Always enable pointer guard

diff --git a/README.google b/README.google
index a8153886b994de5c3c50517bb62c3ee22ab57a41..2d28310602ae1e5caf2c09978afd46e2e2f6e800 100644 (file)
--- a/README.google
+++ b/README.google
@@ -635,3 +635,9 @@ time/tst-strftime.c
   Fix where out of range data to strftime() causes a segfault (BZ18985, CVE-2015-8776)
   https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=d36c75fc0d44deec29635dd239b0fbd206ca49b7
   (stanshebs, backport)
+
+elf/rtld.c
+sysdeps/generic/ldsodefs.h
+  Always enable pointer guard (BZ18928, CVE-2015-8777)
+  https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=a014cecd82b71b70a6a843e250e06b541ad524f7
+  (stanshebs, backport)

diff --git a/elf/rtld.c b/elf/rtld.c
index 8c225cdf4fed1caaf836b9075ca1f4e2d462089f..b23d72209fcba20a4fd12de48cf42127d9aa65f6 100644 (file)
--- a/elf/rtld.c
+++ b/elf/rtld.c
@@ -171,7 +171,6 @@ struct rtld_global_ro _rtld_global_ro attribute_relro =
     ._dl_hwcap_mask = HWCAP_IMPORTANT,
     ._dl_lazy = 1,
     ._dl_fpu_control = _FPU_DEFAULT,
-    ._dl_pointer_guard = 1,
     ._dl_pagesize = EXEC_PAGESIZE,
     ._dl_inhibit_cache = 0,
 
@@ -868,15 +867,12 @@ security_init (void)
 #endif
 
   /* Set up the pointer guard as well, if necessary.  */
-  if (GLRO(dl_pointer_guard))
-    {
-      uintptr_t pointer_chk_guard = _dl_setup_pointer_guard (_dl_random,
-                                                            stack_chk_guard);
+  uintptr_t pointer_chk_guard
+    = _dl_setup_pointer_guard (_dl_random, stack_chk_guard);
 #ifdef THREAD_SET_POINTER_GUARD
-      THREAD_SET_POINTER_GUARD (pointer_chk_guard);
+  THREAD_SET_POINTER_GUARD (pointer_chk_guard);
 #endif
-      __pointer_chk_guard_local = pointer_chk_guard;
-    }
+  __pointer_chk_guard_local = pointer_chk_guard;
 
   /* We do not need the _dl_random value anymore.  The less
      information we leave behind, the better, so clear the
@@ -2635,9 +2631,6 @@ process_envvars (enum mode *modep)
              GLRO(dl_use_load_bias) = envline[14] == '1' ? -1 : 0;
              break;
            }
-
-         if (memcmp (envline, "POINTER_GUARD", 13) == 0)
-           GLRO(dl_pointer_guard) = envline[14] != '0';
          break;
 
        case 14:

diff --git a/sysdeps/generic/ldsodefs.h b/sysdeps/generic/ldsodefs.h
index f3c67ee8aee4946382408911dfb322ae68907658..2294d5de75aa92bf252b5d517853b6201627c37d 100644 (file)
--- a/sysdeps/generic/ldsodefs.h
+++ b/sysdeps/generic/ldsodefs.h
@@ -637,7 +637,7 @@ struct rtld_global_ro
   struct audit_ifaces *_dl_audit;
   unsigned int _dl_naudit;
 
-  /* 0 if internal pointer values should not be guarded, 1 if they should.  */
+  /* Google local: retain this no-longer-used field for binary compat.  */
   EXTERN int _dl_pointer_guard;
 };
 # define __rtld_global_attribute__