fix dlopen UB due to longjmp/volatile rules violation

[musl] / src / ldso / dynlink.c

diff --git a/src/ldso/dynlink.c b/src/ldso/dynlink.c
index 305d70e..33937e7 100644 (file)
--- a/src/ldso/dynlink.c
+++ b/src/ldso/dynlink.c
@@ -53,7 +53,7 @@ struct dso
 };
 
 static struct dso *head, *tail, *libc;
-static char *env_path, *sys_path;
+static char *env_path, *sys_path, *r_path;
 static int rtld_used;
 static int runtime;
 static jmp_buf rtld_fail;
@@ -139,6 +139,37 @@ static void do_relocs(unsigned char *base, size_t *rel, size_t rel_size, size_t
        }
 }
 
+/* A huge hack: to make up for the wastefulness of shared libraries
+ * needing at least a page of dirty memory even if they have no global
+ * data, we reclaim the gaps at the beginning and end of writable maps
+ * and "donate" them to the heap by setting up minimal malloc
+ * structures and then freeing them. */
+
+static void reclaim(unsigned char *base, size_t start, size_t end)
+{
+       size_t *a, *z;
+       start = start + 6*sizeof(size_t)-1 & -4*sizeof(size_t);
+       end = (end & -4*sizeof(size_t)) - 2*sizeof(size_t);
+       if (start>end || end-start < 4*sizeof(size_t)) return;
+       a = (size_t *)(base + start);
+       z = (size_t *)(base + end);
+       a[-2] = 1;
+       a[-1] = z[0] = end-start + 2*sizeof(size_t) | 1;
+       z[1] = 1;
+       free(a);
+}
+
+static void reclaim_gaps(unsigned char *base, Phdr *ph, size_t phent, size_t phcnt)
+{
+       for (; phcnt--; ph=(void *)((char *)ph+phent)) {
+               if (ph->p_type!=PT_LOAD) continue;
+               if ((ph->p_flags&(PF_R|PF_W))!=(PF_R|PF_W)) continue;
+               reclaim(base, ph->p_vaddr & -PAGE_SIZE, ph->p_vaddr);
+               reclaim(base, ph->p_vaddr+ph->p_memsz,
+                       ph->p_vaddr+ph->p_memsz+PAGE_SIZE-1 & -PAGE_SIZE);
+       }
+}
+
 static void *map_library(int fd, size_t *lenp, unsigned char **basep, size_t *dynp)
 {
        Ehdr buf[(896+sizeof(Ehdr))/sizeof(Ehdr)];
@@ -189,7 +220,7 @@ static void *map_library(int fd, size_t *lenp, unsigned char **basep, size_t *dy
         * the length of the file. This is okay because we will not
         * use the invalid part; we just need to reserve the right
         * amount of virtual address space to map over later. */
-       map = mmap(0, map_len, prot, MAP_PRIVATE, fd, off_start);
+       map = mmap((void *)addr_min, map_len, prot, MAP_PRIVATE, fd, off_start);
        if (map==MAP_FAILED) return 0;
        base = map - addr_min;
        ph = (void *)((char *)buf + eh->e_phoff);
@@ -217,6 +248,13 @@ static void *map_library(int fd, size_t *lenp, unsigned char **basep, size_t *dy
                        }
                }
        }
+       for (i=0; ((size_t *)(base+dyn))[i]; i+=2)
+               if (((size_t *)(base+dyn))[i]==DT_TEXTREL) {
+                       mprotect(map, map_len, PROT_READ|PROT_WRITE|PROT_EXEC);
+                       break;
+               }
+       if (!runtime) reclaim_gaps(base, (void *)((char *)buf + eh->e_phoff),
+               eh->e_phentsize, eh->e_phnum);
        *lenp = map_len;
        *basep = base;
        *dynp = dyn;
@@ -278,7 +316,8 @@ static struct dso *load_library(const char *name)
        } else {
                if (strlen(name) > NAME_MAX) return 0;
                fd = -1;
-               if (env_path) fd = path_open(name, env_path);
+               if (r_path) fd = path_open(name, r_path);
+               if (fd < 0 && env_path) fd = path_open(name, env_path);
                if (fd < 0) {
                        if (!sys_path) {
                                FILE *f = fopen(ETC_LDSO_PATH, "r");
@@ -340,6 +379,10 @@ static void load_deps(struct dso *p)
        size_t i, ndeps=0;
        struct dso ***deps = &p->deps, **tmp, *dep;
        for (; p; p=p->next) {
+               for (i=0; p->dynv[i]; i+=2) {
+                       if (p->dynv[i] != DT_RPATH) continue;
+                       r_path = (void *)(p->strings + p->dynv[i+1]);
+               }
                for (i=0; p->dynv[i]; i+=2) {
                        if (p->dynv[i] != DT_NEEDED) continue;
                        dep = load_library(p->strings + p->dynv[i+1]);
@@ -357,6 +400,7 @@ static void load_deps(struct dso *p)
                                *deps = tmp;
                        }
                }
+               r_path = 0;
        }
 }
 
@@ -398,6 +442,7 @@ void *__dynlink(int argc, char **argv, size_t *got)
        size_t lib_dyn[DYN_CNT] = {0};
        size_t i;
        Phdr *phdr;
+       Ehdr *ehdr;
        struct dso lib, app;
 
        /* Find aux vector just past environ[] */
@@ -456,12 +501,18 @@ void *__dynlink(int argc, char **argv, size_t *got)
 
        /* At this point the standard library is fully functional */
 
+       reclaim_gaps(app.base, (void *)aux[AT_PHDR], aux[AT_PHENT], aux[AT_PHNUM]);
+       ehdr = (void *)lib.base;
+       reclaim_gaps(lib.base, (void *)(lib.base+ehdr->e_phoff),
+               ehdr->e_phentsize, ehdr->e_phnum);
+
        head = tail = &app;
        libc = &lib;
        app.next = 0;
        load_deps(head);
 
        make_global(head);
+       reloc_all(head->next);
        reloc_all(head);
 
        if (rtld_used) {
@@ -473,6 +524,7 @@ void *__dynlink(int argc, char **argv, size_t *got)
                *libc->prev->next = *libc;
                libc = libc->prev->next;
                if (libc->next) libc->next->prev = libc;
+               if (tail == &lib) tail = libc;
        } else {
                free_all(head);
                free(sys_path);
@@ -484,7 +536,7 @@ void *__dynlink(int argc, char **argv, size_t *got)
 
 void *dlopen(const char *file, int mode)
 {
-       struct dso *p, *orig_tail = tail, *next;
+       struct dso *volatile p, *orig_tail = tail, *next;
        size_t i;
 
        if (!file) return head;
@@ -509,30 +561,30 @@ void *dlopen(const char *file, int mode)
        }
 
        p = load_library(file);
-       if (!p) return 0;
+       if (!p) goto end;
 
        /* First load handling */
        if (!p->deps) {
                load_deps(p);
-               for (i=0; p->deps[i]; i++)
+               if (p->deps) for (i=0; p->deps[i]; i++)
                        if (!p->deps[i]->global)
                                p->deps[i]->global = -1;
                if (!p->global) p->global = -1;
                reloc_all(p);
-               for (i=0; p->deps[i]; i++)
+               if (p->deps) for (i=0; p->deps[i]; i++)
                        if (p->deps[i]->global < 0)
                                p->deps[i]->global = 0;
                if (p->global < 0) p->global = 0;
        }
 
        if (mode & RTLD_GLOBAL) {
-               for (i=0; p->deps[i]; i++)
+               if (p->deps) for (i=0; p->deps[i]; i++)
                        p->deps[i]->global = 1;
                p->global = 1;
        }
 
+end:
        pthread_rwlock_unlock(&lock);
-
        return p;
 }
 
@@ -541,7 +593,8 @@ static void *do_dlsym(struct dso *p, const char *s)
        size_t i;
        uint32_t h;
        Sym *sym;
-       if (p == head) return find_sym(head, s, 0);
+       if (p == head || p == RTLD_DEFAULT)
+               return find_sym(head, s, 0);
        h = hash(s);
        sym = lookup(s, h, p->syms, p->hashtab, p->strings);
        if (sym && sym->st_value && (1<<(sym->st_info&0xf) & OK_TYPES))