1 /*
2  * Copyright (C) 2007 The Android Open Source Project
3  *
4  * Licensed under the Apache License, Version 2.0 (the "License");
5  * you may not use this file except in compliance with the License.
6  * You may obtain a copy of the License at
7  *
8  *      http://www.apache.org/licenses/LICENSE-2.0
9  *
10  * Unless required by applicable law or agreed to in writing, software
11  * distributed under the License is distributed on an "AS IS" BASIS,
12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13  * See the License for the specific language governing permissions and
14  * limitations under the License.
15  */
16 
17 #include "linker.h"
18 
19 #include <dlfcn.h>
20 #include <pthread.h>
21 #include <stdio.h>
22 #include <stdlib.h>
23 #include <string.h>
24 #include <android/dlext.h>
25 #include <android/api-level.h>
26 
27 #include <bionic/pthread_internal.h>
28 #include "private/bionic_tls.h"
29 #include "private/ScopedPthreadMutexLocker.h"
30 #include "private/ThreadLocalBuffer.h"
31 
32 /* This file hijacks the symbols stubbed out in libdl.so. */
33 
34 static pthread_mutex_t g_dl_mutex = PTHREAD_RECURSIVE_MUTEX_INITIALIZER_NP;
35 
__bionic_set_dlerror(char * new_value)36 static const char* __bionic_set_dlerror(char* new_value) {
37   char** dlerror_slot = &reinterpret_cast<char**>(__get_tls())[TLS_SLOT_DLERROR];
38 
39   const char* old_value = *dlerror_slot;
40   *dlerror_slot = new_value;
41   return old_value;
42 }
43 
__bionic_format_dlerror(const char * msg,const char * detail)44 static void __bionic_format_dlerror(const char* msg, const char* detail) {
45   char* buffer = __get_thread()->dlerror_buffer;
46   strlcpy(buffer, msg, __BIONIC_DLERROR_BUFFER_SIZE);
47   if (detail != nullptr) {
48     strlcat(buffer, ": ", __BIONIC_DLERROR_BUFFER_SIZE);
49     strlcat(buffer, detail, __BIONIC_DLERROR_BUFFER_SIZE);
50   }
51 
52   __bionic_set_dlerror(buffer);
53 }
54 
dlerror()55 const char* dlerror() {
56   const char* old_value = __bionic_set_dlerror(nullptr);
57   return old_value;
58 }
59 
android_get_LD_LIBRARY_PATH(char * buffer,size_t buffer_size)60 void android_get_LD_LIBRARY_PATH(char* buffer, size_t buffer_size) {
61   ScopedPthreadMutexLocker locker(&g_dl_mutex);
62   do_android_get_LD_LIBRARY_PATH(buffer, buffer_size);
63 }
64 
android_update_LD_LIBRARY_PATH(const char * ld_library_path)65 void android_update_LD_LIBRARY_PATH(const char* ld_library_path) {
66   ScopedPthreadMutexLocker locker(&g_dl_mutex);
67   do_android_update_LD_LIBRARY_PATH(ld_library_path);
68 }
69 
dlopen_ext(const char * filename,int flags,const android_dlextinfo * extinfo)70 static void* dlopen_ext(const char* filename, int flags, const android_dlextinfo* extinfo) {
71   ScopedPthreadMutexLocker locker(&g_dl_mutex);
72   soinfo* result = do_dlopen(filename, flags, extinfo);
73   if (result == nullptr) {
74     __bionic_format_dlerror("dlopen failed", linker_get_error_buffer());
75     return nullptr;
76   }
77   return result;
78 }
79 
android_dlopen_ext(const char * filename,int flags,const android_dlextinfo * extinfo)80 void* android_dlopen_ext(const char* filename, int flags, const android_dlextinfo* extinfo) {
81   return dlopen_ext(filename, flags, extinfo);
82 }
83 
dlopen(const char * filename,int flags)84 void* dlopen(const char* filename, int flags) {
85   return dlopen_ext(filename, flags, nullptr);
86 }
87 
dlsym(void * handle,const char * symbol)88 void* dlsym(void* handle, const char* symbol) {
89   ScopedPthreadMutexLocker locker(&g_dl_mutex);
90 
91 #if !defined(__LP64__)
92   if (handle == nullptr) {
93     __bionic_format_dlerror("dlsym library handle is null", nullptr);
94     return nullptr;
95   }
96 #endif
97 
98   if (symbol == nullptr) {
99     __bionic_format_dlerror("dlsym symbol name is null", nullptr);
100     return nullptr;
101   }
102 
103   soinfo* found = nullptr;
104   const ElfW(Sym)* sym = nullptr;
105   void* caller_addr = __builtin_return_address(0);
106   soinfo* caller = find_containing_library(caller_addr);
107 
108   if (handle == RTLD_DEFAULT || handle == RTLD_NEXT) {
109     sym = dlsym_linear_lookup(symbol, &found, caller, handle);
110   } else {
111     sym = dlsym_handle_lookup(reinterpret_cast<soinfo*>(handle), &found, symbol);
112   }
113 
114   if (sym != nullptr) {
115     unsigned bind = ELF_ST_BIND(sym->st_info);
116 
117     if ((bind == STB_GLOBAL || bind == STB_WEAK) && sym->st_shndx != 0) {
118       return reinterpret_cast<void*>(found->resolve_symbol_address(sym));
119     }
120 
121     __bionic_format_dlerror("symbol found but not global", symbol);
122     return nullptr;
123   } else {
124     __bionic_format_dlerror("undefined symbol", symbol);
125     return nullptr;
126   }
127 }
128 
dladdr(const void * addr,Dl_info * info)129 int dladdr(const void* addr, Dl_info* info) {
130   ScopedPthreadMutexLocker locker(&g_dl_mutex);
131 
132   // Determine if this address can be found in any library currently mapped.
133   soinfo* si = find_containing_library(addr);
134   if (si == nullptr) {
135     return 0;
136   }
137 
138   memset(info, 0, sizeof(Dl_info));
139 
140   info->dli_fname = si->get_realpath();
141   // Address at which the shared object is loaded.
142   info->dli_fbase = reinterpret_cast<void*>(si->base);
143 
144   // Determine if any symbol in the library contains the specified address.
145   ElfW(Sym)* sym = si->find_symbol_by_address(addr);
146   if (sym != nullptr) {
147     info->dli_sname = si->get_string(sym->st_name);
148     info->dli_saddr = reinterpret_cast<void*>(si->resolve_symbol_address(sym));
149   }
150 
151   return 1;
152 }
153 
dlclose(void * handle)154 int dlclose(void* handle) {
155   ScopedPthreadMutexLocker locker(&g_dl_mutex);
156   do_dlclose(reinterpret_cast<soinfo*>(handle));
157   // dlclose has no defined errors.
158   return 0;
159 }
160 
dl_iterate_phdr(int (* cb)(dl_phdr_info * info,size_t size,void * data),void * data)161 int dl_iterate_phdr(int (*cb)(dl_phdr_info* info, size_t size, void* data), void* data) {
162   ScopedPthreadMutexLocker locker(&g_dl_mutex);
163   return do_dl_iterate_phdr(cb, data);
164 }
165 
android_set_application_target_sdk_version(uint32_t target)166 void android_set_application_target_sdk_version(uint32_t target) {
167   // lock to avoid modification in the middle of dlopen.
168   ScopedPthreadMutexLocker locker(&g_dl_mutex);
169   set_application_target_sdk_version(target);
170 }
171 
android_get_application_target_sdk_version()172 uint32_t android_get_application_target_sdk_version() {
173   return get_application_target_sdk_version();
174 }
175 
176 // name_offset: starting index of the name in libdl_info.strtab
177 #define ELF32_SYM_INITIALIZER(name_offset, value, shndx) \
178     { name_offset, \
179       reinterpret_cast<Elf32_Addr>(value), \
180       /* st_size */ 0, \
181       (shndx == 0) ? 0 : (STB_GLOBAL << 4), \
182       /* st_other */ 0, \
183       shndx, \
184     }
185 
186 #define ELF64_SYM_INITIALIZER(name_offset, value, shndx) \
187     { name_offset, \
188       (shndx == 0) ? 0 : (STB_GLOBAL << 4), \
189       /* st_other */ 0, \
190       shndx, \
191       reinterpret_cast<Elf64_Addr>(value), \
192       /* st_size */ 0, \
193     }
194 
195 static const char ANDROID_LIBDL_STRTAB[] =
196   // 0000000 00011111 111112 22222222 2333333 3333444444444455555555556666666 6667777777777888888888899999 99999
197   // 0123456 78901234 567890 12345678 9012345 6789012345678901234567890123456 7890123456789012345678901234 56789
198     "dlopen\0dlclose\0dlsym\0dlerror\0dladdr\0android_update_LD_LIBRARY_PATH\0android_get_LD_LIBRARY_PATH\0dl_it"
199   // 00000000001 1111111112222222222 3333333333444444444455555555556666666666777 777777788888888889999999999
200   // 01234567890 1234567890123456789 0123456789012345678901234567890123456789012 345678901234567890123456789
201     "erate_phdr\0android_dlopen_ext\0android_set_application_target_sdk_version\0android_get_application_tar"
202   // 0000000000111111
203   // 0123456789012345
204     "get_sdk_version\0"
205 #if defined(__arm__)
206   // 216
207     "dl_unwind_find_exidx\0"
208 #endif
209     ;
210 
211 static ElfW(Sym) g_libdl_symtab[] = {
212   // Total length of libdl_info.strtab, including trailing 0.
213   // This is actually the STH_UNDEF entry. Technically, it's
214   // supposed to have st_name == 0, but instead, it points to an index
215   // in the strtab with a \0 to make iterating through the symtab easier.
216   ELFW(SYM_INITIALIZER)(sizeof(ANDROID_LIBDL_STRTAB) - 1, nullptr, 0),
217   ELFW(SYM_INITIALIZER)(  0, &dlopen, 1),
218   ELFW(SYM_INITIALIZER)(  7, &dlclose, 1),
219   ELFW(SYM_INITIALIZER)( 15, &dlsym, 1),
220   ELFW(SYM_INITIALIZER)( 21, &dlerror, 1),
221   ELFW(SYM_INITIALIZER)( 29, &dladdr, 1),
222   ELFW(SYM_INITIALIZER)( 36, &android_update_LD_LIBRARY_PATH, 1),
223   ELFW(SYM_INITIALIZER)( 67, &android_get_LD_LIBRARY_PATH, 1),
224   ELFW(SYM_INITIALIZER)( 95, &dl_iterate_phdr, 1),
225   ELFW(SYM_INITIALIZER)(111, &android_dlopen_ext, 1),
226   ELFW(SYM_INITIALIZER)(130, &android_set_application_target_sdk_version, 1),
227   ELFW(SYM_INITIALIZER)(173, &android_get_application_target_sdk_version, 1),
228 #if defined(__arm__)
229   ELFW(SYM_INITIALIZER)(216, &dl_unwind_find_exidx, 1),
230 #endif
231 };
232 
233 // Fake out a hash table with a single bucket.
234 //
235 // A search of the hash table will look through g_libdl_symtab starting with index 1, then
236 // use g_libdl_chains to find the next index to look at. g_libdl_chains should be set up to
237 // walk through every element in g_libdl_symtab, and then end with 0 (sentinel value).
238 //
239 // That is, g_libdl_chains should look like { 0, 2, 3, ... N, 0 } where N is the number
240 // of actual symbols, or nelems(g_libdl_symtab)-1 (since the first element of g_libdl_symtab is not
241 // a real symbol). (See soinfo_elf_lookup().)
242 //
243 // Note that adding any new symbols here requires stubbing them out in libdl.
244 static unsigned g_libdl_buckets[1] = { 1 };
245 #if defined(__arm__)
246 static unsigned g_libdl_chains[] = { 0, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 0 };
247 #else
248 static unsigned g_libdl_chains[] = { 0, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 0 };
249 #endif
250 
251 static uint8_t __libdl_info_buf[sizeof(soinfo)] __attribute__((aligned(8)));
252 static soinfo* __libdl_info = nullptr;
253 
254 // This is used by the dynamic linker. Every process gets these symbols for free.
get_libdl_info()255 soinfo* get_libdl_info() {
256   if (__libdl_info == nullptr) {
257     __libdl_info = new (__libdl_info_buf) soinfo("libdl.so", nullptr, 0, RTLD_GLOBAL);
258     __libdl_info->flags_ |= FLAG_LINKED;
259     __libdl_info->strtab_ = ANDROID_LIBDL_STRTAB;
260     __libdl_info->symtab_ = g_libdl_symtab;
261     __libdl_info->nbucket_ = sizeof(g_libdl_buckets)/sizeof(unsigned);
262     __libdl_info->nchain_ = sizeof(g_libdl_chains)/sizeof(unsigned);
263     __libdl_info->bucket_ = g_libdl_buckets;
264     __libdl_info->chain_ = g_libdl_chains;
265     __libdl_info->ref_count_ = 1;
266     __libdl_info->strtab_size_ = sizeof(ANDROID_LIBDL_STRTAB);
267     __libdl_info->local_group_root_ = __libdl_info;
268     __libdl_info->soname_ = "libdl.so";
269     __libdl_info->target_sdk_version_ = __ANDROID_API__;
270 #if defined(__arm__)
271     strlcpy(__libdl_info->old_name_, __libdl_info->soname_, sizeof(__libdl_info->old_name_));
272 #endif
273   }
274 
275   return __libdl_info;
276 }
277