1 /*
2  * Copyright (C) 2012 The Android Open Source Project
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  *  * Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  *  * Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in
12  *    the documentation and/or other materials provided with the
13  *    distribution.
14  *
15  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
16  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
17  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
18  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
19  * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
20  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
21  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
22  * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
23  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
24  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
25  * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26  * SUCH DAMAGE.
27  */
28 
29 #include "linker_phdr.h"
30 
31 #include <errno.h>
32 #include <string.h>
33 #include <sys/mman.h>
34 #include <sys/types.h>
35 #include <sys/stat.h>
36 #include <unistd.h>
37 
38 #include "linker.h"
39 #include "linker_debug.h"
40 #include "linker_utils.h"
41 
42 #include "private/bionic_prctl.h"
43 
GetTargetElfMachine()44 static int GetTargetElfMachine() {
45 #if defined(__arm__)
46   return EM_ARM;
47 #elif defined(__aarch64__)
48   return EM_AARCH64;
49 #elif defined(__i386__)
50   return EM_386;
51 #elif defined(__mips__)
52   return EM_MIPS;
53 #elif defined(__x86_64__)
54   return EM_X86_64;
55 #endif
56 }
57 
58 /**
59   TECHNICAL NOTE ON ELF LOADING.
60 
61   An ELF file's program header table contains one or more PT_LOAD
62   segments, which corresponds to portions of the file that need to
63   be mapped into the process' address space.
64 
65   Each loadable segment has the following important properties:
66 
67     p_offset  -> segment file offset
68     p_filesz  -> segment file size
69     p_memsz   -> segment memory size (always >= p_filesz)
70     p_vaddr   -> segment's virtual address
71     p_flags   -> segment flags (e.g. readable, writable, executable)
72 
73   We will ignore the p_paddr and p_align fields of ElfW(Phdr) for now.
74 
75   The loadable segments can be seen as a list of [p_vaddr ... p_vaddr+p_memsz)
76   ranges of virtual addresses. A few rules apply:
77 
78   - the virtual address ranges should not overlap.
79 
80   - if a segment's p_filesz is smaller than its p_memsz, the extra bytes
81     between them should always be initialized to 0.
82 
83   - ranges do not necessarily start or end at page boundaries. Two distinct
84     segments can have their start and end on the same page. In this case, the
85     page inherits the mapping flags of the latter segment.
86 
87   Finally, the real load addrs of each segment is not p_vaddr. Instead the
88   loader decides where to load the first segment, then will load all others
89   relative to the first one to respect the initial range layout.
90 
91   For example, consider the following list:
92 
93     [ offset:0,      filesz:0x4000, memsz:0x4000, vaddr:0x30000 ],
94     [ offset:0x4000, filesz:0x2000, memsz:0x8000, vaddr:0x40000 ],
95 
96   This corresponds to two segments that cover these virtual address ranges:
97 
98        0x30000...0x34000
99        0x40000...0x48000
100 
101   If the loader decides to load the first segment at address 0xa0000000
102   then the segments' load address ranges will be:
103 
104        0xa0030000...0xa0034000
105        0xa0040000...0xa0048000
106 
107   In other words, all segments must be loaded at an address that has the same
108   constant offset from their p_vaddr value. This offset is computed as the
109   difference between the first segment's load address, and its p_vaddr value.
110 
111   However, in practice, segments do _not_ start at page boundaries. Since we
112   can only memory-map at page boundaries, this means that the bias is
113   computed as:
114 
115        load_bias = phdr0_load_address - PAGE_START(phdr0->p_vaddr)
116 
117   (NOTE: The value must be used as a 32-bit unsigned integer, to deal with
118           possible wrap around UINT32_MAX for possible large p_vaddr values).
119 
120   And that the phdr0_load_address must start at a page boundary, with
121   the segment's real content starting at:
122 
123        phdr0_load_address + PAGE_OFFSET(phdr0->p_vaddr)
124 
125   Note that ELF requires the following condition to make the mmap()-ing work:
126 
127       PAGE_OFFSET(phdr0->p_vaddr) == PAGE_OFFSET(phdr0->p_offset)
128 
129   The load_bias must be added to any p_vaddr value read from the ELF file to
130   determine the corresponding memory address.
131 
132  **/
133 
134 #define MAYBE_MAP_FLAG(x, from, to)  (((x) & (from)) ? (to) : 0)
135 #define PFLAGS_TO_PROT(x)            (MAYBE_MAP_FLAG((x), PF_X, PROT_EXEC) | \
136                                       MAYBE_MAP_FLAG((x), PF_R, PROT_READ) | \
137                                       MAYBE_MAP_FLAG((x), PF_W, PROT_WRITE))
138 
ElfReader()139 ElfReader::ElfReader()
140     : did_read_(false), did_load_(false), fd_(-1), file_offset_(0), file_size_(0), phdr_num_(0),
141       phdr_table_(nullptr), shdr_table_(nullptr), shdr_num_(0), dynamic_(nullptr), strtab_(nullptr),
142       strtab_size_(0), load_start_(nullptr), load_size_(0), load_bias_(0), loaded_phdr_(nullptr),
143       mapped_by_caller_(false) {
144 }
145 
Read(const char * name,int fd,off64_t file_offset,off64_t file_size)146 bool ElfReader::Read(const char* name, int fd, off64_t file_offset, off64_t file_size) {
147   CHECK(!did_read_);
148   CHECK(!did_load_);
149   name_ = name;
150   fd_ = fd;
151   file_offset_ = file_offset;
152   file_size_ = file_size;
153 
154   if (ReadElfHeader() &&
155       VerifyElfHeader() &&
156       ReadProgramHeaders() &&
157       ReadSectionHeaders() &&
158       ReadDynamicSection()) {
159     did_read_ = true;
160   }
161 
162   return did_read_;
163 }
164 
Load(const android_dlextinfo * extinfo)165 bool ElfReader::Load(const android_dlextinfo* extinfo) {
166   CHECK(did_read_);
167   CHECK(!did_load_);
168   if (ReserveAddressSpace(extinfo) &&
169       LoadSegments() &&
170       FindPhdr()) {
171     did_load_ = true;
172   }
173 
174   return did_load_;
175 }
176 
get_string(ElfW (Word)index) const177 const char* ElfReader::get_string(ElfW(Word) index) const {
178   CHECK(strtab_ != nullptr);
179   CHECK(index < strtab_size_);
180 
181   return strtab_ + index;
182 }
183 
ReadElfHeader()184 bool ElfReader::ReadElfHeader() {
185   ssize_t rc = TEMP_FAILURE_RETRY(pread64(fd_, &header_, sizeof(header_), file_offset_));
186   if (rc < 0) {
187     DL_ERR("can't read file \"%s\": %s", name_.c_str(), strerror(errno));
188     return false;
189   }
190 
191   if (rc != sizeof(header_)) {
192     DL_ERR("\"%s\" is too small to be an ELF executable: only found %zd bytes", name_.c_str(),
193            static_cast<size_t>(rc));
194     return false;
195   }
196   return true;
197 }
198 
VerifyElfHeader()199 bool ElfReader::VerifyElfHeader() {
200   if (memcmp(header_.e_ident, ELFMAG, SELFMAG) != 0) {
201     DL_ERR("\"%s\" has bad ELF magic", name_.c_str());
202     return false;
203   }
204 
205   // Try to give a clear diagnostic for ELF class mismatches, since they're
206   // an easy mistake to make during the 32-bit/64-bit transition period.
207   int elf_class = header_.e_ident[EI_CLASS];
208 #if defined(__LP64__)
209   if (elf_class != ELFCLASS64) {
210     if (elf_class == ELFCLASS32) {
211       DL_ERR("\"%s\" is 32-bit instead of 64-bit", name_.c_str());
212     } else {
213       DL_ERR("\"%s\" has unknown ELF class: %d", name_.c_str(), elf_class);
214     }
215     return false;
216   }
217 #else
218   if (elf_class != ELFCLASS32) {
219     if (elf_class == ELFCLASS64) {
220       DL_ERR("\"%s\" is 64-bit instead of 32-bit", name_.c_str());
221     } else {
222       DL_ERR("\"%s\" has unknown ELF class: %d", name_.c_str(), elf_class);
223     }
224     return false;
225   }
226 #endif
227 
228   if (header_.e_ident[EI_DATA] != ELFDATA2LSB) {
229     DL_ERR("\"%s\" not little-endian: %d", name_.c_str(), header_.e_ident[EI_DATA]);
230     return false;
231   }
232 
233   if (header_.e_type != ET_DYN) {
234     DL_ERR("\"%s\" has unexpected e_type: %d", name_.c_str(), header_.e_type);
235     return false;
236   }
237 
238   if (header_.e_version != EV_CURRENT) {
239     DL_ERR("\"%s\" has unexpected e_version: %d", name_.c_str(), header_.e_version);
240     return false;
241   }
242 
243   if (header_.e_machine != GetTargetElfMachine()) {
244     DL_ERR("\"%s\" has unexpected e_machine: %d", name_.c_str(), header_.e_machine);
245     return false;
246   }
247 
248   return true;
249 }
250 
CheckFileRange(ElfW (Addr)offset,size_t size)251 bool ElfReader::CheckFileRange(ElfW(Addr) offset, size_t size) {
252   off64_t range_start;
253   off64_t range_end;
254 
255   return safe_add(&range_start, file_offset_, offset) &&
256          safe_add(&range_end, range_start, size) &&
257          range_start < file_size_ &&
258          range_end <= file_size_;
259 }
260 
261 // Loads the program header table from an ELF file into a read-only private
262 // anonymous mmap-ed block.
ReadProgramHeaders()263 bool ElfReader::ReadProgramHeaders() {
264   phdr_num_ = header_.e_phnum;
265 
266   // Like the kernel, we only accept program header tables that
267   // are smaller than 64KiB.
268   if (phdr_num_ < 1 || phdr_num_ > 65536/sizeof(ElfW(Phdr))) {
269     DL_ERR("\"%s\" has invalid e_phnum: %zd", name_.c_str(), phdr_num_);
270     return false;
271   }
272 
273   // Boundary checks
274   size_t size = phdr_num_ * sizeof(ElfW(Phdr));
275   if (!CheckFileRange(header_.e_phoff, size)) {
276     DL_ERR("\"%s\" has invalid phdr offset/size", name_.c_str());
277     return false;
278   }
279 
280   if (!phdr_fragment_.Map(fd_, file_offset_, header_.e_phoff, size)) {
281     DL_ERR("\"%s\" phdr mmap failed: %s", name_.c_str(), strerror(errno));
282     return false;
283   }
284 
285   phdr_table_ = static_cast<ElfW(Phdr)*>(phdr_fragment_.data());
286   return true;
287 }
288 
ReadSectionHeaders()289 bool ElfReader::ReadSectionHeaders() {
290   shdr_num_ = header_.e_shnum;
291 
292   if (shdr_num_ == 0) {
293     DL_ERR("\"%s\" has no section headers", name_.c_str());
294     return false;
295   }
296 
297   size_t size = shdr_num_ * sizeof(ElfW(Shdr));
298   if (!CheckFileRange(header_.e_shoff, size)) {
299     DL_ERR("\"%s\" has invalid shdr offset/size", name_.c_str());
300     return false;
301   }
302 
303   if (!shdr_fragment_.Map(fd_, file_offset_, header_.e_shoff, size)) {
304     DL_ERR("\"%s\" shdr mmap failed: %s", name_.c_str(), strerror(errno));
305     return false;
306   }
307 
308   shdr_table_ = static_cast<const ElfW(Shdr)*>(shdr_fragment_.data());
309   return true;
310 }
311 
ReadDynamicSection()312 bool ElfReader::ReadDynamicSection() {
313   // 1. Find .dynamic section (in section headers)
314   const ElfW(Shdr)* dynamic_shdr = nullptr;
315   for (size_t i = 0; i < shdr_num_; ++i) {
316     if (shdr_table_[i].sh_type == SHT_DYNAMIC) {
317       dynamic_shdr = &shdr_table_ [i];
318       break;
319     }
320   }
321 
322   if (dynamic_shdr == nullptr) {
323     DL_ERR("\"%s\" .dynamic section header was not found", name_.c_str());
324     return false;
325   }
326 
327   if (dynamic_shdr->sh_link >= shdr_num_) {
328     DL_ERR("\"%s\" .dynamic section has invalid sh_link: %d", name_.c_str(), dynamic_shdr->sh_link);
329     return false;
330   }
331 
332   const ElfW(Shdr)* strtab_shdr = &shdr_table_[dynamic_shdr->sh_link];
333 
334   if (strtab_shdr->sh_type != SHT_STRTAB) {
335     DL_ERR("\"%s\" .dynamic section has invalid link(%d) sh_type: %d (expected SHT_STRTAB)",
336            name_.c_str(), dynamic_shdr->sh_link, strtab_shdr->sh_type);
337     return false;
338   }
339 
340   if (!CheckFileRange(dynamic_shdr->sh_offset, dynamic_shdr->sh_size)) {
341     DL_ERR("\"%s\" has invalid offset/size of .dynamic section", name_.c_str());
342     PRINT("\"%s\" has invalid offset/size of .dynamic section", name_.c_str());
343     return false;
344   }
345 
346   if (!dynamic_fragment_.Map(fd_, file_offset_, dynamic_shdr->sh_offset, dynamic_shdr->sh_size)) {
347     DL_ERR("\"%s\" dynamic section mmap failed: %s", name_.c_str(), strerror(errno));
348     return false;
349   }
350 
351   dynamic_ = static_cast<const ElfW(Dyn)*>(dynamic_fragment_.data());
352 
353   if (!CheckFileRange(strtab_shdr->sh_offset, strtab_shdr->sh_size)) {
354     DL_ERR("\"%s\" has invalid offset/size of the .strtab section linked from .dynamic section",
355            name_.c_str());
356     return false;
357   }
358 
359   if (!strtab_fragment_.Map(fd_, file_offset_, strtab_shdr->sh_offset, strtab_shdr->sh_size)) {
360     DL_ERR("\"%s\" strtab section mmap failed: %s", name_.c_str(), strerror(errno));
361     return false;
362   }
363 
364   strtab_ = static_cast<const char*>(strtab_fragment_.data());
365   strtab_size_ = strtab_fragment_.size();
366   return true;
367 }
368 
369 /* Returns the size of the extent of all the possibly non-contiguous
370  * loadable segments in an ELF program header table. This corresponds
371  * to the page-aligned size in bytes that needs to be reserved in the
372  * process' address space. If there are no loadable segments, 0 is
373  * returned.
374  *
375  * If out_min_vaddr or out_max_vaddr are not null, they will be
376  * set to the minimum and maximum addresses of pages to be reserved,
377  * or 0 if there is nothing to load.
378  */
phdr_table_get_load_size(const ElfW (Phdr)* phdr_table,size_t phdr_count,ElfW (Addr)* out_min_vaddr,ElfW (Addr)* out_max_vaddr)379 size_t phdr_table_get_load_size(const ElfW(Phdr)* phdr_table, size_t phdr_count,
380                                 ElfW(Addr)* out_min_vaddr,
381                                 ElfW(Addr)* out_max_vaddr) {
382   ElfW(Addr) min_vaddr = UINTPTR_MAX;
383   ElfW(Addr) max_vaddr = 0;
384 
385   bool found_pt_load = false;
386   for (size_t i = 0; i < phdr_count; ++i) {
387     const ElfW(Phdr)* phdr = &phdr_table[i];
388 
389     if (phdr->p_type != PT_LOAD) {
390       continue;
391     }
392     found_pt_load = true;
393 
394     if (phdr->p_vaddr < min_vaddr) {
395       min_vaddr = phdr->p_vaddr;
396     }
397 
398     if (phdr->p_vaddr + phdr->p_memsz > max_vaddr) {
399       max_vaddr = phdr->p_vaddr + phdr->p_memsz;
400     }
401   }
402   if (!found_pt_load) {
403     min_vaddr = 0;
404   }
405 
406   min_vaddr = PAGE_START(min_vaddr);
407   max_vaddr = PAGE_END(max_vaddr);
408 
409   if (out_min_vaddr != nullptr) {
410     *out_min_vaddr = min_vaddr;
411   }
412   if (out_max_vaddr != nullptr) {
413     *out_max_vaddr = max_vaddr;
414   }
415   return max_vaddr - min_vaddr;
416 }
417 
418 // Reserve a virtual address range big enough to hold all loadable
419 // segments of a program header table. This is done by creating a
420 // private anonymous mmap() with PROT_NONE.
ReserveAddressSpace(const android_dlextinfo * extinfo)421 bool ElfReader::ReserveAddressSpace(const android_dlextinfo* extinfo) {
422   ElfW(Addr) min_vaddr;
423   load_size_ = phdr_table_get_load_size(phdr_table_, phdr_num_, &min_vaddr);
424   if (load_size_ == 0) {
425     DL_ERR("\"%s\" has no loadable segments", name_.c_str());
426     return false;
427   }
428 
429   uint8_t* addr = reinterpret_cast<uint8_t*>(min_vaddr);
430   void* start;
431   size_t reserved_size = 0;
432   bool reserved_hint = true;
433   bool strict_hint = false;
434   // Assume position independent executable by default.
435   void* mmap_hint = nullptr;
436 
437   if (extinfo != nullptr) {
438     if (extinfo->flags & ANDROID_DLEXT_RESERVED_ADDRESS) {
439       reserved_size = extinfo->reserved_size;
440       reserved_hint = false;
441     } else if (extinfo->flags & ANDROID_DLEXT_RESERVED_ADDRESS_HINT) {
442       reserved_size = extinfo->reserved_size;
443     }
444 
445     if (addr != nullptr && (extinfo->flags & ANDROID_DLEXT_FORCE_FIXED_VADDR) != 0) {
446       mmap_hint = addr;
447     } else if ((extinfo->flags & ANDROID_DLEXT_LOAD_AT_FIXED_ADDRESS) != 0) {
448       mmap_hint = extinfo->reserved_addr;
449       strict_hint = true;
450     }
451   }
452 
453   if (load_size_ > reserved_size) {
454     if (!reserved_hint) {
455       DL_ERR("reserved address space %zd smaller than %zd bytes needed for \"%s\"",
456              reserved_size - load_size_, load_size_, name_.c_str());
457       return false;
458     }
459     int mmap_flags = MAP_PRIVATE | MAP_ANONYMOUS;
460     start = mmap(mmap_hint, load_size_, PROT_NONE, mmap_flags, -1, 0);
461     if (start == MAP_FAILED) {
462       DL_ERR("couldn't reserve %zd bytes of address space for \"%s\"", load_size_, name_.c_str());
463       return false;
464     }
465     if (strict_hint && (start != mmap_hint)) {
466       munmap(start, load_size_);
467       DL_ERR("couldn't reserve %zd bytes of address space at %p for \"%s\"",
468              load_size_, mmap_hint, name_.c_str());
469       return false;
470     }
471   } else {
472     start = extinfo->reserved_addr;
473     mapped_by_caller_ = true;
474   }
475 
476   load_start_ = start;
477   load_bias_ = reinterpret_cast<uint8_t*>(start) - addr;
478   return true;
479 }
480 
LoadSegments()481 bool ElfReader::LoadSegments() {
482   for (size_t i = 0; i < phdr_num_; ++i) {
483     const ElfW(Phdr)* phdr = &phdr_table_[i];
484 
485     if (phdr->p_type != PT_LOAD) {
486       continue;
487     }
488 
489     // Segment addresses in memory.
490     ElfW(Addr) seg_start = phdr->p_vaddr + load_bias_;
491     ElfW(Addr) seg_end   = seg_start + phdr->p_memsz;
492 
493     ElfW(Addr) seg_page_start = PAGE_START(seg_start);
494     ElfW(Addr) seg_page_end   = PAGE_END(seg_end);
495 
496     ElfW(Addr) seg_file_end   = seg_start + phdr->p_filesz;
497 
498     // File offsets.
499     ElfW(Addr) file_start = phdr->p_offset;
500     ElfW(Addr) file_end   = file_start + phdr->p_filesz;
501 
502     ElfW(Addr) file_page_start = PAGE_START(file_start);
503     ElfW(Addr) file_length = file_end - file_page_start;
504 
505     if (file_size_ <= 0) {
506       DL_ERR("\"%s\" invalid file size: %" PRId64, name_.c_str(), file_size_);
507       return false;
508     }
509 
510     if (file_end > static_cast<size_t>(file_size_)) {
511       DL_ERR("invalid ELF file \"%s\" load segment[%zd]:"
512           " p_offset (%p) + p_filesz (%p) ( = %p) past end of file (0x%" PRIx64 ")",
513           name_.c_str(), i, reinterpret_cast<void*>(phdr->p_offset),
514           reinterpret_cast<void*>(phdr->p_filesz),
515           reinterpret_cast<void*>(file_end), file_size_);
516       return false;
517     }
518 
519     if (file_length != 0) {
520       void* seg_addr = mmap64(reinterpret_cast<void*>(seg_page_start),
521                             file_length,
522                             PFLAGS_TO_PROT(phdr->p_flags),
523                             MAP_FIXED|MAP_PRIVATE,
524                             fd_,
525                             file_offset_ + file_page_start);
526       if (seg_addr == MAP_FAILED) {
527         DL_ERR("couldn't map \"%s\" segment %zd: %s", name_.c_str(), i, strerror(errno));
528         return false;
529       }
530     }
531 
532     // if the segment is writable, and does not end on a page boundary,
533     // zero-fill it until the page limit.
534     if ((phdr->p_flags & PF_W) != 0 && PAGE_OFFSET(seg_file_end) > 0) {
535       memset(reinterpret_cast<void*>(seg_file_end), 0, PAGE_SIZE - PAGE_OFFSET(seg_file_end));
536     }
537 
538     seg_file_end = PAGE_END(seg_file_end);
539 
540     // seg_file_end is now the first page address after the file
541     // content. If seg_end is larger, we need to zero anything
542     // between them. This is done by using a private anonymous
543     // map for all extra pages.
544     if (seg_page_end > seg_file_end) {
545       size_t zeromap_size = seg_page_end - seg_file_end;
546       void* zeromap = mmap(reinterpret_cast<void*>(seg_file_end),
547                            zeromap_size,
548                            PFLAGS_TO_PROT(phdr->p_flags),
549                            MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE,
550                            -1,
551                            0);
552       if (zeromap == MAP_FAILED) {
553         DL_ERR("couldn't zero fill \"%s\" gap: %s", name_.c_str(), strerror(errno));
554         return false;
555       }
556 
557       prctl(PR_SET_VMA, PR_SET_VMA_ANON_NAME, zeromap, zeromap_size, ".bss");
558     }
559   }
560   return true;
561 }
562 
563 /* Used internally. Used to set the protection bits of all loaded segments
564  * with optional extra flags (i.e. really PROT_WRITE). Used by
565  * phdr_table_protect_segments and phdr_table_unprotect_segments.
566  */
_phdr_table_set_load_prot(const ElfW (Phdr)* phdr_table,size_t phdr_count,ElfW (Addr)load_bias,int extra_prot_flags)567 static int _phdr_table_set_load_prot(const ElfW(Phdr)* phdr_table, size_t phdr_count,
568                                      ElfW(Addr) load_bias, int extra_prot_flags) {
569   const ElfW(Phdr)* phdr = phdr_table;
570   const ElfW(Phdr)* phdr_limit = phdr + phdr_count;
571 
572   for (; phdr < phdr_limit; phdr++) {
573     if (phdr->p_type != PT_LOAD || (phdr->p_flags & PF_W) != 0) {
574       continue;
575     }
576 
577     ElfW(Addr) seg_page_start = PAGE_START(phdr->p_vaddr) + load_bias;
578     ElfW(Addr) seg_page_end   = PAGE_END(phdr->p_vaddr + phdr->p_memsz) + load_bias;
579 
580     int prot = PFLAGS_TO_PROT(phdr->p_flags);
581     if ((extra_prot_flags & PROT_WRITE) != 0) {
582       // make sure we're never simultaneously writable / executable
583       prot &= ~PROT_EXEC;
584     }
585 
586     int ret = mprotect(reinterpret_cast<void*>(seg_page_start),
587                        seg_page_end - seg_page_start,
588                        prot | extra_prot_flags);
589     if (ret < 0) {
590       return -1;
591     }
592   }
593   return 0;
594 }
595 
596 /* Restore the original protection modes for all loadable segments.
597  * You should only call this after phdr_table_unprotect_segments and
598  * applying all relocations.
599  *
600  * Input:
601  *   phdr_table  -> program header table
602  *   phdr_count  -> number of entries in tables
603  *   load_bias   -> load bias
604  * Return:
605  *   0 on error, -1 on failure (error code in errno).
606  */
phdr_table_protect_segments(const ElfW (Phdr)* phdr_table,size_t phdr_count,ElfW (Addr)load_bias)607 int phdr_table_protect_segments(const ElfW(Phdr)* phdr_table,
608                                 size_t phdr_count, ElfW(Addr) load_bias) {
609   return _phdr_table_set_load_prot(phdr_table, phdr_count, load_bias, 0);
610 }
611 
612 /* Change the protection of all loaded segments in memory to writable.
613  * This is useful before performing relocations. Once completed, you
614  * will have to call phdr_table_protect_segments to restore the original
615  * protection flags on all segments.
616  *
617  * Note that some writable segments can also have their content turned
618  * to read-only by calling phdr_table_protect_gnu_relro. This is no
619  * performed here.
620  *
621  * Input:
622  *   phdr_table  -> program header table
623  *   phdr_count  -> number of entries in tables
624  *   load_bias   -> load bias
625  * Return:
626  *   0 on error, -1 on failure (error code in errno).
627  */
phdr_table_unprotect_segments(const ElfW (Phdr)* phdr_table,size_t phdr_count,ElfW (Addr)load_bias)628 int phdr_table_unprotect_segments(const ElfW(Phdr)* phdr_table,
629                                   size_t phdr_count, ElfW(Addr) load_bias) {
630   return _phdr_table_set_load_prot(phdr_table, phdr_count, load_bias, PROT_WRITE);
631 }
632 
633 /* Used internally by phdr_table_protect_gnu_relro and
634  * phdr_table_unprotect_gnu_relro.
635  */
_phdr_table_set_gnu_relro_prot(const ElfW (Phdr)* phdr_table,size_t phdr_count,ElfW (Addr)load_bias,int prot_flags)636 static int _phdr_table_set_gnu_relro_prot(const ElfW(Phdr)* phdr_table, size_t phdr_count,
637                                           ElfW(Addr) load_bias, int prot_flags) {
638   const ElfW(Phdr)* phdr = phdr_table;
639   const ElfW(Phdr)* phdr_limit = phdr + phdr_count;
640 
641   for (phdr = phdr_table; phdr < phdr_limit; phdr++) {
642     if (phdr->p_type != PT_GNU_RELRO) {
643       continue;
644     }
645 
646     // Tricky: what happens when the relro segment does not start
647     // or end at page boundaries? We're going to be over-protective
648     // here and put every page touched by the segment as read-only.
649 
650     // This seems to match Ian Lance Taylor's description of the
651     // feature at http://www.airs.com/blog/archives/189.
652 
653     //    Extract:
654     //       Note that the current dynamic linker code will only work
655     //       correctly if the PT_GNU_RELRO segment starts on a page
656     //       boundary. This is because the dynamic linker rounds the
657     //       p_vaddr field down to the previous page boundary. If
658     //       there is anything on the page which should not be read-only,
659     //       the program is likely to fail at runtime. So in effect the
660     //       linker must only emit a PT_GNU_RELRO segment if it ensures
661     //       that it starts on a page boundary.
662     ElfW(Addr) seg_page_start = PAGE_START(phdr->p_vaddr) + load_bias;
663     ElfW(Addr) seg_page_end   = PAGE_END(phdr->p_vaddr + phdr->p_memsz) + load_bias;
664 
665     int ret = mprotect(reinterpret_cast<void*>(seg_page_start),
666                        seg_page_end - seg_page_start,
667                        prot_flags);
668     if (ret < 0) {
669       return -1;
670     }
671   }
672   return 0;
673 }
674 
675 /* Apply GNU relro protection if specified by the program header. This will
676  * turn some of the pages of a writable PT_LOAD segment to read-only, as
677  * specified by one or more PT_GNU_RELRO segments. This must be always
678  * performed after relocations.
679  *
680  * The areas typically covered are .got and .data.rel.ro, these are
681  * read-only from the program's POV, but contain absolute addresses
682  * that need to be relocated before use.
683  *
684  * Input:
685  *   phdr_table  -> program header table
686  *   phdr_count  -> number of entries in tables
687  *   load_bias   -> load bias
688  * Return:
689  *   0 on error, -1 on failure (error code in errno).
690  */
phdr_table_protect_gnu_relro(const ElfW (Phdr)* phdr_table,size_t phdr_count,ElfW (Addr)load_bias)691 int phdr_table_protect_gnu_relro(const ElfW(Phdr)* phdr_table,
692                                  size_t phdr_count, ElfW(Addr) load_bias) {
693   return _phdr_table_set_gnu_relro_prot(phdr_table, phdr_count, load_bias, PROT_READ);
694 }
695 
696 /* Serialize the GNU relro segments to the given file descriptor. This can be
697  * performed after relocations to allow another process to later share the
698  * relocated segment, if it was loaded at the same address.
699  *
700  * Input:
701  *   phdr_table  -> program header table
702  *   phdr_count  -> number of entries in tables
703  *   load_bias   -> load bias
704  *   fd          -> writable file descriptor to use
705  * Return:
706  *   0 on error, -1 on failure (error code in errno).
707  */
phdr_table_serialize_gnu_relro(const ElfW (Phdr)* phdr_table,size_t phdr_count,ElfW (Addr)load_bias,int fd)708 int phdr_table_serialize_gnu_relro(const ElfW(Phdr)* phdr_table,
709                                    size_t phdr_count,
710                                    ElfW(Addr) load_bias,
711                                    int fd) {
712   const ElfW(Phdr)* phdr = phdr_table;
713   const ElfW(Phdr)* phdr_limit = phdr + phdr_count;
714   ssize_t file_offset = 0;
715 
716   for (phdr = phdr_table; phdr < phdr_limit; phdr++) {
717     if (phdr->p_type != PT_GNU_RELRO) {
718       continue;
719     }
720 
721     ElfW(Addr) seg_page_start = PAGE_START(phdr->p_vaddr) + load_bias;
722     ElfW(Addr) seg_page_end   = PAGE_END(phdr->p_vaddr + phdr->p_memsz) + load_bias;
723     ssize_t size = seg_page_end - seg_page_start;
724 
725     ssize_t written = TEMP_FAILURE_RETRY(write(fd, reinterpret_cast<void*>(seg_page_start), size));
726     if (written != size) {
727       return -1;
728     }
729     void* map = mmap(reinterpret_cast<void*>(seg_page_start), size, PROT_READ,
730                      MAP_PRIVATE|MAP_FIXED, fd, file_offset);
731     if (map == MAP_FAILED) {
732       return -1;
733     }
734     file_offset += size;
735   }
736   return 0;
737 }
738 
739 /* Where possible, replace the GNU relro segments with mappings of the given
740  * file descriptor. This can be performed after relocations to allow a file
741  * previously created by phdr_table_serialize_gnu_relro in another process to
742  * replace the dirty relocated pages, saving memory, if it was loaded at the
743  * same address. We have to compare the data before we map over it, since some
744  * parts of the relro segment may not be identical due to other libraries in
745  * the process being loaded at different addresses.
746  *
747  * Input:
748  *   phdr_table  -> program header table
749  *   phdr_count  -> number of entries in tables
750  *   load_bias   -> load bias
751  *   fd          -> readable file descriptor to use
752  * Return:
753  *   0 on error, -1 on failure (error code in errno).
754  */
phdr_table_map_gnu_relro(const ElfW (Phdr)* phdr_table,size_t phdr_count,ElfW (Addr)load_bias,int fd)755 int phdr_table_map_gnu_relro(const ElfW(Phdr)* phdr_table,
756                              size_t phdr_count,
757                              ElfW(Addr) load_bias,
758                              int fd) {
759   // Map the file at a temporary location so we can compare its contents.
760   struct stat file_stat;
761   if (TEMP_FAILURE_RETRY(fstat(fd, &file_stat)) != 0) {
762     return -1;
763   }
764   off_t file_size = file_stat.st_size;
765   void* temp_mapping = nullptr;
766   if (file_size > 0) {
767     temp_mapping = mmap(nullptr, file_size, PROT_READ, MAP_PRIVATE, fd, 0);
768     if (temp_mapping == MAP_FAILED) {
769       return -1;
770     }
771   }
772   size_t file_offset = 0;
773 
774   // Iterate over the relro segments and compare/remap the pages.
775   const ElfW(Phdr)* phdr = phdr_table;
776   const ElfW(Phdr)* phdr_limit = phdr + phdr_count;
777 
778   for (phdr = phdr_table; phdr < phdr_limit; phdr++) {
779     if (phdr->p_type != PT_GNU_RELRO) {
780       continue;
781     }
782 
783     ElfW(Addr) seg_page_start = PAGE_START(phdr->p_vaddr) + load_bias;
784     ElfW(Addr) seg_page_end   = PAGE_END(phdr->p_vaddr + phdr->p_memsz) + load_bias;
785 
786     char* file_base = static_cast<char*>(temp_mapping) + file_offset;
787     char* mem_base = reinterpret_cast<char*>(seg_page_start);
788     size_t match_offset = 0;
789     size_t size = seg_page_end - seg_page_start;
790 
791     if (file_size - file_offset < size) {
792       // File is too short to compare to this segment. The contents are likely
793       // different as well (it's probably for a different library version) so
794       // just don't bother checking.
795       break;
796     }
797 
798     while (match_offset < size) {
799       // Skip over dissimilar pages.
800       while (match_offset < size &&
801              memcmp(mem_base + match_offset, file_base + match_offset, PAGE_SIZE) != 0) {
802         match_offset += PAGE_SIZE;
803       }
804 
805       // Count similar pages.
806       size_t mismatch_offset = match_offset;
807       while (mismatch_offset < size &&
808              memcmp(mem_base + mismatch_offset, file_base + mismatch_offset, PAGE_SIZE) == 0) {
809         mismatch_offset += PAGE_SIZE;
810       }
811 
812       // Map over similar pages.
813       if (mismatch_offset > match_offset) {
814         void* map = mmap(mem_base + match_offset, mismatch_offset - match_offset,
815                          PROT_READ, MAP_PRIVATE|MAP_FIXED, fd, match_offset);
816         if (map == MAP_FAILED) {
817           munmap(temp_mapping, file_size);
818           return -1;
819         }
820       }
821 
822       match_offset = mismatch_offset;
823     }
824 
825     // Add to the base file offset in case there are multiple relro segments.
826     file_offset += size;
827   }
828   munmap(temp_mapping, file_size);
829   return 0;
830 }
831 
832 
833 #if defined(__arm__)
834 
835 #  ifndef PT_ARM_EXIDX
836 #    define PT_ARM_EXIDX    0x70000001      /* .ARM.exidx segment */
837 #  endif
838 
839 /* Return the address and size of the .ARM.exidx section in memory,
840  * if present.
841  *
842  * Input:
843  *   phdr_table  -> program header table
844  *   phdr_count  -> number of entries in tables
845  *   load_bias   -> load bias
846  * Output:
847  *   arm_exidx       -> address of table in memory (null on failure).
848  *   arm_exidx_count -> number of items in table (0 on failure).
849  * Return:
850  *   0 on error, -1 on failure (_no_ error code in errno)
851  */
phdr_table_get_arm_exidx(const ElfW (Phdr)* phdr_table,size_t phdr_count,ElfW (Addr)load_bias,ElfW (Addr)** arm_exidx,size_t * arm_exidx_count)852 int phdr_table_get_arm_exidx(const ElfW(Phdr)* phdr_table, size_t phdr_count,
853                              ElfW(Addr) load_bias,
854                              ElfW(Addr)** arm_exidx, size_t* arm_exidx_count) {
855   const ElfW(Phdr)* phdr = phdr_table;
856   const ElfW(Phdr)* phdr_limit = phdr + phdr_count;
857 
858   for (phdr = phdr_table; phdr < phdr_limit; phdr++) {
859     if (phdr->p_type != PT_ARM_EXIDX) {
860       continue;
861     }
862 
863     *arm_exidx = reinterpret_cast<ElfW(Addr)*>(load_bias + phdr->p_vaddr);
864     *arm_exidx_count = phdr->p_memsz / 8;
865     return 0;
866   }
867   *arm_exidx = nullptr;
868   *arm_exidx_count = 0;
869   return -1;
870 }
871 #endif
872 
873 /* Return the address and size of the ELF file's .dynamic section in memory,
874  * or null if missing.
875  *
876  * Input:
877  *   phdr_table  -> program header table
878  *   phdr_count  -> number of entries in tables
879  *   load_bias   -> load bias
880  * Output:
881  *   dynamic       -> address of table in memory (null on failure).
882  *   dynamic_flags -> protection flags for section (unset on failure)
883  * Return:
884  *   void
885  */
phdr_table_get_dynamic_section(const ElfW (Phdr)* phdr_table,size_t phdr_count,ElfW (Addr)load_bias,ElfW (Dyn)** dynamic,ElfW (Word)* dynamic_flags)886 void phdr_table_get_dynamic_section(const ElfW(Phdr)* phdr_table, size_t phdr_count,
887                                     ElfW(Addr) load_bias, ElfW(Dyn)** dynamic,
888                                     ElfW(Word)* dynamic_flags) {
889   *dynamic = nullptr;
890   for (size_t i = 0; i<phdr_count; ++i) {
891     const ElfW(Phdr)& phdr = phdr_table[i];
892     if (phdr.p_type == PT_DYNAMIC) {
893       *dynamic = reinterpret_cast<ElfW(Dyn)*>(load_bias + phdr.p_vaddr);
894       if (dynamic_flags) {
895         *dynamic_flags = phdr.p_flags;
896       }
897       return;
898     }
899   }
900 }
901 
902 /* Return the program interpreter string, or nullptr if missing.
903  *
904  * Input:
905  *   phdr_table  -> program header table
906  *   phdr_count  -> number of entries in tables
907  *   load_bias   -> load bias
908  * Return:
909  *   pointer to the program interpreter string.
910  */
phdr_table_get_interpreter_name(const ElfW (Phdr)* phdr_table,size_t phdr_count,ElfW (Addr)load_bias)911 const char* phdr_table_get_interpreter_name(const ElfW(Phdr) * phdr_table, size_t phdr_count,
912                                             ElfW(Addr) load_bias) {
913   for (size_t i = 0; i<phdr_count; ++i) {
914     const ElfW(Phdr)& phdr = phdr_table[i];
915     if (phdr.p_type == PT_INTERP) {
916       return reinterpret_cast<const char*>(load_bias + phdr.p_vaddr);
917     }
918   }
919   return nullptr;
920 }
921 
922 // Sets loaded_phdr_ to the address of the program header table as it appears
923 // in the loaded segments in memory. This is in contrast with phdr_table_,
924 // which is temporary and will be released before the library is relocated.
FindPhdr()925 bool ElfReader::FindPhdr() {
926   const ElfW(Phdr)* phdr_limit = phdr_table_ + phdr_num_;
927 
928   // If there is a PT_PHDR, use it directly.
929   for (const ElfW(Phdr)* phdr = phdr_table_; phdr < phdr_limit; ++phdr) {
930     if (phdr->p_type == PT_PHDR) {
931       return CheckPhdr(load_bias_ + phdr->p_vaddr);
932     }
933   }
934 
935   // Otherwise, check the first loadable segment. If its file offset
936   // is 0, it starts with the ELF header, and we can trivially find the
937   // loaded program header from it.
938   for (const ElfW(Phdr)* phdr = phdr_table_; phdr < phdr_limit; ++phdr) {
939     if (phdr->p_type == PT_LOAD) {
940       if (phdr->p_offset == 0) {
941         ElfW(Addr)  elf_addr = load_bias_ + phdr->p_vaddr;
942         const ElfW(Ehdr)* ehdr = reinterpret_cast<const ElfW(Ehdr)*>(elf_addr);
943         ElfW(Addr)  offset = ehdr->e_phoff;
944         return CheckPhdr(reinterpret_cast<ElfW(Addr)>(ehdr) + offset);
945       }
946       break;
947     }
948   }
949 
950   DL_ERR("can't find loaded phdr for \"%s\"", name_.c_str());
951   return false;
952 }
953 
954 // Ensures that our program header is actually within a loadable
955 // segment. This should help catch badly-formed ELF files that
956 // would cause the linker to crash later when trying to access it.
CheckPhdr(ElfW (Addr)loaded)957 bool ElfReader::CheckPhdr(ElfW(Addr) loaded) {
958   const ElfW(Phdr)* phdr_limit = phdr_table_ + phdr_num_;
959   ElfW(Addr) loaded_end = loaded + (phdr_num_ * sizeof(ElfW(Phdr)));
960   for (const ElfW(Phdr)* phdr = phdr_table_; phdr < phdr_limit; ++phdr) {
961     if (phdr->p_type != PT_LOAD) {
962       continue;
963     }
964     ElfW(Addr) seg_start = phdr->p_vaddr + load_bias_;
965     ElfW(Addr) seg_end = phdr->p_filesz + seg_start;
966     if (seg_start <= loaded && loaded_end <= seg_end) {
967       loaded_phdr_ = reinterpret_cast<const ElfW(Phdr)*>(loaded);
968       return true;
969     }
970   }
971   DL_ERR("\"%s\" loaded phdr %p not in loadable segment",
972          name_.c_str(), reinterpret_cast<void*>(loaded));
973   return false;
974 }
975