1 /*
2 * Copyright (C) 2012 The Android Open Source Project
3 * All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * * Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * * Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in
12 * the documentation and/or other materials provided with the
13 * distribution.
14 *
15 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
16 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
17 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
18 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
19 * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
21 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
22 * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
23 * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
24 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
25 * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26 * SUCH DAMAGE.
27 */
28
29 #include "linker_phdr.h"
30
31 #include <errno.h>
32 #include <string.h>
33 #include <sys/mman.h>
34 #include <sys/types.h>
35 #include <sys/stat.h>
36 #include <unistd.h>
37
38 #include "linker.h"
39 #include "linker_dlwarning.h"
40 #include "linker_globals.h"
41 #include "linker_debug.h"
42 #include "linker_utils.h"
43
44 #include "private/bionic_prctl.h"
45 #include "private/CFIShadow.h" // For kLibraryAlignment
46
GetTargetElfMachine()47 static int GetTargetElfMachine() {
48 #if defined(__arm__)
49 return EM_ARM;
50 #elif defined(__aarch64__)
51 return EM_AARCH64;
52 #elif defined(__i386__)
53 return EM_386;
54 #elif defined(__mips__)
55 return EM_MIPS;
56 #elif defined(__x86_64__)
57 return EM_X86_64;
58 #endif
59 }
60
61 /**
62 TECHNICAL NOTE ON ELF LOADING.
63
64 An ELF file's program header table contains one or more PT_LOAD
65 segments, which corresponds to portions of the file that need to
66 be mapped into the process' address space.
67
68 Each loadable segment has the following important properties:
69
70 p_offset -> segment file offset
71 p_filesz -> segment file size
72 p_memsz -> segment memory size (always >= p_filesz)
73 p_vaddr -> segment's virtual address
74 p_flags -> segment flags (e.g. readable, writable, executable)
75
76 We will ignore the p_paddr and p_align fields of ElfW(Phdr) for now.
77
78 The loadable segments can be seen as a list of [p_vaddr ... p_vaddr+p_memsz)
79 ranges of virtual addresses. A few rules apply:
80
81 - the virtual address ranges should not overlap.
82
83 - if a segment's p_filesz is smaller than its p_memsz, the extra bytes
84 between them should always be initialized to 0.
85
86 - ranges do not necessarily start or end at page boundaries. Two distinct
87 segments can have their start and end on the same page. In this case, the
88 page inherits the mapping flags of the latter segment.
89
90 Finally, the real load addrs of each segment is not p_vaddr. Instead the
91 loader decides where to load the first segment, then will load all others
92 relative to the first one to respect the initial range layout.
93
94 For example, consider the following list:
95
96 [ offset:0, filesz:0x4000, memsz:0x4000, vaddr:0x30000 ],
97 [ offset:0x4000, filesz:0x2000, memsz:0x8000, vaddr:0x40000 ],
98
99 This corresponds to two segments that cover these virtual address ranges:
100
101 0x30000...0x34000
102 0x40000...0x48000
103
104 If the loader decides to load the first segment at address 0xa0000000
105 then the segments' load address ranges will be:
106
107 0xa0030000...0xa0034000
108 0xa0040000...0xa0048000
109
110 In other words, all segments must be loaded at an address that has the same
111 constant offset from their p_vaddr value. This offset is computed as the
112 difference between the first segment's load address, and its p_vaddr value.
113
114 However, in practice, segments do _not_ start at page boundaries. Since we
115 can only memory-map at page boundaries, this means that the bias is
116 computed as:
117
118 load_bias = phdr0_load_address - PAGE_START(phdr0->p_vaddr)
119
120 (NOTE: The value must be used as a 32-bit unsigned integer, to deal with
121 possible wrap around UINT32_MAX for possible large p_vaddr values).
122
123 And that the phdr0_load_address must start at a page boundary, with
124 the segment's real content starting at:
125
126 phdr0_load_address + PAGE_OFFSET(phdr0->p_vaddr)
127
128 Note that ELF requires the following condition to make the mmap()-ing work:
129
130 PAGE_OFFSET(phdr0->p_vaddr) == PAGE_OFFSET(phdr0->p_offset)
131
132 The load_bias must be added to any p_vaddr value read from the ELF file to
133 determine the corresponding memory address.
134
135 **/
136
137 #define MAYBE_MAP_FLAG(x, from, to) (((x) & (from)) ? (to) : 0)
138 #define PFLAGS_TO_PROT(x) (MAYBE_MAP_FLAG((x), PF_X, PROT_EXEC) | \
139 MAYBE_MAP_FLAG((x), PF_R, PROT_READ) | \
140 MAYBE_MAP_FLAG((x), PF_W, PROT_WRITE))
141
ElfReader()142 ElfReader::ElfReader()
143 : did_read_(false), did_load_(false), fd_(-1), file_offset_(0), file_size_(0), phdr_num_(0),
144 phdr_table_(nullptr), shdr_table_(nullptr), shdr_num_(0), dynamic_(nullptr), strtab_(nullptr),
145 strtab_size_(0), load_start_(nullptr), load_size_(0), load_bias_(0), loaded_phdr_(nullptr),
146 mapped_by_caller_(false) {
147 }
148
Read(const char * name,int fd,off64_t file_offset,off64_t file_size)149 bool ElfReader::Read(const char* name, int fd, off64_t file_offset, off64_t file_size) {
150 CHECK(!did_read_);
151 CHECK(!did_load_);
152 name_ = name;
153 fd_ = fd;
154 file_offset_ = file_offset;
155 file_size_ = file_size;
156
157 if (ReadElfHeader() &&
158 VerifyElfHeader() &&
159 ReadProgramHeaders() &&
160 ReadSectionHeaders() &&
161 ReadDynamicSection()) {
162 did_read_ = true;
163 }
164
165 return did_read_;
166 }
167
Load(const android_dlextinfo * extinfo)168 bool ElfReader::Load(const android_dlextinfo* extinfo) {
169 CHECK(did_read_);
170 CHECK(!did_load_);
171 if (ReserveAddressSpace(extinfo) &&
172 LoadSegments() &&
173 FindPhdr()) {
174 did_load_ = true;
175 }
176
177 return did_load_;
178 }
179
get_string(ElfW (Word)index) const180 const char* ElfReader::get_string(ElfW(Word) index) const {
181 CHECK(strtab_ != nullptr);
182 CHECK(index < strtab_size_);
183
184 return strtab_ + index;
185 }
186
ReadElfHeader()187 bool ElfReader::ReadElfHeader() {
188 ssize_t rc = TEMP_FAILURE_RETRY(pread64(fd_, &header_, sizeof(header_), file_offset_));
189 if (rc < 0) {
190 DL_ERR("can't read file \"%s\": %s", name_.c_str(), strerror(errno));
191 return false;
192 }
193
194 if (rc != sizeof(header_)) {
195 DL_ERR("\"%s\" is too small to be an ELF executable: only found %zd bytes", name_.c_str(),
196 static_cast<size_t>(rc));
197 return false;
198 }
199 return true;
200 }
201
VerifyElfHeader()202 bool ElfReader::VerifyElfHeader() {
203 if (memcmp(header_.e_ident, ELFMAG, SELFMAG) != 0) {
204 DL_ERR("\"%s\" has bad ELF magic", name_.c_str());
205 return false;
206 }
207
208 // Try to give a clear diagnostic for ELF class mismatches, since they're
209 // an easy mistake to make during the 32-bit/64-bit transition period.
210 int elf_class = header_.e_ident[EI_CLASS];
211 #if defined(__LP64__)
212 if (elf_class != ELFCLASS64) {
213 if (elf_class == ELFCLASS32) {
214 DL_ERR("\"%s\" is 32-bit instead of 64-bit", name_.c_str());
215 } else {
216 DL_ERR("\"%s\" has unknown ELF class: %d", name_.c_str(), elf_class);
217 }
218 return false;
219 }
220 #else
221 if (elf_class != ELFCLASS32) {
222 if (elf_class == ELFCLASS64) {
223 DL_ERR("\"%s\" is 64-bit instead of 32-bit", name_.c_str());
224 } else {
225 DL_ERR("\"%s\" has unknown ELF class: %d", name_.c_str(), elf_class);
226 }
227 return false;
228 }
229 #endif
230
231 if (header_.e_ident[EI_DATA] != ELFDATA2LSB) {
232 DL_ERR("\"%s\" not little-endian: %d", name_.c_str(), header_.e_ident[EI_DATA]);
233 return false;
234 }
235
236 if (header_.e_type != ET_DYN) {
237 DL_ERR("\"%s\" has unexpected e_type: %d", name_.c_str(), header_.e_type);
238 return false;
239 }
240
241 if (header_.e_version != EV_CURRENT) {
242 DL_ERR("\"%s\" has unexpected e_version: %d", name_.c_str(), header_.e_version);
243 return false;
244 }
245
246 if (header_.e_machine != GetTargetElfMachine()) {
247 DL_ERR("\"%s\" has unexpected e_machine: %d", name_.c_str(), header_.e_machine);
248 return false;
249 }
250
251 if (header_.e_shentsize != sizeof(ElfW(Shdr))) {
252 // Fail if app is targeting Android O or above
253 if (get_application_target_sdk_version() >= __ANDROID_API_O__) {
254 DL_ERR_AND_LOG("\"%s\" has unsupported e_shentsize: 0x%x (expected 0x%zx)",
255 name_.c_str(), header_.e_shentsize, sizeof(ElfW(Shdr)));
256 return false;
257 }
258 DL_WARN("\"%s\" has unsupported e_shentsize: 0x%x (expected 0x%zx)",
259 name_.c_str(), header_.e_shentsize, sizeof(ElfW(Shdr)));
260 add_dlwarning(name_.c_str(), "has invalid ELF header");
261 }
262
263 if (header_.e_shstrndx == 0) {
264 // Fail if app is targeting Android O or above
265 if (get_application_target_sdk_version() >= __ANDROID_API_O__) {
266 DL_ERR_AND_LOG("\"%s\" has invalid e_shstrndx", name_.c_str());
267 return false;
268 }
269
270 DL_WARN("\"%s\" has invalid e_shstrndx", name_.c_str());
271 add_dlwarning(name_.c_str(), "has invalid ELF header");
272 }
273
274 return true;
275 }
276
CheckFileRange(ElfW (Addr)offset,size_t size,size_t alignment)277 bool ElfReader::CheckFileRange(ElfW(Addr) offset, size_t size, size_t alignment) {
278 off64_t range_start;
279 off64_t range_end;
280
281 // Only header can be located at the 0 offset... This function called to
282 // check DYNSYM and DYNAMIC sections and phdr/shdr - none of them can be
283 // at offset 0.
284
285 return offset > 0 &&
286 safe_add(&range_start, file_offset_, offset) &&
287 safe_add(&range_end, range_start, size) &&
288 (range_start < file_size_) &&
289 (range_end <= file_size_) &&
290 ((offset % alignment) == 0);
291 }
292
293 // Loads the program header table from an ELF file into a read-only private
294 // anonymous mmap-ed block.
ReadProgramHeaders()295 bool ElfReader::ReadProgramHeaders() {
296 phdr_num_ = header_.e_phnum;
297
298 // Like the kernel, we only accept program header tables that
299 // are smaller than 64KiB.
300 if (phdr_num_ < 1 || phdr_num_ > 65536/sizeof(ElfW(Phdr))) {
301 DL_ERR("\"%s\" has invalid e_phnum: %zd", name_.c_str(), phdr_num_);
302 return false;
303 }
304
305 // Boundary checks
306 size_t size = phdr_num_ * sizeof(ElfW(Phdr));
307 if (!CheckFileRange(header_.e_phoff, size, alignof(ElfW(Phdr)))) {
308 DL_ERR_AND_LOG("\"%s\" has invalid phdr offset/size: %zu/%zu",
309 name_.c_str(),
310 static_cast<size_t>(header_.e_phoff),
311 size);
312 return false;
313 }
314
315 if (!phdr_fragment_.Map(fd_, file_offset_, header_.e_phoff, size)) {
316 DL_ERR("\"%s\" phdr mmap failed: %s", name_.c_str(), strerror(errno));
317 return false;
318 }
319
320 phdr_table_ = static_cast<ElfW(Phdr)*>(phdr_fragment_.data());
321 return true;
322 }
323
ReadSectionHeaders()324 bool ElfReader::ReadSectionHeaders() {
325 shdr_num_ = header_.e_shnum;
326
327 if (shdr_num_ == 0) {
328 DL_ERR_AND_LOG("\"%s\" has no section headers", name_.c_str());
329 return false;
330 }
331
332 size_t size = shdr_num_ * sizeof(ElfW(Shdr));
333 if (!CheckFileRange(header_.e_shoff, size, alignof(const ElfW(Shdr)))) {
334 DL_ERR_AND_LOG("\"%s\" has invalid shdr offset/size: %zu/%zu",
335 name_.c_str(),
336 static_cast<size_t>(header_.e_shoff),
337 size);
338 return false;
339 }
340
341 if (!shdr_fragment_.Map(fd_, file_offset_, header_.e_shoff, size)) {
342 DL_ERR("\"%s\" shdr mmap failed: %s", name_.c_str(), strerror(errno));
343 return false;
344 }
345
346 shdr_table_ = static_cast<const ElfW(Shdr)*>(shdr_fragment_.data());
347 return true;
348 }
349
ReadDynamicSection()350 bool ElfReader::ReadDynamicSection() {
351 // 1. Find .dynamic section (in section headers)
352 const ElfW(Shdr)* dynamic_shdr = nullptr;
353 for (size_t i = 0; i < shdr_num_; ++i) {
354 if (shdr_table_[i].sh_type == SHT_DYNAMIC) {
355 dynamic_shdr = &shdr_table_ [i];
356 break;
357 }
358 }
359
360 if (dynamic_shdr == nullptr) {
361 DL_ERR_AND_LOG("\"%s\" .dynamic section header was not found", name_.c_str());
362 return false;
363 }
364
365 // Make sure dynamic_shdr offset and size matches PT_DYNAMIC phdr
366 size_t pt_dynamic_offset = 0;
367 size_t pt_dynamic_filesz = 0;
368 for (size_t i = 0; i < phdr_num_; ++i) {
369 const ElfW(Phdr)* phdr = &phdr_table_[i];
370 if (phdr->p_type == PT_DYNAMIC) {
371 pt_dynamic_offset = phdr->p_offset;
372 pt_dynamic_filesz = phdr->p_filesz;
373 }
374 }
375
376 if (pt_dynamic_offset != dynamic_shdr->sh_offset) {
377 if (get_application_target_sdk_version() >= __ANDROID_API_O__) {
378 DL_ERR_AND_LOG("\"%s\" .dynamic section has invalid offset: 0x%zx, "
379 "expected to match PT_DYNAMIC offset: 0x%zx",
380 name_.c_str(),
381 static_cast<size_t>(dynamic_shdr->sh_offset),
382 pt_dynamic_offset);
383 return false;
384 }
385 DL_WARN("\"%s\" .dynamic section has invalid offset: 0x%zx, "
386 "expected to match PT_DYNAMIC offset: 0x%zx",
387 name_.c_str(),
388 static_cast<size_t>(dynamic_shdr->sh_offset),
389 pt_dynamic_offset);
390 add_dlwarning(name_.c_str(), "invalid .dynamic section");
391 }
392
393 if (pt_dynamic_filesz != dynamic_shdr->sh_size) {
394 if (get_application_target_sdk_version() >= __ANDROID_API_O__) {
395 DL_ERR_AND_LOG("\"%s\" .dynamic section has invalid size: 0x%zx, "
396 "expected to match PT_DYNAMIC filesz: 0x%zx",
397 name_.c_str(),
398 static_cast<size_t>(dynamic_shdr->sh_size),
399 pt_dynamic_filesz);
400 return false;
401 }
402 DL_WARN("\"%s\" .dynamic section has invalid size: 0x%zx, "
403 "expected to match PT_DYNAMIC filesz: 0x%zx",
404 name_.c_str(),
405 static_cast<size_t>(dynamic_shdr->sh_size),
406 pt_dynamic_filesz);
407 add_dlwarning(name_.c_str(), "invalid .dynamic section");
408 }
409
410 if (dynamic_shdr->sh_link >= shdr_num_) {
411 DL_ERR_AND_LOG("\"%s\" .dynamic section has invalid sh_link: %d",
412 name_.c_str(),
413 dynamic_shdr->sh_link);
414 return false;
415 }
416
417 const ElfW(Shdr)* strtab_shdr = &shdr_table_[dynamic_shdr->sh_link];
418
419 if (strtab_shdr->sh_type != SHT_STRTAB) {
420 DL_ERR_AND_LOG("\"%s\" .dynamic section has invalid link(%d) sh_type: %d (expected SHT_STRTAB)",
421 name_.c_str(), dynamic_shdr->sh_link, strtab_shdr->sh_type);
422 return false;
423 }
424
425 if (!CheckFileRange(dynamic_shdr->sh_offset, dynamic_shdr->sh_size, alignof(const ElfW(Dyn)))) {
426 DL_ERR_AND_LOG("\"%s\" has invalid offset/size of .dynamic section", name_.c_str());
427 return false;
428 }
429
430 if (!dynamic_fragment_.Map(fd_, file_offset_, dynamic_shdr->sh_offset, dynamic_shdr->sh_size)) {
431 DL_ERR("\"%s\" dynamic section mmap failed: %s", name_.c_str(), strerror(errno));
432 return false;
433 }
434
435 dynamic_ = static_cast<const ElfW(Dyn)*>(dynamic_fragment_.data());
436
437 if (!CheckFileRange(strtab_shdr->sh_offset, strtab_shdr->sh_size, alignof(const char))) {
438 DL_ERR_AND_LOG("\"%s\" has invalid offset/size of the .strtab section linked from .dynamic section",
439 name_.c_str());
440 return false;
441 }
442
443 if (!strtab_fragment_.Map(fd_, file_offset_, strtab_shdr->sh_offset, strtab_shdr->sh_size)) {
444 DL_ERR("\"%s\" strtab section mmap failed: %s", name_.c_str(), strerror(errno));
445 return false;
446 }
447
448 strtab_ = static_cast<const char*>(strtab_fragment_.data());
449 strtab_size_ = strtab_fragment_.size();
450 return true;
451 }
452
453 /* Returns the size of the extent of all the possibly non-contiguous
454 * loadable segments in an ELF program header table. This corresponds
455 * to the page-aligned size in bytes that needs to be reserved in the
456 * process' address space. If there are no loadable segments, 0 is
457 * returned.
458 *
459 * If out_min_vaddr or out_max_vaddr are not null, they will be
460 * set to the minimum and maximum addresses of pages to be reserved,
461 * or 0 if there is nothing to load.
462 */
phdr_table_get_load_size(const ElfW (Phdr)* phdr_table,size_t phdr_count,ElfW (Addr)* out_min_vaddr,ElfW (Addr)* out_max_vaddr)463 size_t phdr_table_get_load_size(const ElfW(Phdr)* phdr_table, size_t phdr_count,
464 ElfW(Addr)* out_min_vaddr,
465 ElfW(Addr)* out_max_vaddr) {
466 ElfW(Addr) min_vaddr = UINTPTR_MAX;
467 ElfW(Addr) max_vaddr = 0;
468
469 bool found_pt_load = false;
470 for (size_t i = 0; i < phdr_count; ++i) {
471 const ElfW(Phdr)* phdr = &phdr_table[i];
472
473 if (phdr->p_type != PT_LOAD) {
474 continue;
475 }
476 found_pt_load = true;
477
478 if (phdr->p_vaddr < min_vaddr) {
479 min_vaddr = phdr->p_vaddr;
480 }
481
482 if (phdr->p_vaddr + phdr->p_memsz > max_vaddr) {
483 max_vaddr = phdr->p_vaddr + phdr->p_memsz;
484 }
485 }
486 if (!found_pt_load) {
487 min_vaddr = 0;
488 }
489
490 min_vaddr = PAGE_START(min_vaddr);
491 max_vaddr = PAGE_END(max_vaddr);
492
493 if (out_min_vaddr != nullptr) {
494 *out_min_vaddr = min_vaddr;
495 }
496 if (out_max_vaddr != nullptr) {
497 *out_max_vaddr = max_vaddr;
498 }
499 return max_vaddr - min_vaddr;
500 }
501
502 // Reserve a virtual address range such that if it's limits were extended to the next 2**align
503 // boundary, it would not overlap with any existing mappings.
ReserveAligned(void * hint,size_t size,size_t align)504 static void* ReserveAligned(void* hint, size_t size, size_t align) {
505 int mmap_flags = MAP_PRIVATE | MAP_ANONYMOUS;
506 // Address hint is only used in Art for the image mapping, and it is pretty important. Don't mess
507 // with it.
508 // FIXME: try an aligned allocation and fall back to plain mmap() if the former does not provide a
509 // mapping at the requested address?
510 if (align == PAGE_SIZE || hint != nullptr) {
511 void* mmap_ptr = mmap(hint, size, PROT_NONE, mmap_flags, -1, 0);
512 if (mmap_ptr == MAP_FAILED) {
513 return nullptr;
514 }
515 return mmap_ptr;
516 }
517
518 // Allocate enough space so that the end of the desired region aligned up is still inside the
519 // mapping.
520 size_t mmap_size = align_up(size, align) + align - PAGE_SIZE;
521 uint8_t* mmap_ptr =
522 reinterpret_cast<uint8_t*>(mmap(nullptr, mmap_size, PROT_NONE, mmap_flags, -1, 0));
523 if (mmap_ptr == MAP_FAILED) {
524 return nullptr;
525 }
526
527 uint8_t* first = align_up(mmap_ptr, align);
528 uint8_t* last = align_down(mmap_ptr + mmap_size, align) - size;
529 size_t n = arc4random_uniform((last - first) / PAGE_SIZE + 1);
530 uint8_t* start = first + n * PAGE_SIZE;
531 munmap(mmap_ptr, start - mmap_ptr);
532 munmap(start + size, mmap_ptr + mmap_size - (start + size));
533 return start;
534 }
535
536 // Reserve a virtual address range big enough to hold all loadable
537 // segments of a program header table. This is done by creating a
538 // private anonymous mmap() with PROT_NONE.
ReserveAddressSpace(const android_dlextinfo * extinfo)539 bool ElfReader::ReserveAddressSpace(const android_dlextinfo* extinfo) {
540 ElfW(Addr) min_vaddr;
541 load_size_ = phdr_table_get_load_size(phdr_table_, phdr_num_, &min_vaddr);
542 if (load_size_ == 0) {
543 DL_ERR("\"%s\" has no loadable segments", name_.c_str());
544 return false;
545 }
546
547 uint8_t* addr = reinterpret_cast<uint8_t*>(min_vaddr);
548 void* start;
549 size_t reserved_size = 0;
550 bool reserved_hint = true;
551 bool strict_hint = false;
552 // Assume position independent executable by default.
553 void* mmap_hint = nullptr;
554
555 if (extinfo != nullptr) {
556 if (extinfo->flags & ANDROID_DLEXT_RESERVED_ADDRESS) {
557 reserved_size = extinfo->reserved_size;
558 reserved_hint = false;
559 } else if (extinfo->flags & ANDROID_DLEXT_RESERVED_ADDRESS_HINT) {
560 reserved_size = extinfo->reserved_size;
561 }
562
563 if (addr != nullptr && (extinfo->flags & ANDROID_DLEXT_FORCE_FIXED_VADDR) != 0) {
564 mmap_hint = addr;
565 } else if ((extinfo->flags & ANDROID_DLEXT_LOAD_AT_FIXED_ADDRESS) != 0) {
566 mmap_hint = extinfo->reserved_addr;
567 strict_hint = true;
568 }
569 }
570
571 if (load_size_ > reserved_size) {
572 if (!reserved_hint) {
573 DL_ERR("reserved address space %zd smaller than %zd bytes needed for \"%s\"",
574 reserved_size - load_size_, load_size_, name_.c_str());
575 return false;
576 }
577 start = ReserveAligned(mmap_hint, load_size_, kLibraryAlignment);
578 if (start == nullptr) {
579 DL_ERR("couldn't reserve %zd bytes of address space for \"%s\"", load_size_, name_.c_str());
580 return false;
581 }
582 if (strict_hint && (start != mmap_hint)) {
583 munmap(start, load_size_);
584 DL_ERR("couldn't reserve %zd bytes of address space at %p for \"%s\"",
585 load_size_, mmap_hint, name_.c_str());
586 return false;
587 }
588 } else {
589 start = extinfo->reserved_addr;
590 mapped_by_caller_ = true;
591 }
592
593 load_start_ = start;
594 load_bias_ = reinterpret_cast<uint8_t*>(start) - addr;
595 return true;
596 }
597
LoadSegments()598 bool ElfReader::LoadSegments() {
599 for (size_t i = 0; i < phdr_num_; ++i) {
600 const ElfW(Phdr)* phdr = &phdr_table_[i];
601
602 if (phdr->p_type != PT_LOAD) {
603 continue;
604 }
605
606 // Segment addresses in memory.
607 ElfW(Addr) seg_start = phdr->p_vaddr + load_bias_;
608 ElfW(Addr) seg_end = seg_start + phdr->p_memsz;
609
610 ElfW(Addr) seg_page_start = PAGE_START(seg_start);
611 ElfW(Addr) seg_page_end = PAGE_END(seg_end);
612
613 ElfW(Addr) seg_file_end = seg_start + phdr->p_filesz;
614
615 // File offsets.
616 ElfW(Addr) file_start = phdr->p_offset;
617 ElfW(Addr) file_end = file_start + phdr->p_filesz;
618
619 ElfW(Addr) file_page_start = PAGE_START(file_start);
620 ElfW(Addr) file_length = file_end - file_page_start;
621
622 if (file_size_ <= 0) {
623 DL_ERR("\"%s\" invalid file size: %" PRId64, name_.c_str(), file_size_);
624 return false;
625 }
626
627 if (file_end > static_cast<size_t>(file_size_)) {
628 DL_ERR("invalid ELF file \"%s\" load segment[%zd]:"
629 " p_offset (%p) + p_filesz (%p) ( = %p) past end of file (0x%" PRIx64 ")",
630 name_.c_str(), i, reinterpret_cast<void*>(phdr->p_offset),
631 reinterpret_cast<void*>(phdr->p_filesz),
632 reinterpret_cast<void*>(file_end), file_size_);
633 return false;
634 }
635
636 if (file_length != 0) {
637 int prot = PFLAGS_TO_PROT(phdr->p_flags);
638 if ((prot & (PROT_EXEC | PROT_WRITE)) == (PROT_EXEC | PROT_WRITE)) {
639 // W + E PT_LOAD segments are not allowed in O.
640 if (get_application_target_sdk_version() >= __ANDROID_API_O__) {
641 DL_ERR_AND_LOG("\"%s\": W + E load segments are not allowed", name_.c_str());
642 return false;
643 }
644 DL_WARN("\"%s\": W + E load segments are not allowed", name_.c_str());
645 add_dlwarning(name_.c_str(), "W+E load segments");
646 }
647
648 void* seg_addr = mmap64(reinterpret_cast<void*>(seg_page_start),
649 file_length,
650 prot,
651 MAP_FIXED|MAP_PRIVATE,
652 fd_,
653 file_offset_ + file_page_start);
654 if (seg_addr == MAP_FAILED) {
655 DL_ERR("couldn't map \"%s\" segment %zd: %s", name_.c_str(), i, strerror(errno));
656 return false;
657 }
658 }
659
660 // if the segment is writable, and does not end on a page boundary,
661 // zero-fill it until the page limit.
662 if ((phdr->p_flags & PF_W) != 0 && PAGE_OFFSET(seg_file_end) > 0) {
663 memset(reinterpret_cast<void*>(seg_file_end), 0, PAGE_SIZE - PAGE_OFFSET(seg_file_end));
664 }
665
666 seg_file_end = PAGE_END(seg_file_end);
667
668 // seg_file_end is now the first page address after the file
669 // content. If seg_end is larger, we need to zero anything
670 // between them. This is done by using a private anonymous
671 // map for all extra pages.
672 if (seg_page_end > seg_file_end) {
673 size_t zeromap_size = seg_page_end - seg_file_end;
674 void* zeromap = mmap(reinterpret_cast<void*>(seg_file_end),
675 zeromap_size,
676 PFLAGS_TO_PROT(phdr->p_flags),
677 MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE,
678 -1,
679 0);
680 if (zeromap == MAP_FAILED) {
681 DL_ERR("couldn't zero fill \"%s\" gap: %s", name_.c_str(), strerror(errno));
682 return false;
683 }
684
685 prctl(PR_SET_VMA, PR_SET_VMA_ANON_NAME, zeromap, zeromap_size, ".bss");
686 }
687 }
688 return true;
689 }
690
691 /* Used internally. Used to set the protection bits of all loaded segments
692 * with optional extra flags (i.e. really PROT_WRITE). Used by
693 * phdr_table_protect_segments and phdr_table_unprotect_segments.
694 */
_phdr_table_set_load_prot(const ElfW (Phdr)* phdr_table,size_t phdr_count,ElfW (Addr)load_bias,int extra_prot_flags)695 static int _phdr_table_set_load_prot(const ElfW(Phdr)* phdr_table, size_t phdr_count,
696 ElfW(Addr) load_bias, int extra_prot_flags) {
697 const ElfW(Phdr)* phdr = phdr_table;
698 const ElfW(Phdr)* phdr_limit = phdr + phdr_count;
699
700 for (; phdr < phdr_limit; phdr++) {
701 if (phdr->p_type != PT_LOAD || (phdr->p_flags & PF_W) != 0) {
702 continue;
703 }
704
705 ElfW(Addr) seg_page_start = PAGE_START(phdr->p_vaddr) + load_bias;
706 ElfW(Addr) seg_page_end = PAGE_END(phdr->p_vaddr + phdr->p_memsz) + load_bias;
707
708 int prot = PFLAGS_TO_PROT(phdr->p_flags);
709 if ((extra_prot_flags & PROT_WRITE) != 0) {
710 // make sure we're never simultaneously writable / executable
711 prot &= ~PROT_EXEC;
712 }
713
714 int ret = mprotect(reinterpret_cast<void*>(seg_page_start),
715 seg_page_end - seg_page_start,
716 prot | extra_prot_flags);
717 if (ret < 0) {
718 return -1;
719 }
720 }
721 return 0;
722 }
723
724 /* Restore the original protection modes for all loadable segments.
725 * You should only call this after phdr_table_unprotect_segments and
726 * applying all relocations.
727 *
728 * Input:
729 * phdr_table -> program header table
730 * phdr_count -> number of entries in tables
731 * load_bias -> load bias
732 * Return:
733 * 0 on error, -1 on failure (error code in errno).
734 */
phdr_table_protect_segments(const ElfW (Phdr)* phdr_table,size_t phdr_count,ElfW (Addr)load_bias)735 int phdr_table_protect_segments(const ElfW(Phdr)* phdr_table,
736 size_t phdr_count, ElfW(Addr) load_bias) {
737 return _phdr_table_set_load_prot(phdr_table, phdr_count, load_bias, 0);
738 }
739
740 /* Change the protection of all loaded segments in memory to writable.
741 * This is useful before performing relocations. Once completed, you
742 * will have to call phdr_table_protect_segments to restore the original
743 * protection flags on all segments.
744 *
745 * Note that some writable segments can also have their content turned
746 * to read-only by calling phdr_table_protect_gnu_relro. This is no
747 * performed here.
748 *
749 * Input:
750 * phdr_table -> program header table
751 * phdr_count -> number of entries in tables
752 * load_bias -> load bias
753 * Return:
754 * 0 on error, -1 on failure (error code in errno).
755 */
phdr_table_unprotect_segments(const ElfW (Phdr)* phdr_table,size_t phdr_count,ElfW (Addr)load_bias)756 int phdr_table_unprotect_segments(const ElfW(Phdr)* phdr_table,
757 size_t phdr_count, ElfW(Addr) load_bias) {
758 return _phdr_table_set_load_prot(phdr_table, phdr_count, load_bias, PROT_WRITE);
759 }
760
761 /* Used internally by phdr_table_protect_gnu_relro and
762 * phdr_table_unprotect_gnu_relro.
763 */
_phdr_table_set_gnu_relro_prot(const ElfW (Phdr)* phdr_table,size_t phdr_count,ElfW (Addr)load_bias,int prot_flags)764 static int _phdr_table_set_gnu_relro_prot(const ElfW(Phdr)* phdr_table, size_t phdr_count,
765 ElfW(Addr) load_bias, int prot_flags) {
766 const ElfW(Phdr)* phdr = phdr_table;
767 const ElfW(Phdr)* phdr_limit = phdr + phdr_count;
768
769 for (phdr = phdr_table; phdr < phdr_limit; phdr++) {
770 if (phdr->p_type != PT_GNU_RELRO) {
771 continue;
772 }
773
774 // Tricky: what happens when the relro segment does not start
775 // or end at page boundaries? We're going to be over-protective
776 // here and put every page touched by the segment as read-only.
777
778 // This seems to match Ian Lance Taylor's description of the
779 // feature at http://www.airs.com/blog/archives/189.
780
781 // Extract:
782 // Note that the current dynamic linker code will only work
783 // correctly if the PT_GNU_RELRO segment starts on a page
784 // boundary. This is because the dynamic linker rounds the
785 // p_vaddr field down to the previous page boundary. If
786 // there is anything on the page which should not be read-only,
787 // the program is likely to fail at runtime. So in effect the
788 // linker must only emit a PT_GNU_RELRO segment if it ensures
789 // that it starts on a page boundary.
790 ElfW(Addr) seg_page_start = PAGE_START(phdr->p_vaddr) + load_bias;
791 ElfW(Addr) seg_page_end = PAGE_END(phdr->p_vaddr + phdr->p_memsz) + load_bias;
792
793 int ret = mprotect(reinterpret_cast<void*>(seg_page_start),
794 seg_page_end - seg_page_start,
795 prot_flags);
796 if (ret < 0) {
797 return -1;
798 }
799 }
800 return 0;
801 }
802
803 /* Apply GNU relro protection if specified by the program header. This will
804 * turn some of the pages of a writable PT_LOAD segment to read-only, as
805 * specified by one or more PT_GNU_RELRO segments. This must be always
806 * performed after relocations.
807 *
808 * The areas typically covered are .got and .data.rel.ro, these are
809 * read-only from the program's POV, but contain absolute addresses
810 * that need to be relocated before use.
811 *
812 * Input:
813 * phdr_table -> program header table
814 * phdr_count -> number of entries in tables
815 * load_bias -> load bias
816 * Return:
817 * 0 on error, -1 on failure (error code in errno).
818 */
phdr_table_protect_gnu_relro(const ElfW (Phdr)* phdr_table,size_t phdr_count,ElfW (Addr)load_bias)819 int phdr_table_protect_gnu_relro(const ElfW(Phdr)* phdr_table,
820 size_t phdr_count, ElfW(Addr) load_bias) {
821 return _phdr_table_set_gnu_relro_prot(phdr_table, phdr_count, load_bias, PROT_READ);
822 }
823
824 /* Serialize the GNU relro segments to the given file descriptor. This can be
825 * performed after relocations to allow another process to later share the
826 * relocated segment, if it was loaded at the same address.
827 *
828 * Input:
829 * phdr_table -> program header table
830 * phdr_count -> number of entries in tables
831 * load_bias -> load bias
832 * fd -> writable file descriptor to use
833 * Return:
834 * 0 on error, -1 on failure (error code in errno).
835 */
phdr_table_serialize_gnu_relro(const ElfW (Phdr)* phdr_table,size_t phdr_count,ElfW (Addr)load_bias,int fd)836 int phdr_table_serialize_gnu_relro(const ElfW(Phdr)* phdr_table,
837 size_t phdr_count,
838 ElfW(Addr) load_bias,
839 int fd) {
840 const ElfW(Phdr)* phdr = phdr_table;
841 const ElfW(Phdr)* phdr_limit = phdr + phdr_count;
842 ssize_t file_offset = 0;
843
844 for (phdr = phdr_table; phdr < phdr_limit; phdr++) {
845 if (phdr->p_type != PT_GNU_RELRO) {
846 continue;
847 }
848
849 ElfW(Addr) seg_page_start = PAGE_START(phdr->p_vaddr) + load_bias;
850 ElfW(Addr) seg_page_end = PAGE_END(phdr->p_vaddr + phdr->p_memsz) + load_bias;
851 ssize_t size = seg_page_end - seg_page_start;
852
853 ssize_t written = TEMP_FAILURE_RETRY(write(fd, reinterpret_cast<void*>(seg_page_start), size));
854 if (written != size) {
855 return -1;
856 }
857 void* map = mmap(reinterpret_cast<void*>(seg_page_start), size, PROT_READ,
858 MAP_PRIVATE|MAP_FIXED, fd, file_offset);
859 if (map == MAP_FAILED) {
860 return -1;
861 }
862 file_offset += size;
863 }
864 return 0;
865 }
866
867 /* Where possible, replace the GNU relro segments with mappings of the given
868 * file descriptor. This can be performed after relocations to allow a file
869 * previously created by phdr_table_serialize_gnu_relro in another process to
870 * replace the dirty relocated pages, saving memory, if it was loaded at the
871 * same address. We have to compare the data before we map over it, since some
872 * parts of the relro segment may not be identical due to other libraries in
873 * the process being loaded at different addresses.
874 *
875 * Input:
876 * phdr_table -> program header table
877 * phdr_count -> number of entries in tables
878 * load_bias -> load bias
879 * fd -> readable file descriptor to use
880 * Return:
881 * 0 on error, -1 on failure (error code in errno).
882 */
phdr_table_map_gnu_relro(const ElfW (Phdr)* phdr_table,size_t phdr_count,ElfW (Addr)load_bias,int fd)883 int phdr_table_map_gnu_relro(const ElfW(Phdr)* phdr_table,
884 size_t phdr_count,
885 ElfW(Addr) load_bias,
886 int fd) {
887 // Map the file at a temporary location so we can compare its contents.
888 struct stat file_stat;
889 if (TEMP_FAILURE_RETRY(fstat(fd, &file_stat)) != 0) {
890 return -1;
891 }
892 off_t file_size = file_stat.st_size;
893 void* temp_mapping = nullptr;
894 if (file_size > 0) {
895 temp_mapping = mmap(nullptr, file_size, PROT_READ, MAP_PRIVATE, fd, 0);
896 if (temp_mapping == MAP_FAILED) {
897 return -1;
898 }
899 }
900 size_t file_offset = 0;
901
902 // Iterate over the relro segments and compare/remap the pages.
903 const ElfW(Phdr)* phdr = phdr_table;
904 const ElfW(Phdr)* phdr_limit = phdr + phdr_count;
905
906 for (phdr = phdr_table; phdr < phdr_limit; phdr++) {
907 if (phdr->p_type != PT_GNU_RELRO) {
908 continue;
909 }
910
911 ElfW(Addr) seg_page_start = PAGE_START(phdr->p_vaddr) + load_bias;
912 ElfW(Addr) seg_page_end = PAGE_END(phdr->p_vaddr + phdr->p_memsz) + load_bias;
913
914 char* file_base = static_cast<char*>(temp_mapping) + file_offset;
915 char* mem_base = reinterpret_cast<char*>(seg_page_start);
916 size_t match_offset = 0;
917 size_t size = seg_page_end - seg_page_start;
918
919 if (file_size - file_offset < size) {
920 // File is too short to compare to this segment. The contents are likely
921 // different as well (it's probably for a different library version) so
922 // just don't bother checking.
923 break;
924 }
925
926 while (match_offset < size) {
927 // Skip over dissimilar pages.
928 while (match_offset < size &&
929 memcmp(mem_base + match_offset, file_base + match_offset, PAGE_SIZE) != 0) {
930 match_offset += PAGE_SIZE;
931 }
932
933 // Count similar pages.
934 size_t mismatch_offset = match_offset;
935 while (mismatch_offset < size &&
936 memcmp(mem_base + mismatch_offset, file_base + mismatch_offset, PAGE_SIZE) == 0) {
937 mismatch_offset += PAGE_SIZE;
938 }
939
940 // Map over similar pages.
941 if (mismatch_offset > match_offset) {
942 void* map = mmap(mem_base + match_offset, mismatch_offset - match_offset,
943 PROT_READ, MAP_PRIVATE|MAP_FIXED, fd, match_offset);
944 if (map == MAP_FAILED) {
945 munmap(temp_mapping, file_size);
946 return -1;
947 }
948 }
949
950 match_offset = mismatch_offset;
951 }
952
953 // Add to the base file offset in case there are multiple relro segments.
954 file_offset += size;
955 }
956 munmap(temp_mapping, file_size);
957 return 0;
958 }
959
960
961 #if defined(__arm__)
962
963 # ifndef PT_ARM_EXIDX
964 # define PT_ARM_EXIDX 0x70000001 /* .ARM.exidx segment */
965 # endif
966
967 /* Return the address and size of the .ARM.exidx section in memory,
968 * if present.
969 *
970 * Input:
971 * phdr_table -> program header table
972 * phdr_count -> number of entries in tables
973 * load_bias -> load bias
974 * Output:
975 * arm_exidx -> address of table in memory (null on failure).
976 * arm_exidx_count -> number of items in table (0 on failure).
977 * Return:
978 * 0 on error, -1 on failure (_no_ error code in errno)
979 */
phdr_table_get_arm_exidx(const ElfW (Phdr)* phdr_table,size_t phdr_count,ElfW (Addr)load_bias,ElfW (Addr)** arm_exidx,size_t * arm_exidx_count)980 int phdr_table_get_arm_exidx(const ElfW(Phdr)* phdr_table, size_t phdr_count,
981 ElfW(Addr) load_bias,
982 ElfW(Addr)** arm_exidx, size_t* arm_exidx_count) {
983 const ElfW(Phdr)* phdr = phdr_table;
984 const ElfW(Phdr)* phdr_limit = phdr + phdr_count;
985
986 for (phdr = phdr_table; phdr < phdr_limit; phdr++) {
987 if (phdr->p_type != PT_ARM_EXIDX) {
988 continue;
989 }
990
991 *arm_exidx = reinterpret_cast<ElfW(Addr)*>(load_bias + phdr->p_vaddr);
992 *arm_exidx_count = phdr->p_memsz / 8;
993 return 0;
994 }
995 *arm_exidx = nullptr;
996 *arm_exidx_count = 0;
997 return -1;
998 }
999 #endif
1000
1001 /* Return the address and size of the ELF file's .dynamic section in memory,
1002 * or null if missing.
1003 *
1004 * Input:
1005 * phdr_table -> program header table
1006 * phdr_count -> number of entries in tables
1007 * load_bias -> load bias
1008 * Output:
1009 * dynamic -> address of table in memory (null on failure).
1010 * dynamic_flags -> protection flags for section (unset on failure)
1011 * Return:
1012 * void
1013 */
phdr_table_get_dynamic_section(const ElfW (Phdr)* phdr_table,size_t phdr_count,ElfW (Addr)load_bias,ElfW (Dyn)** dynamic,ElfW (Word)* dynamic_flags)1014 void phdr_table_get_dynamic_section(const ElfW(Phdr)* phdr_table, size_t phdr_count,
1015 ElfW(Addr) load_bias, ElfW(Dyn)** dynamic,
1016 ElfW(Word)* dynamic_flags) {
1017 *dynamic = nullptr;
1018 for (size_t i = 0; i<phdr_count; ++i) {
1019 const ElfW(Phdr)& phdr = phdr_table[i];
1020 if (phdr.p_type == PT_DYNAMIC) {
1021 *dynamic = reinterpret_cast<ElfW(Dyn)*>(load_bias + phdr.p_vaddr);
1022 if (dynamic_flags) {
1023 *dynamic_flags = phdr.p_flags;
1024 }
1025 return;
1026 }
1027 }
1028 }
1029
1030 /* Return the program interpreter string, or nullptr if missing.
1031 *
1032 * Input:
1033 * phdr_table -> program header table
1034 * phdr_count -> number of entries in tables
1035 * load_bias -> load bias
1036 * Return:
1037 * pointer to the program interpreter string.
1038 */
phdr_table_get_interpreter_name(const ElfW (Phdr)* phdr_table,size_t phdr_count,ElfW (Addr)load_bias)1039 const char* phdr_table_get_interpreter_name(const ElfW(Phdr) * phdr_table, size_t phdr_count,
1040 ElfW(Addr) load_bias) {
1041 for (size_t i = 0; i<phdr_count; ++i) {
1042 const ElfW(Phdr)& phdr = phdr_table[i];
1043 if (phdr.p_type == PT_INTERP) {
1044 return reinterpret_cast<const char*>(load_bias + phdr.p_vaddr);
1045 }
1046 }
1047 return nullptr;
1048 }
1049
1050 // Sets loaded_phdr_ to the address of the program header table as it appears
1051 // in the loaded segments in memory. This is in contrast with phdr_table_,
1052 // which is temporary and will be released before the library is relocated.
FindPhdr()1053 bool ElfReader::FindPhdr() {
1054 const ElfW(Phdr)* phdr_limit = phdr_table_ + phdr_num_;
1055
1056 // If there is a PT_PHDR, use it directly.
1057 for (const ElfW(Phdr)* phdr = phdr_table_; phdr < phdr_limit; ++phdr) {
1058 if (phdr->p_type == PT_PHDR) {
1059 return CheckPhdr(load_bias_ + phdr->p_vaddr);
1060 }
1061 }
1062
1063 // Otherwise, check the first loadable segment. If its file offset
1064 // is 0, it starts with the ELF header, and we can trivially find the
1065 // loaded program header from it.
1066 for (const ElfW(Phdr)* phdr = phdr_table_; phdr < phdr_limit; ++phdr) {
1067 if (phdr->p_type == PT_LOAD) {
1068 if (phdr->p_offset == 0) {
1069 ElfW(Addr) elf_addr = load_bias_ + phdr->p_vaddr;
1070 const ElfW(Ehdr)* ehdr = reinterpret_cast<const ElfW(Ehdr)*>(elf_addr);
1071 ElfW(Addr) offset = ehdr->e_phoff;
1072 return CheckPhdr(reinterpret_cast<ElfW(Addr)>(ehdr) + offset);
1073 }
1074 break;
1075 }
1076 }
1077
1078 DL_ERR("can't find loaded phdr for \"%s\"", name_.c_str());
1079 return false;
1080 }
1081
1082 // Ensures that our program header is actually within a loadable
1083 // segment. This should help catch badly-formed ELF files that
1084 // would cause the linker to crash later when trying to access it.
CheckPhdr(ElfW (Addr)loaded)1085 bool ElfReader::CheckPhdr(ElfW(Addr) loaded) {
1086 const ElfW(Phdr)* phdr_limit = phdr_table_ + phdr_num_;
1087 ElfW(Addr) loaded_end = loaded + (phdr_num_ * sizeof(ElfW(Phdr)));
1088 for (const ElfW(Phdr)* phdr = phdr_table_; phdr < phdr_limit; ++phdr) {
1089 if (phdr->p_type != PT_LOAD) {
1090 continue;
1091 }
1092 ElfW(Addr) seg_start = phdr->p_vaddr + load_bias_;
1093 ElfW(Addr) seg_end = phdr->p_filesz + seg_start;
1094 if (seg_start <= loaded && loaded_end <= seg_end) {
1095 loaded_phdr_ = reinterpret_cast<const ElfW(Phdr)*>(loaded);
1096 return true;
1097 }
1098 }
1099 DL_ERR("\"%s\" loaded phdr %p not in loadable segment",
1100 name_.c_str(), reinterpret_cast<void*>(loaded));
1101 return false;
1102 }
1103