1 /* 2 * Copyright (C) 2016 The Android Open Source Project 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * * Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * * Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in 12 * the documentation and/or other materials provided with the 13 * distribution. 14 * 15 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 16 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 17 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 18 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 19 * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 21 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS 22 * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED 23 * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, 24 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT 25 * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26 * SUCH DAMAGE. 27 */ 28 29 #include "linker_main.h" 30 31 #include "linker_debug.h" 32 #include "linker_cfi.h" 33 #include "linker_gdb_support.h" 34 #include "linker_globals.h" 35 #include "linker_phdr.h" 36 #include "linker_utils.h" 37 38 #include "private/bionic_globals.h" 39 #include "private/bionic_tls.h" 40 #include "private/KernelArgumentBlock.h" 41 42 #include "android-base/strings.h" 43 #include "android-base/stringprintf.h" 44 #ifdef __ANDROID__ 45 #include "debuggerd/handler.h" 46 #endif 47 48 #include <vector> 49 50 extern void __libc_init_globals(KernelArgumentBlock&); 51 extern void __libc_init_AT_SECURE(KernelArgumentBlock&); 52 53 extern "C" void _start(); 54 55 static ElfW(Addr) get_elf_exec_load_bias(const ElfW(Ehdr)* elf); 56 57 // These should be preserved static to avoid emitting 58 // RELATIVE relocations for the part of the code running 59 // before linker links itself. 60 61 // TODO (dimtiry): remove somain, rename solist to solist_head 62 static soinfo* solist; 63 static soinfo* sonext; 64 static soinfo* somain; // main process, always the one after libdl_info 65 66 void solist_add_soinfo(soinfo* si) { 67 sonext->next = si; 68 sonext = si; 69 } 70 71 bool solist_remove_soinfo(soinfo* si) { 72 soinfo *prev = nullptr, *trav; 73 for (trav = solist; trav != nullptr; trav = trav->next) { 74 if (trav == si) { 75 break; 76 } 77 prev = trav; 78 } 79 80 if (trav == nullptr) { 81 // si was not in solist 82 PRINT("name \"%s\"@%p is not in solist!", si->get_realpath(), si); 83 return false; 84 } 85 86 // prev will never be null, because the first entry in solist is 87 // always the static libdl_info. 88 prev->next = si->next; 89 if (si == sonext) { 90 sonext = prev; 91 } 92 93 return true; 94 } 95 96 soinfo* solist_get_head() { 97 return solist; 98 } 99 100 soinfo* solist_get_somain() { 101 return somain; 102 } 103 104 int g_ld_debug_verbosity; 105 abort_msg_t* g_abort_message = nullptr; // For debuggerd. 106 107 static std::vector<std::string> g_ld_preload_names; 108 109 static std::vector<soinfo*> g_ld_preloads; 110 111 static void parse_path(const char* path, const char* delimiters, 112 std::vector<std::string>* resolved_paths) { 113 std::vector<std::string> paths; 114 split_path(path, delimiters, &paths); 115 resolve_paths(paths, resolved_paths); 116 } 117 118 static void parse_LD_LIBRARY_PATH(const char* path) { 119 std::vector<std::string> ld_libary_paths; 120 parse_path(path, ":", &ld_libary_paths); 121 g_default_namespace.set_ld_library_paths(std::move(ld_libary_paths)); 122 } 123 124 static void parse_LD_PRELOAD(const char* path) { 125 g_ld_preload_names.clear(); 126 if (path != nullptr) { 127 // We have historically supported ':' as well as ' ' in LD_PRELOAD. 128 g_ld_preload_names = android::base::Split(path, " :"); 129 std::remove_if(g_ld_preload_names.begin(), 130 g_ld_preload_names.end(), 131 [] (const std::string& s) { return s.empty(); }); 132 } 133 } 134 135 // An empty list of soinfos 136 static soinfo_list_t g_empty_list; 137 138 static void add_vdso(KernelArgumentBlock& args __unused) { 139 #if defined(AT_SYSINFO_EHDR) 140 ElfW(Ehdr)* ehdr_vdso = reinterpret_cast<ElfW(Ehdr)*>(args.getauxval(AT_SYSINFO_EHDR)); 141 if (ehdr_vdso == nullptr) { 142 return; 143 } 144 145 soinfo* si = soinfo_alloc(&g_default_namespace, "[vdso]", nullptr, 0, 0); 146 147 si->phdr = reinterpret_cast<ElfW(Phdr)*>(reinterpret_cast<char*>(ehdr_vdso) + ehdr_vdso->e_phoff); 148 si->phnum = ehdr_vdso->e_phnum; 149 si->base = reinterpret_cast<ElfW(Addr)>(ehdr_vdso); 150 si->size = phdr_table_get_load_size(si->phdr, si->phnum); 151 si->load_bias = get_elf_exec_load_bias(ehdr_vdso); 152 153 si->prelink_image(); 154 si->link_image(g_empty_list, soinfo_list_t::make_list(si), nullptr); 155 #endif 156 } 157 158 /* gdb expects the linker to be in the debug shared object list. 159 * Without this, gdb has trouble locating the linker's ".text" 160 * and ".plt" sections. Gdb could also potentially use this to 161 * relocate the offset of our exported 'rtld_db_dlactivity' symbol. 162 * Note that the linker shouldn't be on the soinfo list. 163 */ 164 static void init_linker_info_for_gdb(ElfW(Addr) linker_base, char* linker_path) { 165 static link_map linker_link_map_for_gdb; 166 167 linker_link_map_for_gdb.l_addr = linker_base; 168 linker_link_map_for_gdb.l_name = linker_path; 169 170 /* 171 * Set the dynamic field in the link map otherwise gdb will complain with 172 * the following: 173 * warning: .dynamic section for "/system/bin/linker" is not at the 174 * expected address (wrong library or version mismatch?) 175 */ 176 ElfW(Ehdr)* elf_hdr = reinterpret_cast<ElfW(Ehdr)*>(linker_base); 177 ElfW(Phdr)* phdr = reinterpret_cast<ElfW(Phdr)*>(linker_base + elf_hdr->e_phoff); 178 phdr_table_get_dynamic_section(phdr, elf_hdr->e_phnum, linker_base, 179 &linker_link_map_for_gdb.l_ld, nullptr); 180 181 insert_link_map_into_debug_map(&linker_link_map_for_gdb); 182 } 183 184 extern "C" int __system_properties_init(void); 185 186 static const char* get_executable_path() { 187 static std::string executable_path; 188 if (executable_path.empty()) { 189 char path[PATH_MAX]; 190 ssize_t path_len = readlink("/proc/self/exe", path, sizeof(path)); 191 if (path_len == -1 || path_len >= static_cast<ssize_t>(sizeof(path))) { 192 __libc_fatal("readlink('/proc/self/exe') failed: %s", strerror(errno)); 193 } 194 executable_path = std::string(path, path_len); 195 } 196 197 return executable_path.c_str(); 198 } 199 200 #if defined(__LP64__) 201 static char kLinkerPath[] = "/system/bin/linker64"; 202 #else 203 static char kLinkerPath[] = "/system/bin/linker"; 204 #endif 205 206 /* 207 * This code is called after the linker has linked itself and 208 * fixed it's own GOT. It is safe to make references to externs 209 * and other non-local data at this point. 210 */ 211 static ElfW(Addr) __linker_init_post_relocation(KernelArgumentBlock& args, ElfW(Addr) linker_base) { 212 ProtectedDataGuard guard; 213 214 #if TIMING 215 struct timeval t0, t1; 216 gettimeofday(&t0, 0); 217 #endif 218 219 // Sanitize the environment. 220 __libc_init_AT_SECURE(args); 221 222 // Initialize system properties 223 __system_properties_init(); // may use 'environ' 224 225 // Register the debuggerd signal handler. 226 #ifdef __ANDROID__ 227 debuggerd_callbacks_t callbacks = { 228 .get_abort_message = []() { 229 return g_abort_message; 230 }, 231 .post_dump = ¬ify_gdb_of_libraries, 232 }; 233 debuggerd_init(&callbacks); 234 #endif 235 236 g_linker_logger.ResetState(); 237 238 // Get a few environment variables. 239 const char* LD_DEBUG = getenv("LD_DEBUG"); 240 if (LD_DEBUG != nullptr) { 241 g_ld_debug_verbosity = atoi(LD_DEBUG); 242 } 243 244 #if defined(__LP64__) 245 INFO("[ Android dynamic linker (64-bit) ]"); 246 #else 247 INFO("[ Android dynamic linker (32-bit) ]"); 248 #endif 249 250 // These should have been sanitized by __libc_init_AT_SECURE, but the test 251 // doesn't cost us anything. 252 const char* ldpath_env = nullptr; 253 const char* ldpreload_env = nullptr; 254 if (!getauxval(AT_SECURE)) { 255 ldpath_env = getenv("LD_LIBRARY_PATH"); 256 if (ldpath_env != nullptr) { 257 INFO("[ LD_LIBRARY_PATH set to \"%s\" ]", ldpath_env); 258 } 259 ldpreload_env = getenv("LD_PRELOAD"); 260 if (ldpreload_env != nullptr) { 261 INFO("[ LD_PRELOAD set to \"%s\" ]", ldpreload_env); 262 } 263 } 264 265 struct stat file_stat; 266 // Stat "/proc/self/exe" instead of executable_path because 267 // the executable could be unlinked by this point and it should 268 // not cause a crash (see http://b/31084669) 269 if (TEMP_FAILURE_RETRY(stat("/proc/self/exe", &file_stat)) != 0) { 270 __libc_fatal("unable to stat \"/proc/self/exe\": %s", strerror(errno)); 271 } 272 273 const char* executable_path = get_executable_path(); 274 soinfo* si = soinfo_alloc(&g_default_namespace, executable_path, &file_stat, 0, RTLD_GLOBAL); 275 if (si == nullptr) { 276 __libc_fatal("Couldn't allocate soinfo: out of memory?"); 277 } 278 279 /* bootstrap the link map, the main exe always needs to be first */ 280 si->set_main_executable(); 281 link_map* map = &(si->link_map_head); 282 283 // Register the main executable and the linker upfront to have 284 // gdb aware of them before loading the rest of the dependency 285 // tree. 286 map->l_addr = 0; 287 map->l_name = const_cast<char*>(executable_path); 288 insert_link_map_into_debug_map(map); 289 init_linker_info_for_gdb(linker_base, kLinkerPath); 290 291 // Extract information passed from the kernel. 292 si->phdr = reinterpret_cast<ElfW(Phdr)*>(args.getauxval(AT_PHDR)); 293 si->phnum = args.getauxval(AT_PHNUM); 294 295 /* Compute the value of si->base. We can't rely on the fact that 296 * the first entry is the PHDR because this will not be true 297 * for certain executables (e.g. some in the NDK unit test suite) 298 */ 299 si->base = 0; 300 si->size = phdr_table_get_load_size(si->phdr, si->phnum); 301 si->load_bias = 0; 302 for (size_t i = 0; i < si->phnum; ++i) { 303 if (si->phdr[i].p_type == PT_PHDR) { 304 si->load_bias = reinterpret_cast<ElfW(Addr)>(si->phdr) - si->phdr[i].p_vaddr; 305 si->base = reinterpret_cast<ElfW(Addr)>(si->phdr) - si->phdr[i].p_offset; 306 break; 307 } 308 } 309 si->dynamic = nullptr; 310 311 ElfW(Ehdr)* elf_hdr = reinterpret_cast<ElfW(Ehdr)*>(si->base); 312 313 // We haven't supported non-PIE since Lollipop for security reasons. 314 if (elf_hdr->e_type != ET_DYN) { 315 // We don't use __libc_fatal here because we don't want a tombstone: it's 316 // been several years now but we still find ourselves on app compatibility 317 // investigations because some app's trying to launch an executable that 318 // hasn't worked in at least three years, and we've "helpfully" dropped a 319 // tombstone for them. The tombstone never provided any detail relevant to 320 // fixing the problem anyway, and the utility of drawing extra attention 321 // to the problem is non-existent at this late date. 322 __libc_format_fd(STDERR_FILENO, 323 "\"%s\": error: Android 5.0 and later only support " 324 "position-independent executables (-fPIE).\n", 325 g_argv[0]); 326 exit(EXIT_FAILURE); 327 } 328 329 // Use LD_LIBRARY_PATH and LD_PRELOAD (but only if we aren't setuid/setgid). 330 parse_LD_LIBRARY_PATH(ldpath_env); 331 parse_LD_PRELOAD(ldpreload_env); 332 333 somain = si; 334 335 init_default_namespace(executable_path); 336 337 if (!si->prelink_image()) { 338 __libc_fatal("CANNOT LINK EXECUTABLE \"%s\": %s", g_argv[0], linker_get_error_buffer()); 339 } 340 341 // add somain to global group 342 si->set_dt_flags_1(si->get_dt_flags_1() | DF_1_GLOBAL); 343 344 // Load ld_preloads and dependencies. 345 std::vector<const char*> needed_library_name_list; 346 size_t ld_preloads_count = 0; 347 348 for (const auto& ld_preload_name : g_ld_preload_names) { 349 needed_library_name_list.push_back(ld_preload_name.c_str()); 350 ++ld_preloads_count; 351 } 352 353 for_each_dt_needed(si, [&](const char* name) { 354 needed_library_name_list.push_back(name); 355 }); 356 357 const char** needed_library_names = &needed_library_name_list[0]; 358 size_t needed_libraries_count = needed_library_name_list.size(); 359 360 if (needed_libraries_count > 0 && 361 !find_libraries(&g_default_namespace, 362 si, 363 needed_library_names, 364 needed_libraries_count, 365 nullptr, 366 &g_ld_preloads, 367 ld_preloads_count, 368 RTLD_GLOBAL, 369 nullptr, 370 true /* add_as_children */, 371 true /* search_linked_namespaces */)) { 372 __libc_fatal("CANNOT LINK EXECUTABLE \"%s\": %s", g_argv[0], linker_get_error_buffer()); 373 } else if (needed_libraries_count == 0) { 374 if (!si->link_image(g_empty_list, soinfo_list_t::make_list(si), nullptr)) { 375 __libc_fatal("CANNOT LINK EXECUTABLE \"%s\": %s", g_argv[0], linker_get_error_buffer()); 376 } 377 si->increment_ref_count(); 378 } 379 380 add_vdso(args); 381 382 if (!get_cfi_shadow()->InitialLinkDone(solist)) { 383 __libc_fatal("CANNOT LINK EXECUTABLE \"%s\": %s", g_argv[0], linker_get_error_buffer()); 384 } 385 386 si->call_pre_init_constructors(); 387 388 /* After the prelink_image, the si->load_bias is initialized. 389 * For so lib, the map->l_addr will be updated in notify_gdb_of_load. 390 * We need to update this value for so exe here. So Unwind_Backtrace 391 * for some arch like x86 could work correctly within so exe. 392 */ 393 map->l_addr = si->load_bias; 394 si->call_constructors(); 395 396 #if TIMING 397 gettimeofday(&t1, nullptr); 398 PRINT("LINKER TIME: %s: %d microseconds", g_argv[0], (int) ( 399 (((long long)t1.tv_sec * 1000000LL) + (long long)t1.tv_usec) - 400 (((long long)t0.tv_sec * 1000000LL) + (long long)t0.tv_usec))); 401 #endif 402 #if STATS 403 PRINT("RELO STATS: %s: %d abs, %d rel, %d copy, %d symbol", g_argv[0], 404 linker_stats.count[kRelocAbsolute], 405 linker_stats.count[kRelocRelative], 406 linker_stats.count[kRelocCopy], 407 linker_stats.count[kRelocSymbol]); 408 #endif 409 #if COUNT_PAGES 410 { 411 unsigned n; 412 unsigned i; 413 unsigned count = 0; 414 for (n = 0; n < 4096; n++) { 415 if (bitmask[n]) { 416 unsigned x = bitmask[n]; 417 #if defined(__LP64__) 418 for (i = 0; i < 32; i++) { 419 #else 420 for (i = 0; i < 8; i++) { 421 #endif 422 if (x & 1) { 423 count++; 424 } 425 x >>= 1; 426 } 427 } 428 } 429 PRINT("PAGES MODIFIED: %s: %d (%dKB)", g_argv[0], count, count * 4); 430 } 431 #endif 432 433 #if TIMING || STATS || COUNT_PAGES 434 fflush(stdout); 435 #endif 436 437 ElfW(Addr) entry = args.getauxval(AT_ENTRY); 438 TRACE("[ Ready to execute \"%s\" @ %p ]", si->get_realpath(), reinterpret_cast<void*>(entry)); 439 return entry; 440 } 441 442 /* Compute the load-bias of an existing executable. This shall only 443 * be used to compute the load bias of an executable or shared library 444 * that was loaded by the kernel itself. 445 * 446 * Input: 447 * elf -> address of ELF header, assumed to be at the start of the file. 448 * Return: 449 * load bias, i.e. add the value of any p_vaddr in the file to get 450 * the corresponding address in memory. 451 */ 452 static ElfW(Addr) get_elf_exec_load_bias(const ElfW(Ehdr)* elf) { 453 ElfW(Addr) offset = elf->e_phoff; 454 const ElfW(Phdr)* phdr_table = 455 reinterpret_cast<const ElfW(Phdr)*>(reinterpret_cast<uintptr_t>(elf) + offset); 456 const ElfW(Phdr)* phdr_end = phdr_table + elf->e_phnum; 457 458 for (const ElfW(Phdr)* phdr = phdr_table; phdr < phdr_end; phdr++) { 459 if (phdr->p_type == PT_LOAD) { 460 return reinterpret_cast<ElfW(Addr)>(elf) + phdr->p_offset - phdr->p_vaddr; 461 } 462 } 463 return 0; 464 } 465 466 static void __linker_cannot_link(const char* argv0) { 467 __libc_fatal("CANNOT LINK EXECUTABLE \"%s\": %s", argv0, linker_get_error_buffer()); 468 } 469 470 /* 471 * This is the entry point for the linker, called from begin.S. This 472 * method is responsible for fixing the linker's own relocations, and 473 * then calling __linker_init_post_relocation(). 474 * 475 * Because this method is called before the linker has fixed it's own 476 * relocations, any attempt to reference an extern variable, extern 477 * function, or other GOT reference will generate a segfault. 478 */ 479 extern "C" ElfW(Addr) __linker_init(void* raw_args) { 480 KernelArgumentBlock args(raw_args); 481 482 // AT_BASE is set to 0 in the case when linker is run by iself 483 // so in order to link the linker it needs to calcuate AT_BASE 484 // using information at hand. The trick below takes advantage 485 // of the fact that the value of linktime_addr before relocations 486 // are run is an offset and this can be used to calculate AT_BASE. 487 static uintptr_t linktime_addr = reinterpret_cast<uintptr_t>(&linktime_addr); 488 ElfW(Addr) linker_addr = reinterpret_cast<uintptr_t>(&linktime_addr) - linktime_addr; 489 490 ElfW(Addr) entry_point = args.getauxval(AT_ENTRY); 491 ElfW(Ehdr)* elf_hdr = reinterpret_cast<ElfW(Ehdr)*>(linker_addr); 492 ElfW(Phdr)* phdr = reinterpret_cast<ElfW(Phdr)*>(linker_addr + elf_hdr->e_phoff); 493 494 soinfo linker_so(nullptr, nullptr, nullptr, 0, 0); 495 496 linker_so.base = linker_addr; 497 linker_so.size = phdr_table_get_load_size(phdr, elf_hdr->e_phnum); 498 linker_so.load_bias = get_elf_exec_load_bias(elf_hdr); 499 linker_so.dynamic = nullptr; 500 linker_so.phdr = phdr; 501 linker_so.phnum = elf_hdr->e_phnum; 502 linker_so.set_linker_flag(); 503 504 // Prelink the linker so we can access linker globals. 505 if (!linker_so.prelink_image()) __linker_cannot_link(args.argv[0]); 506 507 // This might not be obvious... The reasons why we pass g_empty_list 508 // in place of local_group here are (1) we do not really need it, because 509 // linker is built with DT_SYMBOLIC and therefore relocates its symbols against 510 // itself without having to look into local_group and (2) allocators 511 // are not yet initialized, and therefore we cannot use linked_list.push_* 512 // functions at this point. 513 if (!linker_so.link_image(g_empty_list, g_empty_list, nullptr)) __linker_cannot_link(args.argv[0]); 514 515 #if defined(__i386__) 516 // On x86, we can't make system calls before this point. 517 // We can't move this up because this needs to assign to a global. 518 // Note that until we call __libc_init_main_thread below we have 519 // no TLS, so you shouldn't make a system call that can fail, because 520 // it will SEGV when it tries to set errno. 521 __libc_init_sysinfo(args); 522 #endif 523 524 // Initialize the main thread (including TLS, so system calls really work). 525 __libc_init_main_thread(args); 526 527 // We didn't protect the linker's RELRO pages in link_image because we 528 // couldn't make system calls on x86 at that point, but we can now... 529 if (!linker_so.protect_relro()) __linker_cannot_link(args.argv[0]); 530 531 // Initialize the linker's static libc's globals 532 __libc_init_globals(args); 533 534 // store argc/argv/envp to use them for calling constructors 535 g_argc = args.argc; 536 g_argv = args.argv; 537 g_envp = args.envp; 538 539 // Initialize the linker's own global variables 540 linker_so.call_constructors(); 541 542 // If the linker is not acting as PT_INTERP entry_point is equal to 543 // _start. Which means that the linker is running as an executable and 544 // already linked by PT_INTERP. 545 // 546 // This happens when user tries to run 'adb shell /system/bin/linker' 547 // see also https://code.google.com/p/android/issues/detail?id=63174 548 if (reinterpret_cast<ElfW(Addr)>(&_start) == entry_point) { 549 __libc_format_fd(STDOUT_FILENO, 550 "This is %s, the helper program for dynamic executables.\n", 551 args.argv[0]); 552 exit(0); 553 } 554 555 // Initialize static variables. Note that in order to 556 // get correct libdl_info we need to call constructors 557 // before get_libdl_info(). 558 sonext = solist = get_libdl_info(kLinkerPath); 559 g_default_namespace.add_soinfo(solist); 560 561 // We have successfully fixed our own relocations. It's safe to run 562 // the main part of the linker now. 563 args.abort_message_ptr = &g_abort_message; 564 ElfW(Addr) start_address = __linker_init_post_relocation(args, linker_addr); 565 566 INFO("[ Jumping to _start (%p)... ]", reinterpret_cast<void*>(start_address)); 567 568 // Return the address that the calling assembly stub should jump to. 569 return start_address; 570 } 571