ENOSYS;
return 0;
}
p->tls_id = ++tls_cnt;
size_t i, ndeps=0;
struct dso ***deps = &p->deps, **tmp, *dep;
for (; p; p=p->next) {
- for (i=0; p->dynv[i]; i+=2) {
- if (p->dynv[i] != DT_RPATH) continue;
- r_path = (void *)(p->strings + p->dynv[i+1]);
- }
for (i=0; p->dynv[i]; i+=2) {
if (p->dynv[i] != DT_NEEDED) continue;
- dep = load_library(p->strings + p->dynv[i+1]);
+ dep = load_library(p->strings + p->dynv[i+1], p);
if (!dep) {
snprintf(errbuf, sizeof errbuf,
"Error loading shared library %s: %m (needed by %s)",
*deps = tmp;
}
}
- r_path = 0;
}
}
for (z=s; *z && !isspace(*z); z++);
tmp = *z;
*z = 0;
- load_library(s);
+ load_library(s, 0);
*z = tmp;
}
}
2+(dyn[DT_PLTREL]==DT_RELA));
do_relocs(p, (void *)(p->base+dyn[DT_REL]), dyn[DT_RELSZ], 2);
do_relocs(p, (void *)(p->base+dyn[DT_RELA]), dyn[DT_RELASZ], 3);
+
+ if (p->relro_start != p->relro_end &&
+ mprotect(p->base+p->relro_start, p->relro_end-p->relro_start, PROT_READ) < 0) {
+ snprintf(errbuf, sizeof errbuf,
+ "Error relocating %s: RELRO protection failed",
+ p->name);
+ if (runtime) longjmp(*rtld_fail, 1);
+ dprintf(2, "%s\n", errbuf);
+ ldso_fail = 1;
+ }
+
p->relocated = 1;
}
}
{
size_t min_addr = -1, max_addr = 0;
for (; cnt--; ph = (void *)((char *)ph + stride)) {
+ if (ph->p_type == PT_GNU_RELRO) {
+ p->relro_start = ph->p_vaddr & -PAGE_SIZE;
+ p->relro_end = (ph->p_vaddr + ph->p_memsz) & -PAGE_SIZE;
+ }
if (ph->p_type != PT_LOAD) continue;
if (ph->p_vaddr < min_addr)
min_addr = ph->p_vaddr;
pthread_t td;
struct dso *p;
- if (!tls_cnt) return mem;
-
void **dtv = (void *)mem;
dtv[0] = (void *)tls_cnt;
+ if (!tls_cnt) {
+ td = (void *)(dtv+1);
+ td->dtv = dtv;
+ return td;
+ }
#ifdef TLS_ABOVE_TP
mem += sizeof(void *) * (tls_cnt+1);
size_t vdso_base;
size_t *auxv;
char **envp = argv+argc+1;
+ void *initial_tls;
/* Find aux vector just past environ[] */
for (i=argc+1; argv[i]; i++)
|| aux[AT_GID]!=aux[AT_EGID] || aux[AT_SECURE]) {
env_path = 0;
env_preload = 0;
+ libc.secure = 1;
}
+ libc.page_size = aux[AT_PAGESZ];
/* If the dynamic linker was invoked as a program itself, AT_BASE
* will not be set. In that case, we assume the base address is
lib->base = (void *)aux[AT_BASE];
lib->name = lib->shortname = "libc.so";
lib->global = 1;
+ lib->kernel_mapped = 1;
ehdr = (void *)lib->base;
lib->phnum = ehdr->e_phnum;
lib->phdr = (void *)(aux[AT_BASE]+ehdr->e_phoff);
}
if (app->tls_size) app->tls_image = (char *)app->base + tls_image;
if (interp_off) lib->name = (char *)app->base + interp_off;
- app->name = argv[0];
+ if ((aux[0] & (1UL<<AT_EXECFN))
+ && strncmp((char *)aux[AT_EXECFN], "/proc/", 6))
+ app->name = (char *)aux[AT_EXECFN];
+ else
+ app->name = argv[0];
+ app->kernel_mapped = 1;
app->dynv = (void *)(app->base + find_dyn(
(void *)aux[AT_PHDR], aux[AT_PHNUM], aux[AT_PHENT]));
find_map_range((void *)aux[AT_PHDR],
*argv++ = (void *)-1;
if (argv[0] && !strcmp(argv[0], "--")) *argv++ = (void *)-1;
if (!argv[0]) {
- dprintf(2, "musl libc/dynamic program loader\n");
- dprintf(2, "usage: %s pathname%s\n", ldname,
+ dprintf(2, "musl libc\n"
+ "Version %s\n"
+ "Dynamic Program Loader\n"
+ "Usage: %s [--] pathname%s\n",
+ __libc_get_version(), ldname,
ldd_mode ? "" : " [args]");
_exit(1);
}
/* PAST THIS POINT, ALL LIBC INTERFACES ARE FULLY USABLE. */
/* Donate unused parts of app and library mapping to malloc */
- reclaim_gaps(app->base, (void *)aux[AT_PHDR], aux[AT_PHENT], aux[AT_PHNUM]);
+ reclaim_gaps(app, (void *)aux[AT_PHDR], aux[AT_PHENT], aux[AT_PHNUM]);
ehdr = (void *)lib->base;
- reclaim_gaps(lib->base, (void *)(lib->base+ehdr->e_phoff),
+ reclaim_gaps(lib, (void *)(lib->base+ehdr->e_phoff),
ehdr->e_phentsize, ehdr->e_phnum);
/* Load preload/needed libraries, add their symbols to the global
load_deps(app);
make_global(app);
+#ifndef DYNAMIC_IS_RO
+ for (i=0; app->dynv[i]; i+=2)
+ if (app->dynv[i]==DT_DEBUG)
+ app->dynv[i+1] = (size_t)&debug;
+#endif
+
reloc_all(app->next);
reloc_all(app);
update_tls_size();
- if (tls_cnt) {
- void *mem = mmap(0, libc.tls_size, PROT_READ|PROT_WRITE,
- MAP_ANONYMOUS|MAP_PRIVATE, -1, 0);
- if (mem==MAP_FAILED ||
- !__install_initial_tls(__copy_tls(mem))) {
+ if (libc.tls_size > sizeof builtin_tls) {
+ initial_tls = calloc(libc.tls_size, 1);
+ if (!initial_tls) {
dprintf(2, "%s: Error getting %zu bytes thread-local storage: %m\n",
argv[0], libc.tls_size);
_exit(127);
}
+ } else {
+ initial_tls = builtin_tls;
+ }
+ if (__init_tp(__copy_tls(initial_tls)) < 0 && tls_cnt) {
+ dprintf(2, "%s: Thread-local storage not supported by kernel.\n", argv[0]);
+ _exit(127);
}
if (ldso_fail) _exit(127);
* all memory used by the dynamic linker. */
runtime = 1;
-#ifndef DYNAMIC_IS_RO
- for (i=0; app->dynv[i]; i+=2)
- if (app->dynv[i]==DT_DEBUG)
- app->dynv[i+1] = (size_t)&debug;
-#endif
debug.ver = 1;
debug.bp = _dl_debug_state;
debug.head = head;
p = 0;
errflag = 1;
goto end;
- } else p = load_library(file);
+ } else p = load_library(file, head);
if (!p) {
snprintf(errbuf, sizeof errbuf, noload ?
return 0;
}
-int __dladdr(void *addr, Dl_info *info)
+int __dladdr(const void *addr, Dl_info *info)
{
struct dso *p;
Sym *sym;
uint32_t *hashval;
buckets = p->ghashtab + 4 + (p->ghashtab[2]*sizeof(size_t)/4);
sym += p->ghashtab[1];
- for (i = 0; i < p->ghashtab[0]; i++) {
+ for (i = nsym = 0; i < p->ghashtab[0]; i++) {
if (buckets[i] > nsym)
nsym = buckets[i];
}
{
return 0;
}
-int __dladdr (void *addr, Dl_info *info)
+int __dladdr (const void *addr, Dl_info *info)
{
return 0;
}
projects / musl / blobdiff