Check multiple NT_GNU_PROPERTY_TYPE_0 notes [BZ #23509]

Linkers group input note sections with the same name into one output
note section with the same name.  One output note section is placed in
one PT_NOTE segment.  Since new linkers merge input .note.gnu.property
sections into one output .note.gnu.property section, there is only
one NT_GNU_PROPERTY_TYPE_0 note in one PT_NOTE segment with new linkers.
Since older linkers treat input .note.gnu.property section as a generic
note section and just concatenate all input .note.gnu.property sections
into one output .note.gnu.property section without merging them, we may
see multiple NT_GNU_PROPERTY_TYPE_0 notes in one PT_NOTE segment with
older linkers.

When an older linker is used to created the program on CET-enabled OS,
the linker output has a single .note.gnu.property section with multiple
NT_GNU_PROPERTY_TYPE_0 notes, some of which have IBT and SHSTK enable
bits set even if the program isn't CET enabled.  Such programs will
crash on CET-enabled machines.  This patch updates the note parser:

1. Skip note parsing if a NT_GNU_PROPERTY_TYPE_0 note has been processed.
2. Check multiple NT_GNU_PROPERTY_TYPE_0 notes.

	[BZ #23509]
	* sysdeps/x86/dl-prop.h (_dl_process_cet_property_note): Skip
	note parsing if a NT_GNU_PROPERTY_TYPE_0 note has been processed.
	Update the l_cet field when processing NT_GNU_PROPERTY_TYPE_0 note.
	Check multiple NT_GNU_PROPERTY_TYPE_0 notes.
	* sysdeps/x86/link_map.h (l_cet): Expand to 3 bits,  Add
	lc_unknown.

(cherry picked from commit d524fa6c35e675eedbd8fe6cdf4db0b49c658026)

diff --git a/ChangeLog b/ChangeLog
index db4ac3b76a418828153820b727d98fb29d44365e..86bdf179892df73a4df7608e8bf64a954320f0ca 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,13 @@
+2018-11-08  H.J. Lu  <hongjiu.lu@intel.com>
+
+       [BZ #23509]
+       * sysdeps/x86/dl-prop.h (_dl_process_cet_property_note): Skip
+       note parsing if a NT_GNU_PROPERTY_TYPE_0 note has been processed.
+       Update the l_cet field when processing NT_GNU_PROPERTY_TYPE_0 note.
+       Check multiple NT_GNU_PROPERTY_TYPE_0 notes.
+       * sysdeps/x86/link_map.h (l_cet): Expand to 3 bits,  Add
+       lc_unknown.
+
 2018-11-05  Andreas Schwab  <schwab@suse.de>
 
        [BZ #22927]

diff --git a/NEWS b/NEWS
index b85be4a9c12b269620b52823753304c87837a6f0..e5ca5903ec7e7710ae2c1bb05927b553fe85594f 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -13,6 +13,7 @@ The following bugs are resolved with this release:
   [22927] libanl: properly cleanup if first helper thread creation failed
   [23400] stdlib/test-bz22786.c creates temporary files in glibc source tree
   [23497] readdir64@GLIBC_2.1 cannot parse the kernel directory stream
+  [23509] CET enabled glibc is incompatible with the older linker
   [23521] nss_files aliases database file stream leak
   [23538] pthread_cond_broadcast: Fix waiters-after-spinning case
   [23562] signal: Use correct type for si_band in siginfo_t

diff --git a/sysdeps/x86/dl-prop.h b/sysdeps/x86/dl-prop.h
index 26c3131ac5e2d080dd9ddf2d8be07ec09e9f758e..9ab890d12bb991339826d26c1bed9e1d0cde7934 100644 (file)
--- a/sysdeps/x86/dl-prop.h
+++ b/sysdeps/x86/dl-prop.h
@@ -49,6 +49,10 @@ _dl_process_cet_property_note (struct link_map *l,
                              const ElfW(Addr) align)
 {
 #if CET_ENABLED
+  /* Skip if we have seen a NT_GNU_PROPERTY_TYPE_0 note before.  */
+  if (l->l_cet != lc_unknown)
+    return;
+
   /* The NT_GNU_PROPERTY_TYPE_0 note must be aliged to 4 bytes in
      32-bit objects and to 8 bytes in 64-bit objects.  Skip notes
      with incorrect alignment.  */
@@ -57,6 +61,9 @@ _dl_process_cet_property_note (struct link_map *l,
 
   const ElfW(Addr) start = (ElfW(Addr)) note;
 
+  unsigned int feature_1 = 0;
+  unsigned int last_type = 0;
+
   while ((ElfW(Addr)) (note + 1) - start < size)
     {
       /* Find the NT_GNU_PROPERTY_TYPE_0 note.  */
@@ -64,10 +71,18 @@ _dl_process_cet_property_note (struct link_map *l,
          && note->n_type == NT_GNU_PROPERTY_TYPE_0
          && memcmp (note + 1, "GNU", 4) == 0)
        {
+         /* Stop if we see more than one GNU property note which may
+            be generated by the older linker.  */
+         if (l->l_cet != lc_unknown)
+           return;
+
+         /* Check CET status now.  */
+         l->l_cet = lc_none;
+
          /* Check for invalid property.  */
          if (note->n_descsz < 8
              || (note->n_descsz % sizeof (ElfW(Addr))) != 0)
-           break;
+           return;
 
          /* Start and end of property array.  */
          unsigned char *ptr = (unsigned char *) (note + 1) + 4;
@@ -78,9 +93,15 @@ _dl_process_cet_property_note (struct link_map *l,
              unsigned int type = *(unsigned int *) ptr;
              unsigned int datasz = *(unsigned int *) (ptr + 4);
 
+             /* Property type must be in ascending order.  */
+             if (type < last_type)
+               return;
+
              ptr += 8;
              if ((ptr + datasz) > ptr_end)
-               break;
+               return;
+
+             last_type = type;
 
              if (type == GNU_PROPERTY_X86_FEATURE_1_AND)
                {
@@ -89,14 +110,18 @@ _dl_process_cet_property_note (struct link_map *l,
                     we stop the search regardless if its size is correct
                     or not.  There is no point to continue if this note
                     is ill-formed.  */
-                 if (datasz == 4)
-                   {
-                     unsigned int feature_1 = *(unsigned int *) ptr;
-                     if ((feature_1 & GNU_PROPERTY_X86_FEATURE_1_IBT))
-                       l->l_cet |= lc_ibt;
-                     if ((feature_1 & GNU_PROPERTY_X86_FEATURE_1_SHSTK))
-                       l->l_cet |= lc_shstk;
-                   }
+                 if (datasz != 4)
+                   return;
+
+                 feature_1 = *(unsigned int *) ptr;
+
+                 /* Keep searching for the next GNU property note
+                    generated by the older linker.  */
+                 break;
+               }
+             else if (type > GNU_PROPERTY_X86_FEATURE_1_AND)
+               {
+                 /* Stop since property type is in ascending order.  */
                  return;
                }
 
@@ -112,6 +137,12 @@ _dl_process_cet_property_note (struct link_map *l,
              + ELF_NOTE_NEXT_OFFSET (note->n_namesz, note->n_descsz,
                                      align));
     }
+
+  /* We get here only if there is one or no GNU property note.  */
+  if ((feature_1 & GNU_PROPERTY_X86_FEATURE_1_IBT))
+    l->l_cet |= lc_ibt;
+  if ((feature_1 & GNU_PROPERTY_X86_FEATURE_1_SHSTK))
+    l->l_cet |= lc_shstk;
 #endif
 }
 

diff --git a/sysdeps/x86/link_map.h b/sysdeps/x86/link_map.h
index ef1206a9d2396a6f17bbb236765761a4b97dac3e..9367ed08896794a4fc2b937286f3eb302259c20b 100644 (file)
--- a/sysdeps/x86/link_map.h
+++ b/sysdeps/x86/link_map.h
@@ -19,8 +19,9 @@
 /* If this object is enabled with CET.  */
 enum
   {
-    lc_none = 0,                        /* Not enabled with CET.  */
-    lc_ibt = 1 << 0,                    /* Enabled with IBT.  */
-    lc_shstk = 1 << 1,                  /* Enabled with STSHK.  */
+    lc_unknown = 0,                     /* Unknown CET status.  */
+    lc_none = 1 << 0,                   /* Not enabled with CET.  */
+    lc_ibt = 1 << 1,                    /* Enabled with IBT.  */
+    lc_shstk = 1 << 2,                  /* Enabled with STSHK.  */
     lc_ibt_and_shstk = lc_ibt | lc_shstk /* Enabled with both.  */
-  } l_cet:2;
+  } l_cet:3;