]> git.ipfire.org Git - thirdparty/glibc.git/blobdiff - elf/dl-deps.c
elf: Refuse to dlopen PIE objects [BZ #24323]
[thirdparty/glibc.git] / elf / dl-deps.c
index 440fb563da00ebee7d922df034800522de170703..e12c353158a1fa5cb76de1a62806c808f768d7af 100644 (file)
@@ -1,6 +1,5 @@
 /* Load the dependencies of a mapped object.
-   Copyright (C) 1996-2003, 2004, 2005, 2006, 2007, 2010, 2011
-   Free Software Foundation, Inc.
+   Copyright (C) 1996-2019 Free Software Foundation, Inc.
    This file is part of the GNU C Library.
 
    The GNU C Library is free software; you can redistribute it and/or
@@ -14,9 +13,8 @@
    Lesser General Public License for more details.
 
    You should have received a copy of the GNU Lesser General Public
-   License along with the GNU C Library; if not, write to the Free
-   Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA
-   02111-1307 USA.  */
+   License along with the GNU C Library; if not, see
+   <http://www.gnu.org/licenses/>.  */
 
 #include <atomic.h>
 #include <assert.h>
@@ -29,6 +27,7 @@
 #include <unistd.h>
 #include <sys/param.h>
 #include <ldsodefs.h>
+#include <scratch_buffer.h>
 
 #include <dl-dst.h>
 
@@ -70,7 +69,6 @@ openaux (void *a)
 }
 
 static ptrdiff_t
-internal_function
 _dl_build_local_scope (struct link_map **list, struct link_map *map)
 {
   struct link_map **p = list;
@@ -103,21 +101,21 @@ struct list
   ({                                                                         \
     const char *__str = (str);                                               \
     const char *__result = __str;                                            \
-    size_t __dst_cnt = DL_DST_COUNT (__str, 0);                                      \
+    size_t __dst_cnt = _dl_dst_count (__str);                                \
                                                                              \
     if (__dst_cnt != 0)                                                              \
       {                                                                              \
        char *__newp;                                                         \
                                                                              \
        /* DST must not appear in SUID/SGID programs.  */                     \
-       if (INTUSE(__libc_enable_secure))                                     \
+       if (__libc_enable_secure)                                             \
          _dl_signal_error (0, __str, NULL, N_("\
 DST not allowed in SUID/SGID programs"));                                    \
                                                                              \
        __newp = (char *) alloca (DL_DST_REQUIRED (l, __str, strlen (__str),  \
                                                   __dst_cnt));               \
                                                                              \
-       __result = _dl_dst_substitute (l, __str, __newp, 0);                  \
+       __result = _dl_dst_substitute (l, __str, __newp);                     \
                                                                              \
        if (*__result == '\0')                                                \
          {                                                                   \
@@ -129,7 +127,7 @@ empty dynamic string token substitution"));                               \
            else                                                              \
              {                                                               \
                /* This is for DT_AUXILIARY.  */                              \
-               if (__builtin_expect (GLRO(dl_debug_mask) & DL_DEBUG_LIBS, 0))\
+               if (__glibc_unlikely (GLRO(dl_debug_mask) & DL_DEBUG_LIBS))   \
                  _dl_debug_printf (N_("\
 cannot load auxiliary `%s' because of empty dynamic string token "           \
                                            "substitution\n"), __str);        \
@@ -140,9 +138,21 @@ cannot load auxiliary `%s' because of empty dynamic string token "       \
                                                                              \
     __result; })
 
+static void
+preload (struct list *known, unsigned int *nlist, struct link_map *map)
+{
+  known[*nlist].done = 0;
+  known[*nlist].map = map;
+  known[*nlist].next = &known[*nlist + 1];
+
+  ++*nlist;
+  /* We use `l_reserved' as a mark bit to detect objects we have
+     already put in the search list and avoid adding duplicate
+     elements later in the list.  */
+  map->l_reserved = 1;
+}
 
 void
-internal_function
 _dl_map_object_deps (struct link_map *map,
                     struct link_map **preloads, unsigned int npreloads,
                     int trace_mode, int open_mode)
@@ -154,33 +164,17 @@ _dl_map_object_deps (struct link_map *map,
   const char *name;
   int errno_saved;
   int errno_reason;
-  const char *errstring;
-  const char *objname;
-
-  auto inline void preload (struct link_map *map);
-
-  inline void preload (struct link_map *map)
-    {
-      known[nlist].done = 0;
-      known[nlist].map = map;
-      known[nlist].next = &known[nlist + 1];
-
-      ++nlist;
-      /* We use `l_reserved' as a mark bit to detect objects we have
-        already put in the search list and avoid adding duplicate
-        elements later in the list.  */
-      map->l_reserved = 1;
-    }
+  struct dl_exception exception;
 
   /* No loaded object so far.  */
   nlist = 0;
 
   /* First load MAP itself.  */
-  preload (map);
+  preload (known, &nlist, map);
 
   /* Add the preloaded items after MAP but before any of its dependencies.  */
   for (i = 0; i < npreloads; ++i)
-    preload (preloads[i]);
+    preload (known, &nlist, preloads[i]);
 
   /* Terminate the lists.  */
   known[nlist - 1].next = NULL;
@@ -188,6 +182,9 @@ _dl_map_object_deps (struct link_map *map,
   /* Pointer to last unique object.  */
   tail = &known[nlist - 1];
 
+  struct scratch_buffer needed_space;
+  scratch_buffer_init (&needed_space);
+
   /* Process each element of the search list, loading each of its
      auxiliary objects and immediate dependencies.  Auxiliary objects
      will be added in the list before the object itself and
@@ -200,7 +197,6 @@ _dl_map_object_deps (struct link_map *map,
      alloca means we cannot use recursive function calls.  */
   errno_saved = errno;
   errno_reason = 0;
-  errstring = NULL;
   errno = 0;
   name = NULL;
   for (runp = known; runp; )
@@ -216,8 +212,14 @@ _dl_map_object_deps (struct link_map *map,
         dependencies of this object.  */
       if (l->l_searchlist.r_list == NULL && l->l_initfini == NULL
          && l != map && l->l_ldnum > 0)
-       needed = (struct link_map **) alloca (l->l_ldnum
-                                             * sizeof (struct link_map *));
+       {
+         /* l->l_ldnum includes space for the terminating NULL.  */
+         if (!scratch_buffer_set_array_size
+             (&needed_space, l->l_ldnum, sizeof (struct link_map *)))
+           _dl_signal_error (ENOMEM, map->l_name, NULL,
+                             N_("cannot allocate dependency buffer"));
+         needed = needed_space.data;
+       }
 
       if (l->l_info[DT_NEEDED] || l->l_info[AUXTAG] || l->l_info[FILTERTAG])
        {
@@ -243,17 +245,9 @@ _dl_map_object_deps (struct link_map *map,
                /* Store the tag in the argument structure.  */
                args.name = name;
 
-               bool malloced;
-               int err = _dl_catch_error (&objname, &errstring, &malloced,
-                                          openaux, &args);
-               if (__builtin_expect (errstring != NULL, 0))
+               int err = _dl_catch_exception (&exception, openaux, &args);
+               if (__glibc_unlikely (exception.errstring != NULL))
                  {
-                   char *new_errstring = strdupa (errstring);
-                   objname = strdupa (objname);
-                   if (malloced)
-                     free ((char *) errstring);
-                   errstring = new_errstring;
-
                    if (err)
                      errno_reason = err;
                    else
@@ -295,56 +289,29 @@ _dl_map_object_deps (struct link_map *map,
                /* Store the tag in the argument structure.  */
                args.name = name;
 
-               if (d->d_tag == DT_AUXILIARY)
+               /* Say that we are about to load an auxiliary library.  */
+               if (__builtin_expect (GLRO(dl_debug_mask) & DL_DEBUG_LIBS,
+                                     0))
+                 _dl_debug_printf ("load auxiliary object=%s"
+                                   " requested by file=%s\n",
+                                   name,
+                                   DSO_FILENAME (l->l_name));
+
+               /* We must be prepared that the addressed shared
+                  object is not available.  For filter objects the dependency
+                  must be available.  */
+               int err = _dl_catch_exception (&exception, openaux, &args);
+               if (__glibc_unlikely (exception.errstring != NULL))
                  {
-                   /* Say that we are about to load an auxiliary library.  */
-                   if (__builtin_expect (GLRO(dl_debug_mask) & DL_DEBUG_LIBS,
-                                         0))
-                     _dl_debug_printf ("load auxiliary object=%s"
-                                       " requested by file=%s\n",
-                                       name,
-                                       l->l_name[0]
-                                       ? l->l_name : rtld_progname);
-
-                   /* We must be prepared that the addressed shared
-                      object is not available.  */
-                   bool malloced;
-                   (void) _dl_catch_error (&objname, &errstring, &malloced,
-                                           openaux, &args);
-                   if (__builtin_expect (errstring != NULL, 0))
+                   if (d->d_tag == DT_AUXILIARY)
                      {
                        /* We are not interested in the error message.  */
-                       assert (errstring != NULL);
-                       if (malloced)
-                         free ((char *) errstring);
-
+                       _dl_exception_free (&exception);
                        /* Simply ignore this error and continue the work.  */
                        continue;
                      }
-                 }
-               else
-                 {
-                   /* Say that we are about to load an auxiliary library.  */
-                   if (__builtin_expect (GLRO(dl_debug_mask) & DL_DEBUG_LIBS,
-                                         0))
-                     _dl_debug_printf ("load filtered object=%s"
-                                       " requested by file=%s\n",
-                                       name,
-                                       l->l_name[0]
-                                       ? l->l_name : rtld_progname);
-
-                   /* For filter objects the dependency must be available.  */
-                   bool malloced;
-                   int err = _dl_catch_error (&objname, &errstring, &malloced,
-                                              openaux, &args);
-                   if (__builtin_expect (errstring != NULL, 0))
+                   else
                      {
-                       char *new_errstring = strdupa (errstring);
-                       objname = strdupa (objname);
-                       if (malloced)
-                         free ((char *) errstring);
-                       errstring = new_errstring;
-
                        if (err)
                          errno_reason = err;
                        else
@@ -470,14 +437,18 @@ _dl_map_object_deps (struct link_map *map,
          struct link_map **l_initfini = (struct link_map **)
            malloc ((2 * nneeded + 1) * sizeof needed[0]);
          if (l_initfini == NULL)
-           _dl_signal_error (ENOMEM, map->l_name, NULL,
-                             N_("cannot allocate dependency list"));
+           {
+             scratch_buffer_free (&needed_space);
+             _dl_signal_error (ENOMEM, map->l_name, NULL,
+                               N_("cannot allocate dependency list"));
+           }
          l_initfini[0] = l;
          memcpy (&l_initfini[1], needed, nneeded * sizeof needed[0]);
          memcpy (&l_initfini[nneeded + 1], l_initfini,
                  nneeded * sizeof needed[0]);
          atomic_write_barrier ();
          l->l_initfini = l_initfini;
+         l->l_free_initfini = 1;
        }
 
       /* If we have no auxiliary objects just go on to the next map.  */
@@ -488,6 +459,8 @@ _dl_map_object_deps (struct link_map *map,
     }
 
  out:
+  scratch_buffer_free (&needed_space);
+
   if (errno == 0 && errno_saved != 0)
     __set_errno (errno_saved);
 
@@ -589,7 +562,6 @@ Filters not supported with LD_TRACE_PRELINKING"));
        if (list[i]->l_reserved)
          {
            /* Need to allocate new array of relocation dependencies.  */
-           struct link_map_reldeps *l_reldeps;
            l_reldeps = malloc (sizeof (*l_reldeps)
                                + map->l_reldepsmax
                                  * sizeof (struct link_map *));
@@ -613,67 +585,19 @@ Filters not supported with LD_TRACE_PRELINKING"));
        map->l_searchlist.r_list[i]->l_reserved = 0;
     }
 
-  /* Now determine the order in which the initialization has to happen.  */
+  /* Sort the initializer list to take dependencies into account.  The binary
+     itself will always be initialize last.  */
   memcpy (l_initfini, map->l_searchlist.r_list,
          nlist * sizeof (struct link_map *));
-
-  /* We can skip looking for the binary itself which is at the front
-     of the search list.  */
-  assert (nlist > 1);
-  i = 1;
-  bool seen[nlist];
-  memset (seen, false, nlist * sizeof (seen[0]));
-  while (1)
-    {
-      /* Keep track of which object we looked at this round.  */
-      seen[i] = true;
-      struct link_map *thisp = l_initfini[i];
-
-      /* Find the last object in the list for which the current one is
-        a dependency and move the current object behind the object
-        with the dependency.  */
-      unsigned int k = nlist - 1;
-      while (k > i)
-       {
-         struct link_map **runp = l_initfini[k]->l_initfini;
-         if (runp != NULL)
-           /* Look through the dependencies of the object.  */
-           while (*runp != NULL)
-             if (__builtin_expect (*runp++ == thisp, 0))
-               {
-                 /* Move the current object to the back past the last
-                    object with it as the dependency.  */
-                 memmove (&l_initfini[i], &l_initfini[i + 1],
-                          (k - i) * sizeof (l_initfini[0]));
-                 l_initfini[k] = thisp;
-
-                 if (seen[i + 1])
-                   {
-                     ++i;
-                     goto next_clear;
-                   }
-
-                 memmove (&seen[i], &seen[i + 1], (k - i) * sizeof (seen[0]));
-                 seen[k] = true;
-
-                 goto next;
-               }
-
-         --k;
-       }
-
-      if (++i == nlist)
-       break;
-    next_clear:
-      memset (&seen[i], false, (nlist - i) * sizeof (seen[0]));
-
-    next:;
-    }
+  /* We can skip looking for the binary itself which is at the front of
+     the search list.  */
+  _dl_sort_maps (&l_initfini[1], nlist - 1, NULL, false);
 
   /* Terminate the list of dependencies.  */
   l_initfini[nlist] = NULL;
   atomic_write_barrier ();
   map->l_initfini = l_initfini;
+  map->l_free_initfini = 1;
   if (l_reldeps != NULL)
     {
       atomic_write_barrier ();
@@ -685,6 +609,6 @@ Filters not supported with LD_TRACE_PRELINKING"));
     _dl_scope_free (old_l_initfini);
 
   if (errno_reason)
-    _dl_signal_error (errno_reason == -1 ? 0 : errno_reason, objname,
-                     NULL, errstring);
+    _dl_signal_exception (errno_reason == -1 ? 0 : errno_reason,
+                         &exception, NULL);
 }