1 /* 2 * Copyright (C) 2012 The Android Open Source Project 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * * Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * * Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in 12 * the documentation and/or other materials provided with the 13 * distribution. 14 * 15 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 16 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 17 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 18 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 19 * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 21 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS 22 * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED 23 * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, 24 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT 25 * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26 * SUCH DAMAGE. 27 */ 28 29 #include "linker_phdr.h" 30 31 #include <errno.h> 32 #include <string.h> 33 #include <sys/mman.h> 34 #include <sys/types.h> 35 #include <sys/stat.h> 36 #include <unistd.h> 37 38 #include "linker.h" 39 #include "linker_debug.h" 40 #include "linker_utils.h" 41 42 #include "private/bionic_prctl.h" 43 44 static int GetTargetElfMachine() { 45 #if defined(__arm__) 46 return EM_ARM; 47 #elif defined(__aarch64__) 48 return EM_AARCH64; 49 #elif defined(__i386__) 50 return EM_386; 51 #elif defined(__mips__) 52 return EM_MIPS; 53 #elif defined(__x86_64__) 54 return EM_X86_64; 55 #endif 56 } 57 58 /** 59 TECHNICAL NOTE ON ELF LOADING. 60 61 An ELF file's program header table contains one or more PT_LOAD 62 segments, which corresponds to portions of the file that need to 63 be mapped into the process' address space. 64 65 Each loadable segment has the following important properties: 66 67 p_offset -> segment file offset 68 p_filesz -> segment file size 69 p_memsz -> segment memory size (always >= p_filesz) 70 p_vaddr -> segment's virtual address 71 p_flags -> segment flags (e.g. readable, writable, executable) 72 73 We will ignore the p_paddr and p_align fields of ElfW(Phdr) for now. 74 75 The loadable segments can be seen as a list of [p_vaddr ... p_vaddr+p_memsz) 76 ranges of virtual addresses. A few rules apply: 77 78 - the virtual address ranges should not overlap. 79 80 - if a segment's p_filesz is smaller than its p_memsz, the extra bytes 81 between them should always be initialized to 0. 82 83 - ranges do not necessarily start or end at page boundaries. Two distinct 84 segments can have their start and end on the same page. In this case, the 85 page inherits the mapping flags of the latter segment. 86 87 Finally, the real load addrs of each segment is not p_vaddr. Instead the 88 loader decides where to load the first segment, then will load all others 89 relative to the first one to respect the initial range layout. 90 91 For example, consider the following list: 92 93 [ offset:0, filesz:0x4000, memsz:0x4000, vaddr:0x30000 ], 94 [ offset:0x4000, filesz:0x2000, memsz:0x8000, vaddr:0x40000 ], 95 96 This corresponds to two segments that cover these virtual address ranges: 97 98 0x30000...0x34000 99 0x40000...0x48000 100 101 If the loader decides to load the first segment at address 0xa0000000 102 then the segments' load address ranges will be: 103 104 0xa0030000...0xa0034000 105 0xa0040000...0xa0048000 106 107 In other words, all segments must be loaded at an address that has the same 108 constant offset from their p_vaddr value. This offset is computed as the 109 difference between the first segment's load address, and its p_vaddr value. 110 111 However, in practice, segments do _not_ start at page boundaries. Since we 112 can only memory-map at page boundaries, this means that the bias is 113 computed as: 114 115 load_bias = phdr0_load_address - PAGE_START(phdr0->p_vaddr) 116 117 (NOTE: The value must be used as a 32-bit unsigned integer, to deal with 118 possible wrap around UINT32_MAX for possible large p_vaddr values). 119 120 And that the phdr0_load_address must start at a page boundary, with 121 the segment's real content starting at: 122 123 phdr0_load_address + PAGE_OFFSET(phdr0->p_vaddr) 124 125 Note that ELF requires the following condition to make the mmap()-ing work: 126 127 PAGE_OFFSET(phdr0->p_vaddr) == PAGE_OFFSET(phdr0->p_offset) 128 129 The load_bias must be added to any p_vaddr value read from the ELF file to 130 determine the corresponding memory address. 131 132 **/ 133 134 #define MAYBE_MAP_FLAG(x, from, to) (((x) & (from)) ? (to) : 0) 135 #define PFLAGS_TO_PROT(x) (MAYBE_MAP_FLAG((x), PF_X, PROT_EXEC) | \ 136 MAYBE_MAP_FLAG((x), PF_R, PROT_READ) | \ 137 MAYBE_MAP_FLAG((x), PF_W, PROT_WRITE)) 138 139 ElfReader::ElfReader() 140 : did_read_(false), did_load_(false), fd_(-1), file_offset_(0), file_size_(0), phdr_num_(0), 141 phdr_table_(nullptr), shdr_table_(nullptr), shdr_num_(0), dynamic_(nullptr), strtab_(nullptr), 142 strtab_size_(0), load_start_(nullptr), load_size_(0), load_bias_(0), loaded_phdr_(nullptr), 143 mapped_by_caller_(false) { 144 } 145 146 bool ElfReader::Read(const char* name, int fd, off64_t file_offset, off64_t file_size) { 147 CHECK(!did_read_); 148 CHECK(!did_load_); 149 name_ = name; 150 fd_ = fd; 151 file_offset_ = file_offset; 152 file_size_ = file_size; 153 154 if (ReadElfHeader() && 155 VerifyElfHeader() && 156 ReadProgramHeaders() && 157 ReadSectionHeaders() && 158 ReadDynamicSection()) { 159 did_read_ = true; 160 } 161 162 return did_read_; 163 } 164 165 bool ElfReader::Load(const android_dlextinfo* extinfo) { 166 CHECK(did_read_); 167 CHECK(!did_load_); 168 if (ReserveAddressSpace(extinfo) && 169 LoadSegments() && 170 FindPhdr()) { 171 did_load_ = true; 172 } 173 174 return did_load_; 175 } 176 177 const char* ElfReader::get_string(ElfW(Word) index) const { 178 CHECK(strtab_ != nullptr); 179 CHECK(index < strtab_size_); 180 181 return strtab_ + index; 182 } 183 184 bool ElfReader::ReadElfHeader() { 185 ssize_t rc = TEMP_FAILURE_RETRY(pread64(fd_, &header_, sizeof(header_), file_offset_)); 186 if (rc < 0) { 187 DL_ERR("can't read file \"%s\": %s", name_.c_str(), strerror(errno)); 188 return false; 189 } 190 191 if (rc != sizeof(header_)) { 192 DL_ERR("\"%s\" is too small to be an ELF executable: only found %zd bytes", name_.c_str(), 193 static_cast<size_t>(rc)); 194 return false; 195 } 196 return true; 197 } 198 199 bool ElfReader::VerifyElfHeader() { 200 if (memcmp(header_.e_ident, ELFMAG, SELFMAG) != 0) { 201 DL_ERR("\"%s\" has bad ELF magic", name_.c_str()); 202 return false; 203 } 204 205 // Try to give a clear diagnostic for ELF class mismatches, since they're 206 // an easy mistake to make during the 32-bit/64-bit transition period. 207 int elf_class = header_.e_ident[EI_CLASS]; 208 #if defined(__LP64__) 209 if (elf_class != ELFCLASS64) { 210 if (elf_class == ELFCLASS32) { 211 DL_ERR("\"%s\" is 32-bit instead of 64-bit", name_.c_str()); 212 } else { 213 DL_ERR("\"%s\" has unknown ELF class: %d", name_.c_str(), elf_class); 214 } 215 return false; 216 } 217 #else 218 if (elf_class != ELFCLASS32) { 219 if (elf_class == ELFCLASS64) { 220 DL_ERR("\"%s\" is 64-bit instead of 32-bit", name_.c_str()); 221 } else { 222 DL_ERR("\"%s\" has unknown ELF class: %d", name_.c_str(), elf_class); 223 } 224 return false; 225 } 226 #endif 227 228 if (header_.e_ident[EI_DATA] != ELFDATA2LSB) { 229 DL_ERR("\"%s\" not little-endian: %d", name_.c_str(), header_.e_ident[EI_DATA]); 230 return false; 231 } 232 233 if (header_.e_type != ET_DYN) { 234 DL_ERR("\"%s\" has unexpected e_type: %d", name_.c_str(), header_.e_type); 235 return false; 236 } 237 238 if (header_.e_version != EV_CURRENT) { 239 DL_ERR("\"%s\" has unexpected e_version: %d", name_.c_str(), header_.e_version); 240 return false; 241 } 242 243 if (header_.e_machine != GetTargetElfMachine()) { 244 DL_ERR("\"%s\" has unexpected e_machine: %d", name_.c_str(), header_.e_machine); 245 return false; 246 } 247 248 return true; 249 } 250 251 bool ElfReader::CheckFileRange(ElfW(Addr) offset, size_t size, size_t alignment) { 252 off64_t range_start; 253 off64_t range_end; 254 255 return safe_add(&range_start, file_offset_, offset) && 256 safe_add(&range_end, range_start, size) && 257 (range_start < file_size_) && 258 (range_end <= file_size_) && 259 ((offset % alignment) == 0); 260 } 261 262 // Loads the program header table from an ELF file into a read-only private 263 // anonymous mmap-ed block. 264 bool ElfReader::ReadProgramHeaders() { 265 phdr_num_ = header_.e_phnum; 266 267 // Like the kernel, we only accept program header tables that 268 // are smaller than 64KiB. 269 if (phdr_num_ < 1 || phdr_num_ > 65536/sizeof(ElfW(Phdr))) { 270 DL_ERR("\"%s\" has invalid e_phnum: %zd", name_.c_str(), phdr_num_); 271 return false; 272 } 273 274 // Boundary checks 275 size_t size = phdr_num_ * sizeof(ElfW(Phdr)); 276 if (!CheckFileRange(header_.e_phoff, size, alignof(ElfW(Phdr)))) { 277 DL_ERR_AND_LOG("\"%s\" has invalid phdr offset/size: %zu/%zu", 278 name_.c_str(), 279 static_cast<size_t>(header_.e_phoff), 280 size); 281 return false; 282 } 283 284 if (!phdr_fragment_.Map(fd_, file_offset_, header_.e_phoff, size)) { 285 DL_ERR("\"%s\" phdr mmap failed: %s", name_.c_str(), strerror(errno)); 286 return false; 287 } 288 289 phdr_table_ = static_cast<ElfW(Phdr)*>(phdr_fragment_.data()); 290 return true; 291 } 292 293 bool ElfReader::ReadSectionHeaders() { 294 shdr_num_ = header_.e_shnum; 295 296 if (shdr_num_ == 0) { 297 DL_ERR_AND_LOG("\"%s\" has no section headers", name_.c_str()); 298 return false; 299 } 300 301 size_t size = shdr_num_ * sizeof(ElfW(Shdr)); 302 if (!CheckFileRange(header_.e_shoff, size, alignof(const ElfW(Shdr)))) { 303 DL_ERR_AND_LOG("\"%s\" has invalid shdr offset/size: %zu/%zu", 304 name_.c_str(), 305 static_cast<size_t>(header_.e_shoff), 306 size); 307 return false; 308 } 309 310 if (!shdr_fragment_.Map(fd_, file_offset_, header_.e_shoff, size)) { 311 DL_ERR("\"%s\" shdr mmap failed: %s", name_.c_str(), strerror(errno)); 312 return false; 313 } 314 315 shdr_table_ = static_cast<const ElfW(Shdr)*>(shdr_fragment_.data()); 316 return true; 317 } 318 319 bool ElfReader::ReadDynamicSection() { 320 // 1. Find .dynamic section (in section headers) 321 const ElfW(Shdr)* dynamic_shdr = nullptr; 322 for (size_t i = 0; i < shdr_num_; ++i) { 323 if (shdr_table_[i].sh_type == SHT_DYNAMIC) { 324 dynamic_shdr = &shdr_table_ [i]; 325 break; 326 } 327 } 328 329 if (dynamic_shdr == nullptr) { 330 DL_ERR_AND_LOG("\"%s\" .dynamic section header was not found", name_.c_str()); 331 return false; 332 } 333 334 if (dynamic_shdr->sh_link >= shdr_num_) { 335 DL_ERR_AND_LOG("\"%s\" .dynamic section has invalid sh_link: %d", 336 name_.c_str(), 337 dynamic_shdr->sh_link); 338 return false; 339 } 340 341 const ElfW(Shdr)* strtab_shdr = &shdr_table_[dynamic_shdr->sh_link]; 342 343 if (strtab_shdr->sh_type != SHT_STRTAB) { 344 DL_ERR_AND_LOG("\"%s\" .dynamic section has invalid link(%d) sh_type: %d (expected SHT_STRTAB)", 345 name_.c_str(), dynamic_shdr->sh_link, strtab_shdr->sh_type); 346 return false; 347 } 348 349 if (!CheckFileRange(dynamic_shdr->sh_offset, dynamic_shdr->sh_size, alignof(const ElfW(Dyn)))) { 350 DL_ERR_AND_LOG("\"%s\" has invalid offset/size of .dynamic section", name_.c_str()); 351 return false; 352 } 353 354 if (!dynamic_fragment_.Map(fd_, file_offset_, dynamic_shdr->sh_offset, dynamic_shdr->sh_size)) { 355 DL_ERR("\"%s\" dynamic section mmap failed: %s", name_.c_str(), strerror(errno)); 356 return false; 357 } 358 359 dynamic_ = static_cast<const ElfW(Dyn)*>(dynamic_fragment_.data()); 360 361 if (!CheckFileRange(strtab_shdr->sh_offset, strtab_shdr->sh_size, alignof(const char))) { 362 DL_ERR_AND_LOG("\"%s\" has invalid offset/size of the .strtab section linked from .dynamic section", 363 name_.c_str()); 364 return false; 365 } 366 367 if (!strtab_fragment_.Map(fd_, file_offset_, strtab_shdr->sh_offset, strtab_shdr->sh_size)) { 368 DL_ERR("\"%s\" strtab section mmap failed: %s", name_.c_str(), strerror(errno)); 369 return false; 370 } 371 372 strtab_ = static_cast<const char*>(strtab_fragment_.data()); 373 strtab_size_ = strtab_fragment_.size(); 374 return true; 375 } 376 377 /* Returns the size of the extent of all the possibly non-contiguous 378 * loadable segments in an ELF program header table. This corresponds 379 * to the page-aligned size in bytes that needs to be reserved in the 380 * process' address space. If there are no loadable segments, 0 is 381 * returned. 382 * 383 * If out_min_vaddr or out_max_vaddr are not null, they will be 384 * set to the minimum and maximum addresses of pages to be reserved, 385 * or 0 if there is nothing to load. 386 */ 387 size_t phdr_table_get_load_size(const ElfW(Phdr)* phdr_table, size_t phdr_count, 388 ElfW(Addr)* out_min_vaddr, 389 ElfW(Addr)* out_max_vaddr) { 390 ElfW(Addr) min_vaddr = UINTPTR_MAX; 391 ElfW(Addr) max_vaddr = 0; 392 393 bool found_pt_load = false; 394 for (size_t i = 0; i < phdr_count; ++i) { 395 const ElfW(Phdr)* phdr = &phdr_table[i]; 396 397 if (phdr->p_type != PT_LOAD) { 398 continue; 399 } 400 found_pt_load = true; 401 402 if (phdr->p_vaddr < min_vaddr) { 403 min_vaddr = phdr->p_vaddr; 404 } 405 406 if (phdr->p_vaddr + phdr->p_memsz > max_vaddr) { 407 max_vaddr = phdr->p_vaddr + phdr->p_memsz; 408 } 409 } 410 if (!found_pt_load) { 411 min_vaddr = 0; 412 } 413 414 min_vaddr = PAGE_START(min_vaddr); 415 max_vaddr = PAGE_END(max_vaddr); 416 417 if (out_min_vaddr != nullptr) { 418 *out_min_vaddr = min_vaddr; 419 } 420 if (out_max_vaddr != nullptr) { 421 *out_max_vaddr = max_vaddr; 422 } 423 return max_vaddr - min_vaddr; 424 } 425 426 // Reserve a virtual address range big enough to hold all loadable 427 // segments of a program header table. This is done by creating a 428 // private anonymous mmap() with PROT_NONE. 429 bool ElfReader::ReserveAddressSpace(const android_dlextinfo* extinfo) { 430 ElfW(Addr) min_vaddr; 431 load_size_ = phdr_table_get_load_size(phdr_table_, phdr_num_, &min_vaddr); 432 if (load_size_ == 0) { 433 DL_ERR("\"%s\" has no loadable segments", name_.c_str()); 434 return false; 435 } 436 437 uint8_t* addr = reinterpret_cast<uint8_t*>(min_vaddr); 438 void* start; 439 size_t reserved_size = 0; 440 bool reserved_hint = true; 441 bool strict_hint = false; 442 // Assume position independent executable by default. 443 void* mmap_hint = nullptr; 444 445 if (extinfo != nullptr) { 446 if (extinfo->flags & ANDROID_DLEXT_RESERVED_ADDRESS) { 447 reserved_size = extinfo->reserved_size; 448 reserved_hint = false; 449 } else if (extinfo->flags & ANDROID_DLEXT_RESERVED_ADDRESS_HINT) { 450 reserved_size = extinfo->reserved_size; 451 } 452 453 if (addr != nullptr && (extinfo->flags & ANDROID_DLEXT_FORCE_FIXED_VADDR) != 0) { 454 mmap_hint = addr; 455 } else if ((extinfo->flags & ANDROID_DLEXT_LOAD_AT_FIXED_ADDRESS) != 0) { 456 mmap_hint = extinfo->reserved_addr; 457 strict_hint = true; 458 } 459 } 460 461 if (load_size_ > reserved_size) { 462 if (!reserved_hint) { 463 DL_ERR("reserved address space %zd smaller than %zd bytes needed for \"%s\"", 464 reserved_size - load_size_, load_size_, name_.c_str()); 465 return false; 466 } 467 int mmap_flags = MAP_PRIVATE | MAP_ANONYMOUS; 468 start = mmap(mmap_hint, load_size_, PROT_NONE, mmap_flags, -1, 0); 469 if (start == MAP_FAILED) { 470 DL_ERR("couldn't reserve %zd bytes of address space for \"%s\"", load_size_, name_.c_str()); 471 return false; 472 } 473 if (strict_hint && (start != mmap_hint)) { 474 munmap(start, load_size_); 475 DL_ERR("couldn't reserve %zd bytes of address space at %p for \"%s\"", 476 load_size_, mmap_hint, name_.c_str()); 477 return false; 478 } 479 } else { 480 start = extinfo->reserved_addr; 481 mapped_by_caller_ = true; 482 } 483 484 load_start_ = start; 485 load_bias_ = reinterpret_cast<uint8_t*>(start) - addr; 486 return true; 487 } 488 489 bool ElfReader::LoadSegments() { 490 for (size_t i = 0; i < phdr_num_; ++i) { 491 const ElfW(Phdr)* phdr = &phdr_table_[i]; 492 493 if (phdr->p_type != PT_LOAD) { 494 continue; 495 } 496 497 // Segment addresses in memory. 498 ElfW(Addr) seg_start = phdr->p_vaddr + load_bias_; 499 ElfW(Addr) seg_end = seg_start + phdr->p_memsz; 500 501 ElfW(Addr) seg_page_start = PAGE_START(seg_start); 502 ElfW(Addr) seg_page_end = PAGE_END(seg_end); 503 504 ElfW(Addr) seg_file_end = seg_start + phdr->p_filesz; 505 506 // File offsets. 507 ElfW(Addr) file_start = phdr->p_offset; 508 ElfW(Addr) file_end = file_start + phdr->p_filesz; 509 510 ElfW(Addr) file_page_start = PAGE_START(file_start); 511 ElfW(Addr) file_length = file_end - file_page_start; 512 513 if (file_size_ <= 0) { 514 DL_ERR("\"%s\" invalid file size: %" PRId64, name_.c_str(), file_size_); 515 return false; 516 } 517 518 if (file_end > static_cast<size_t>(file_size_)) { 519 DL_ERR("invalid ELF file \"%s\" load segment[%zd]:" 520 " p_offset (%p) + p_filesz (%p) ( = %p) past end of file (0x%" PRIx64 ")", 521 name_.c_str(), i, reinterpret_cast<void*>(phdr->p_offset), 522 reinterpret_cast<void*>(phdr->p_filesz), 523 reinterpret_cast<void*>(file_end), file_size_); 524 return false; 525 } 526 527 if (file_length != 0) { 528 int prot = PFLAGS_TO_PROT(phdr->p_flags); 529 // W + E PT_LOAD segments are not allowed. 530 if ((prot & (PROT_EXEC | PROT_WRITE)) == (PROT_EXEC | PROT_WRITE)) { 531 DL_WARN("\"%s\": has W+E (writable and executable) load segments. " 532 "This is a security risk shared libraries with W+E load segments " 533 "will not be supported in a future Android release. " 534 "Please fix the library.", name_.c_str()); 535 } 536 537 void* seg_addr = mmap64(reinterpret_cast<void*>(seg_page_start), 538 file_length, 539 prot, 540 MAP_FIXED|MAP_PRIVATE, 541 fd_, 542 file_offset_ + file_page_start); 543 if (seg_addr == MAP_FAILED) { 544 DL_ERR("couldn't map \"%s\" segment %zd: %s", name_.c_str(), i, strerror(errno)); 545 return false; 546 } 547 } 548 549 // if the segment is writable, and does not end on a page boundary, 550 // zero-fill it until the page limit. 551 if ((phdr->p_flags & PF_W) != 0 && PAGE_OFFSET(seg_file_end) > 0) { 552 memset(reinterpret_cast<void*>(seg_file_end), 0, PAGE_SIZE - PAGE_OFFSET(seg_file_end)); 553 } 554 555 seg_file_end = PAGE_END(seg_file_end); 556 557 // seg_file_end is now the first page address after the file 558 // content. If seg_end is larger, we need to zero anything 559 // between them. This is done by using a private anonymous 560 // map for all extra pages. 561 if (seg_page_end > seg_file_end) { 562 size_t zeromap_size = seg_page_end - seg_file_end; 563 void* zeromap = mmap(reinterpret_cast<void*>(seg_file_end), 564 zeromap_size, 565 PFLAGS_TO_PROT(phdr->p_flags), 566 MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE, 567 -1, 568 0); 569 if (zeromap == MAP_FAILED) { 570 DL_ERR("couldn't zero fill \"%s\" gap: %s", name_.c_str(), strerror(errno)); 571 return false; 572 } 573 574 prctl(PR_SET_VMA, PR_SET_VMA_ANON_NAME, zeromap, zeromap_size, ".bss"); 575 } 576 } 577 return true; 578 } 579 580 /* Used internally. Used to set the protection bits of all loaded segments 581 * with optional extra flags (i.e. really PROT_WRITE). Used by 582 * phdr_table_protect_segments and phdr_table_unprotect_segments. 583 */ 584 static int _phdr_table_set_load_prot(const ElfW(Phdr)* phdr_table, size_t phdr_count, 585 ElfW(Addr) load_bias, int extra_prot_flags) { 586 const ElfW(Phdr)* phdr = phdr_table; 587 const ElfW(Phdr)* phdr_limit = phdr + phdr_count; 588 589 for (; phdr < phdr_limit; phdr++) { 590 if (phdr->p_type != PT_LOAD || (phdr->p_flags & PF_W) != 0) { 591 continue; 592 } 593 594 ElfW(Addr) seg_page_start = PAGE_START(phdr->p_vaddr) + load_bias; 595 ElfW(Addr) seg_page_end = PAGE_END(phdr->p_vaddr + phdr->p_memsz) + load_bias; 596 597 int prot = PFLAGS_TO_PROT(phdr->p_flags); 598 if ((extra_prot_flags & PROT_WRITE) != 0) { 599 // make sure we're never simultaneously writable / executable 600 prot &= ~PROT_EXEC; 601 } 602 603 int ret = mprotect(reinterpret_cast<void*>(seg_page_start), 604 seg_page_end - seg_page_start, 605 prot | extra_prot_flags); 606 if (ret < 0) { 607 return -1; 608 } 609 } 610 return 0; 611 } 612 613 /* Restore the original protection modes for all loadable segments. 614 * You should only call this after phdr_table_unprotect_segments and 615 * applying all relocations. 616 * 617 * Input: 618 * phdr_table -> program header table 619 * phdr_count -> number of entries in tables 620 * load_bias -> load bias 621 * Return: 622 * 0 on error, -1 on failure (error code in errno). 623 */ 624 int phdr_table_protect_segments(const ElfW(Phdr)* phdr_table, 625 size_t phdr_count, ElfW(Addr) load_bias) { 626 return _phdr_table_set_load_prot(phdr_table, phdr_count, load_bias, 0); 627 } 628 629 /* Change the protection of all loaded segments in memory to writable. 630 * This is useful before performing relocations. Once completed, you 631 * will have to call phdr_table_protect_segments to restore the original 632 * protection flags on all segments. 633 * 634 * Note that some writable segments can also have their content turned 635 * to read-only by calling phdr_table_protect_gnu_relro. This is no 636 * performed here. 637 * 638 * Input: 639 * phdr_table -> program header table 640 * phdr_count -> number of entries in tables 641 * load_bias -> load bias 642 * Return: 643 * 0 on error, -1 on failure (error code in errno). 644 */ 645 int phdr_table_unprotect_segments(const ElfW(Phdr)* phdr_table, 646 size_t phdr_count, ElfW(Addr) load_bias) { 647 return _phdr_table_set_load_prot(phdr_table, phdr_count, load_bias, PROT_WRITE); 648 } 649 650 /* Used internally by phdr_table_protect_gnu_relro and 651 * phdr_table_unprotect_gnu_relro. 652 */ 653 static int _phdr_table_set_gnu_relro_prot(const ElfW(Phdr)* phdr_table, size_t phdr_count, 654 ElfW(Addr) load_bias, int prot_flags) { 655 const ElfW(Phdr)* phdr = phdr_table; 656 const ElfW(Phdr)* phdr_limit = phdr + phdr_count; 657 658 for (phdr = phdr_table; phdr < phdr_limit; phdr++) { 659 if (phdr->p_type != PT_GNU_RELRO) { 660 continue; 661 } 662 663 // Tricky: what happens when the relro segment does not start 664 // or end at page boundaries? We're going to be over-protective 665 // here and put every page touched by the segment as read-only. 666 667 // This seems to match Ian Lance Taylor's description of the 668 // feature at http://www.airs.com/blog/archives/189. 669 670 // Extract: 671 // Note that the current dynamic linker code will only work 672 // correctly if the PT_GNU_RELRO segment starts on a page 673 // boundary. This is because the dynamic linker rounds the 674 // p_vaddr field down to the previous page boundary. If 675 // there is anything on the page which should not be read-only, 676 // the program is likely to fail at runtime. So in effect the 677 // linker must only emit a PT_GNU_RELRO segment if it ensures 678 // that it starts on a page boundary. 679 ElfW(Addr) seg_page_start = PAGE_START(phdr->p_vaddr) + load_bias; 680 ElfW(Addr) seg_page_end = PAGE_END(phdr->p_vaddr + phdr->p_memsz) + load_bias; 681 682 int ret = mprotect(reinterpret_cast<void*>(seg_page_start), 683 seg_page_end - seg_page_start, 684 prot_flags); 685 if (ret < 0) { 686 return -1; 687 } 688 } 689 return 0; 690 } 691 692 /* Apply GNU relro protection if specified by the program header. This will 693 * turn some of the pages of a writable PT_LOAD segment to read-only, as 694 * specified by one or more PT_GNU_RELRO segments. This must be always 695 * performed after relocations. 696 * 697 * The areas typically covered are .got and .data.rel.ro, these are 698 * read-only from the program's POV, but contain absolute addresses 699 * that need to be relocated before use. 700 * 701 * Input: 702 * phdr_table -> program header table 703 * phdr_count -> number of entries in tables 704 * load_bias -> load bias 705 * Return: 706 * 0 on error, -1 on failure (error code in errno). 707 */ 708 int phdr_table_protect_gnu_relro(const ElfW(Phdr)* phdr_table, 709 size_t phdr_count, ElfW(Addr) load_bias) { 710 return _phdr_table_set_gnu_relro_prot(phdr_table, phdr_count, load_bias, PROT_READ); 711 } 712 713 /* Serialize the GNU relro segments to the given file descriptor. This can be 714 * performed after relocations to allow another process to later share the 715 * relocated segment, if it was loaded at the same address. 716 * 717 * Input: 718 * phdr_table -> program header table 719 * phdr_count -> number of entries in tables 720 * load_bias -> load bias 721 * fd -> writable file descriptor to use 722 * Return: 723 * 0 on error, -1 on failure (error code in errno). 724 */ 725 int phdr_table_serialize_gnu_relro(const ElfW(Phdr)* phdr_table, 726 size_t phdr_count, 727 ElfW(Addr) load_bias, 728 int fd) { 729 const ElfW(Phdr)* phdr = phdr_table; 730 const ElfW(Phdr)* phdr_limit = phdr + phdr_count; 731 ssize_t file_offset = 0; 732 733 for (phdr = phdr_table; phdr < phdr_limit; phdr++) { 734 if (phdr->p_type != PT_GNU_RELRO) { 735 continue; 736 } 737 738 ElfW(Addr) seg_page_start = PAGE_START(phdr->p_vaddr) + load_bias; 739 ElfW(Addr) seg_page_end = PAGE_END(phdr->p_vaddr + phdr->p_memsz) + load_bias; 740 ssize_t size = seg_page_end - seg_page_start; 741 742 ssize_t written = TEMP_FAILURE_RETRY(write(fd, reinterpret_cast<void*>(seg_page_start), size)); 743 if (written != size) { 744 return -1; 745 } 746 void* map = mmap(reinterpret_cast<void*>(seg_page_start), size, PROT_READ, 747 MAP_PRIVATE|MAP_FIXED, fd, file_offset); 748 if (map == MAP_FAILED) { 749 return -1; 750 } 751 file_offset += size; 752 } 753 return 0; 754 } 755 756 /* Where possible, replace the GNU relro segments with mappings of the given 757 * file descriptor. This can be performed after relocations to allow a file 758 * previously created by phdr_table_serialize_gnu_relro in another process to 759 * replace the dirty relocated pages, saving memory, if it was loaded at the 760 * same address. We have to compare the data before we map over it, since some 761 * parts of the relro segment may not be identical due to other libraries in 762 * the process being loaded at different addresses. 763 * 764 * Input: 765 * phdr_table -> program header table 766 * phdr_count -> number of entries in tables 767 * load_bias -> load bias 768 * fd -> readable file descriptor to use 769 * Return: 770 * 0 on error, -1 on failure (error code in errno). 771 */ 772 int phdr_table_map_gnu_relro(const ElfW(Phdr)* phdr_table, 773 size_t phdr_count, 774 ElfW(Addr) load_bias, 775 int fd) { 776 // Map the file at a temporary location so we can compare its contents. 777 struct stat file_stat; 778 if (TEMP_FAILURE_RETRY(fstat(fd, &file_stat)) != 0) { 779 return -1; 780 } 781 off_t file_size = file_stat.st_size; 782 void* temp_mapping = nullptr; 783 if (file_size > 0) { 784 temp_mapping = mmap(nullptr, file_size, PROT_READ, MAP_PRIVATE, fd, 0); 785 if (temp_mapping == MAP_FAILED) { 786 return -1; 787 } 788 } 789 size_t file_offset = 0; 790 791 // Iterate over the relro segments and compare/remap the pages. 792 const ElfW(Phdr)* phdr = phdr_table; 793 const ElfW(Phdr)* phdr_limit = phdr + phdr_count; 794 795 for (phdr = phdr_table; phdr < phdr_limit; phdr++) { 796 if (phdr->p_type != PT_GNU_RELRO) { 797 continue; 798 } 799 800 ElfW(Addr) seg_page_start = PAGE_START(phdr->p_vaddr) + load_bias; 801 ElfW(Addr) seg_page_end = PAGE_END(phdr->p_vaddr + phdr->p_memsz) + load_bias; 802 803 char* file_base = static_cast<char*>(temp_mapping) + file_offset; 804 char* mem_base = reinterpret_cast<char*>(seg_page_start); 805 size_t match_offset = 0; 806 size_t size = seg_page_end - seg_page_start; 807 808 if (file_size - file_offset < size) { 809 // File is too short to compare to this segment. The contents are likely 810 // different as well (it's probably for a different library version) so 811 // just don't bother checking. 812 break; 813 } 814 815 while (match_offset < size) { 816 // Skip over dissimilar pages. 817 while (match_offset < size && 818 memcmp(mem_base + match_offset, file_base + match_offset, PAGE_SIZE) != 0) { 819 match_offset += PAGE_SIZE; 820 } 821 822 // Count similar pages. 823 size_t mismatch_offset = match_offset; 824 while (mismatch_offset < size && 825 memcmp(mem_base + mismatch_offset, file_base + mismatch_offset, PAGE_SIZE) == 0) { 826 mismatch_offset += PAGE_SIZE; 827 } 828 829 // Map over similar pages. 830 if (mismatch_offset > match_offset) { 831 void* map = mmap(mem_base + match_offset, mismatch_offset - match_offset, 832 PROT_READ, MAP_PRIVATE|MAP_FIXED, fd, match_offset); 833 if (map == MAP_FAILED) { 834 munmap(temp_mapping, file_size); 835 return -1; 836 } 837 } 838 839 match_offset = mismatch_offset; 840 } 841 842 // Add to the base file offset in case there are multiple relro segments. 843 file_offset += size; 844 } 845 munmap(temp_mapping, file_size); 846 return 0; 847 } 848 849 850 #if defined(__arm__) 851 852 # ifndef PT_ARM_EXIDX 853 # define PT_ARM_EXIDX 0x70000001 /* .ARM.exidx segment */ 854 # endif 855 856 /* Return the address and size of the .ARM.exidx section in memory, 857 * if present. 858 * 859 * Input: 860 * phdr_table -> program header table 861 * phdr_count -> number of entries in tables 862 * load_bias -> load bias 863 * Output: 864 * arm_exidx -> address of table in memory (null on failure). 865 * arm_exidx_count -> number of items in table (0 on failure). 866 * Return: 867 * 0 on error, -1 on failure (_no_ error code in errno) 868 */ 869 int phdr_table_get_arm_exidx(const ElfW(Phdr)* phdr_table, size_t phdr_count, 870 ElfW(Addr) load_bias, 871 ElfW(Addr)** arm_exidx, size_t* arm_exidx_count) { 872 const ElfW(Phdr)* phdr = phdr_table; 873 const ElfW(Phdr)* phdr_limit = phdr + phdr_count; 874 875 for (phdr = phdr_table; phdr < phdr_limit; phdr++) { 876 if (phdr->p_type != PT_ARM_EXIDX) { 877 continue; 878 } 879 880 *arm_exidx = reinterpret_cast<ElfW(Addr)*>(load_bias + phdr->p_vaddr); 881 *arm_exidx_count = phdr->p_memsz / 8; 882 return 0; 883 } 884 *arm_exidx = nullptr; 885 *arm_exidx_count = 0; 886 return -1; 887 } 888 #endif 889 890 /* Return the address and size of the ELF file's .dynamic section in memory, 891 * or null if missing. 892 * 893 * Input: 894 * phdr_table -> program header table 895 * phdr_count -> number of entries in tables 896 * load_bias -> load bias 897 * Output: 898 * dynamic -> address of table in memory (null on failure). 899 * dynamic_flags -> protection flags for section (unset on failure) 900 * Return: 901 * void 902 */ 903 void phdr_table_get_dynamic_section(const ElfW(Phdr)* phdr_table, size_t phdr_count, 904 ElfW(Addr) load_bias, ElfW(Dyn)** dynamic, 905 ElfW(Word)* dynamic_flags) { 906 *dynamic = nullptr; 907 for (size_t i = 0; i<phdr_count; ++i) { 908 const ElfW(Phdr)& phdr = phdr_table[i]; 909 if (phdr.p_type == PT_DYNAMIC) { 910 *dynamic = reinterpret_cast<ElfW(Dyn)*>(load_bias + phdr.p_vaddr); 911 if (dynamic_flags) { 912 *dynamic_flags = phdr.p_flags; 913 } 914 return; 915 } 916 } 917 } 918 919 /* Return the program interpreter string, or nullptr if missing. 920 * 921 * Input: 922 * phdr_table -> program header table 923 * phdr_count -> number of entries in tables 924 * load_bias -> load bias 925 * Return: 926 * pointer to the program interpreter string. 927 */ 928 const char* phdr_table_get_interpreter_name(const ElfW(Phdr) * phdr_table, size_t phdr_count, 929 ElfW(Addr) load_bias) { 930 for (size_t i = 0; i<phdr_count; ++i) { 931 const ElfW(Phdr)& phdr = phdr_table[i]; 932 if (phdr.p_type == PT_INTERP) { 933 return reinterpret_cast<const char*>(load_bias + phdr.p_vaddr); 934 } 935 } 936 return nullptr; 937 } 938 939 // Sets loaded_phdr_ to the address of the program header table as it appears 940 // in the loaded segments in memory. This is in contrast with phdr_table_, 941 // which is temporary and will be released before the library is relocated. 942 bool ElfReader::FindPhdr() { 943 const ElfW(Phdr)* phdr_limit = phdr_table_ + phdr_num_; 944 945 // If there is a PT_PHDR, use it directly. 946 for (const ElfW(Phdr)* phdr = phdr_table_; phdr < phdr_limit; ++phdr) { 947 if (phdr->p_type == PT_PHDR) { 948 return CheckPhdr(load_bias_ + phdr->p_vaddr); 949 } 950 } 951 952 // Otherwise, check the first loadable segment. If its file offset 953 // is 0, it starts with the ELF header, and we can trivially find the 954 // loaded program header from it. 955 for (const ElfW(Phdr)* phdr = phdr_table_; phdr < phdr_limit; ++phdr) { 956 if (phdr->p_type == PT_LOAD) { 957 if (phdr->p_offset == 0) { 958 ElfW(Addr) elf_addr = load_bias_ + phdr->p_vaddr; 959 const ElfW(Ehdr)* ehdr = reinterpret_cast<const ElfW(Ehdr)*>(elf_addr); 960 ElfW(Addr) offset = ehdr->e_phoff; 961 return CheckPhdr(reinterpret_cast<ElfW(Addr)>(ehdr) + offset); 962 } 963 break; 964 } 965 } 966 967 DL_ERR("can't find loaded phdr for \"%s\"", name_.c_str()); 968 return false; 969 } 970 971 // Ensures that our program header is actually within a loadable 972 // segment. This should help catch badly-formed ELF files that 973 // would cause the linker to crash later when trying to access it. 974 bool ElfReader::CheckPhdr(ElfW(Addr) loaded) { 975 const ElfW(Phdr)* phdr_limit = phdr_table_ + phdr_num_; 976 ElfW(Addr) loaded_end = loaded + (phdr_num_ * sizeof(ElfW(Phdr))); 977 for (const ElfW(Phdr)* phdr = phdr_table_; phdr < phdr_limit; ++phdr) { 978 if (phdr->p_type != PT_LOAD) { 979 continue; 980 } 981 ElfW(Addr) seg_start = phdr->p_vaddr + load_bias_; 982 ElfW(Addr) seg_end = phdr->p_filesz + seg_start; 983 if (seg_start <= loaded && loaded_end <= seg_end) { 984 loaded_phdr_ = reinterpret_cast<const ElfW(Phdr)*>(loaded); 985 return true; 986 } 987 } 988 DL_ERR("\"%s\" loaded phdr %p not in loadable segment", 989 name_.c_str(), reinterpret_cast<void*>(loaded)); 990 return false; 991 } 992