You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
160 lines
6.6 KiB
160 lines
6.6 KiB
Partial backport of: |
|
|
|
commit a42faf59d6d9f82e5293a9ebcc26d9c9e562b12b |
|
Author: Paul Pluzhnikov <ppluzhnikov@google.com> |
|
Date: Mon Mar 24 10:58:26 2014 -0700 |
|
|
|
Fix BZ #16634. |
|
|
|
An application that erroneously tries to repeatedly dlopen("a.out", ...) |
|
may hit assertion failure: |
|
|
|
Inconsistency detected by ld.so: dl-tls.c: 474: _dl_allocate_tls_init: |
|
Assertion `listp != ((void *)0)' failed! |
|
|
|
dlopen() actually fails with "./a.out: cannot dynamically load executable", |
|
but it does so after incrementing dl_tls_max_dtv_idx. |
|
|
|
Once we run out of TLS_SLOTINFO_SURPLUS (62), we exit with above assertion |
|
failure. |
|
|
|
2014-03-24 Paul Pluzhnikov <ppluzhnikov@google.com> |
|
|
|
[BZ #16634] |
|
|
|
* elf/dl-load.c (open_verify): Add mode parameter. |
|
Error early when ET_EXEC and mode does not have __RTLD_OPENEXEC. |
|
(open_path): Change from boolean 'secure' to complete flag 'mode' |
|
(_dl_map_object): Adjust. |
|
* elf/Makefile (tests): Add tst-dlopen-aout. |
|
* elf/tst-dlopen-aout.c: New test. |
|
|
|
Only the change to elf/dl-load.c is included here. The upstream test |
|
does not work because it depends on --enable-hardcoded-path-in-tests |
|
(which is not available in this tree, despite being documented in the |
|
manual). |
|
|
|
diff --git a/elf/dl-load.c b/elf/dl-load.c |
|
index 6a0005da502c8f37..0ba0712aa5201fa0 100644 |
|
--- a/elf/dl-load.c |
|
+++ b/elf/dl-load.c |
|
@@ -1686,7 +1686,7 @@ print_search_path (struct r_search_path_elem **list, |
|
user might want to know about this. */ |
|
static int |
|
open_verify (const char *name, struct filebuf *fbp, struct link_map *loader, |
|
- int whatcode, bool *found_other_class, bool free_name) |
|
+ int whatcode, int mode, bool *found_other_class, bool free_name) |
|
{ |
|
/* This is the expected ELF header. */ |
|
#define ELF32_CLASS ELFCLASS32 |
|
@@ -1863,6 +1863,17 @@ open_verify (const char *name, struct filebuf *fbp, struct link_map *loader, |
|
errstring = N_("only ET_DYN and ET_EXEC can be loaded"); |
|
goto call_lose; |
|
} |
|
+ else if (__glibc_unlikely (ehdr->e_type == ET_EXEC |
|
+ && (mode & __RTLD_OPENEXEC) == 0)) |
|
+ { |
|
+ /* BZ #16634. It is an error to dlopen ET_EXEC (unless |
|
+ __RTLD_OPENEXEC is explicitly set). We return error here |
|
+ so that code in _dl_map_object_from_fd does not try to set |
|
+ l_tls_modid for this module. */ |
|
+ |
|
+ errstring = N_("cannot dynamically load executable"); |
|
+ goto call_lose; |
|
+ } |
|
else if (__builtin_expect (ehdr->e_phentsize, sizeof (ElfW(Phdr))) |
|
!= sizeof (ElfW(Phdr))) |
|
{ |
|
@@ -1964,7 +1975,7 @@ open_verify (const char *name, struct filebuf *fbp, struct link_map *loader, |
|
if MAY_FREE_DIRS is true. */ |
|
|
|
static int |
|
-open_path (const char *name, size_t namelen, int secure, |
|
+open_path (const char *name, size_t namelen, int mode, |
|
struct r_search_path_struct *sps, char **realname, |
|
struct filebuf *fbp, struct link_map *loader, int whatcode, |
|
bool *found_other_class) |
|
@@ -2016,8 +2027,8 @@ open_path (const char *name, size_t namelen, int secure, |
|
if (__builtin_expect (GLRO(dl_debug_mask) & DL_DEBUG_LIBS, 0)) |
|
_dl_debug_printf (" trying file=%s\n", buf); |
|
|
|
- fd = open_verify (buf, fbp, loader, whatcode, found_other_class, |
|
- false); |
|
+ fd = open_verify (buf, fbp, loader, whatcode, mode, |
|
+ found_other_class, false); |
|
if (this_dir->status[cnt] == unknown) |
|
{ |
|
if (fd != -1) |
|
@@ -2046,7 +2057,7 @@ open_path (const char *name, size_t namelen, int secure, |
|
/* Remember whether we found any existing directory. */ |
|
here_any |= this_dir->status[cnt] != nonexisting; |
|
|
|
- if (fd != -1 && __builtin_expect (secure, 0) |
|
+ if (fd != -1 && __builtin_expect (mode & __RTLD_SECURE, 0) |
|
&& INTUSE(__libc_enable_secure)) |
|
{ |
|
/* This is an extra security effort to make sure nobody can |
|
@@ -2236,7 +2247,7 @@ _dl_map_object (struct link_map *loader, const char *name, |
|
for (l = loader; l; l = l->l_loader) |
|
if (cache_rpath (l, &l->l_rpath_dirs, DT_RPATH, "RPATH")) |
|
{ |
|
- fd = open_path (name, namelen, mode & __RTLD_SECURE, |
|
+ fd = open_path (name, namelen, mode, |
|
&l->l_rpath_dirs, |
|
&realname, &fb, loader, LA_SER_RUNPATH, |
|
&found_other_class); |
|
@@ -2252,7 +2263,7 @@ _dl_map_object (struct link_map *loader, const char *name, |
|
&& main_map != NULL && main_map->l_type != lt_loaded |
|
&& cache_rpath (main_map, &main_map->l_rpath_dirs, DT_RPATH, |
|
"RPATH")) |
|
- fd = open_path (name, namelen, mode & __RTLD_SECURE, |
|
+ fd = open_path (name, namelen, mode, |
|
&main_map->l_rpath_dirs, |
|
&realname, &fb, loader ?: main_map, LA_SER_RUNPATH, |
|
&found_other_class); |
|
@@ -2260,7 +2271,7 @@ _dl_map_object (struct link_map *loader, const char *name, |
|
|
|
/* Try the LD_LIBRARY_PATH environment variable. */ |
|
if (fd == -1 && env_path_list.dirs != (void *) -1) |
|
- fd = open_path (name, namelen, mode & __RTLD_SECURE, &env_path_list, |
|
+ fd = open_path (name, namelen, mode, &env_path_list, |
|
&realname, &fb, |
|
loader ?: GL(dl_ns)[LM_ID_BASE]._ns_loaded, |
|
LA_SER_LIBPATH, &found_other_class); |
|
@@ -2269,7 +2280,7 @@ _dl_map_object (struct link_map *loader, const char *name, |
|
if (fd == -1 && loader != NULL |
|
&& cache_rpath (loader, &loader->l_runpath_dirs, |
|
DT_RUNPATH, "RUNPATH")) |
|
- fd = open_path (name, namelen, mode & __RTLD_SECURE, |
|
+ fd = open_path (name, namelen, mode, |
|
&loader->l_runpath_dirs, &realname, &fb, loader, |
|
LA_SER_RUNPATH, &found_other_class); |
|
|
|
@@ -2326,7 +2337,8 @@ _dl_map_object (struct link_map *loader, const char *name, |
|
{ |
|
fd = open_verify (cached, |
|
&fb, loader ?: GL(dl_ns)[nsid]._ns_loaded, |
|
- LA_SER_CONFIG, &found_other_class, false); |
|
+ LA_SER_CONFIG, mode, &found_other_class, |
|
+ false); |
|
if (__builtin_expect (fd != -1, 1)) |
|
realname = cached; |
|
else |
|
@@ -2341,7 +2353,7 @@ _dl_map_object (struct link_map *loader, const char *name, |
|
&& ((l = loader ?: GL(dl_ns)[nsid]._ns_loaded) == NULL |
|
|| __builtin_expect (!(l->l_flags_1 & DF_1_NODEFLIB), 1)) |
|
&& rtld_search_dirs.dirs != (void *) -1) |
|
- fd = open_path (name, namelen, mode & __RTLD_SECURE, &rtld_search_dirs, |
|
+ fd = open_path (name, namelen, mode, &rtld_search_dirs, |
|
&realname, &fb, l, LA_SER_DEFAULT, &found_other_class); |
|
|
|
/* Add another newline when we are tracing the library loading. */ |
|
@@ -2359,7 +2371,7 @@ _dl_map_object (struct link_map *loader, const char *name, |
|
else |
|
{ |
|
fd = open_verify (realname, &fb, |
|
- loader ?: GL(dl_ns)[nsid]._ns_loaded, 0, |
|
+ loader ?: GL(dl_ns)[nsid]._ns_loaded, 0, mode, |
|
&found_other_class, true); |
|
if (__builtin_expect (fd, 0) == -1) |
|
free (realname);
|
|
|