+2004-03-26 Ulrich Drepper <drepper@redhat.com>
+
+ * elf/dl-caller.c: New file.
+ * include/caller.h: New file.
+ * Makefile (distribute): Add include/caller.h.
+ * elf/Makefile (dl-routines): Add dl-caller.
+ * elf/dl-load.c (_dl_map_object_from_fd): Record l_text_end.
+ * elf/dl-open.c (check_libc_caller): Removed.
+ (dl_open_worker): Use __check_caller instead.
+ * elf/rtld.c (_rtld_global_ro): Initialize _dl_check_caller.
+ (_dl_start_final): Record l_text_end for ld.so map.
+ (dl_main): Record l_text_end for main object and vdso.
+ * include/link.h (struct link_map): Add l_text_end field.
+ * sysdeps/generic/ldsodefs.h (struct rtld_global_ro): Add
+ _dl_check_caller field.
+ Define enum allowmask. Add declaration of _dl_check_caller.
+ * sysdeps/unix/sysv/linux/dl-execstack.c: Also use __check_caller test.
+
2004-03-26 Richard Henderson <rth@redhat.com>
* sysdeps/alpha/Makefile <gnulib> (sysdep_routines): Merge divrem
rpm/template rpm/rpmrc abi-tags stub-tag.h \
test-skeleton.c include/des.h include/libc-internal.h \
include/shlib-compat.h include/pthread.h Versions.def \
- cppflags-iterator.mk tls.make.c \
+ cppflags-iterator.mk tls.make.c include/caller.h \
include/stubs-prologue.h include/gnu/stubs.h \
include/atomic.h bits/atomic.h symbol-hacks.h \
INTERFACE CONFORMANCE NAMESPACE LICENSES \
dl-routines = $(addprefix dl-,load cache lookup object reloc deps \
runtime error init fini debug misc \
version profile conflict tls origin \
- execstack)
+ execstack caller)
all-dl-routines = $(dl-routines) $(sysdep-dl-routines)
# But they are absent from the shared libc, because that code is in ld.so.
elide-routines.os = $(all-dl-routines) dl-support enbl-secure dl-origin
--- /dev/null
+/* Check whether caller comes from the right place.
+ Copyright (C) 2004 Free Software Foundation, Inc.
+ This file is part of the GNU C Library.
+
+ The GNU C Library is free software; you can redistribute it and/or
+ modify it under the terms of the GNU Lesser General Public
+ License as published by the Free Software Foundation; either
+ version 2.1 of the License, or (at your option) any later version.
+
+ The GNU C Library is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+ Lesser General Public License for more details.
+
+ You should have received a copy of the GNU Lesser General Public
+ License along with the GNU C Library; if not, write to the Free
+ Software Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA
+ 02111-1307 USA. */
+
+#include <assert.h>
+#include <ldsodefs.h>
+#include <stddef.h>
+#include <caller.h>
+#include <gnu/lib-names.h>
+
+
+int
+attribute_hidden
+_dl_check_caller (const void *caller, enum allowmask mask)
+{
+ static const char expected1[] = LIBC_SO;
+ static const char expected2[] = LIBDL_SO;
+#ifdef LIBPTHREAD_SO
+ static const char expected3[] = LIBPTHREAD_SO;
+#endif
+ static const char expected4[] = LD_SO;
+
+ for (struct link_map *l = GL(dl_loaded); l != NULL; l = l->l_next)
+ if (caller >= (const void *) l->l_map_start
+ && caller < (const void *) l->l_text_end)
+ {
+ /* The address falls into this DSO's address range. Check the
+ name. */
+ if ((mask & allow_libc) && strcmp (expected1, l->l_name) == 0)
+ return 0;
+ if ((mask & allow_libdl) && strcmp (expected2, l->l_name) == 0)
+ return 0;
+#ifdef LIBPTHREAD_SO
+ if ((mask & allow_libpthread) && strcmp (expected3, l->l_name) == 0)
+ return 0;
+#endif
+ if ((mask & allow_ldso) && strcmp (expected4, l->l_name) == 0)
+ return 0;
+
+ struct libname_list *runp = l->l_libname;
+
+ while (runp != NULL)
+ {
+ if ((mask & allow_libc) && strcmp (expected1, runp->name) == 0)
+ return 0;
+ if ((mask & allow_libdl) && strcmp (expected2, runp->name) == 0)
+ return 0;
+#ifdef LIBPTHREAD_SO
+ if ((mask & allow_libpthread)
+ && strcmp (expected3, runp->name) == 0)
+ return 0;
+#endif
+ if ((mask & allow_ldso) && strcmp (expected4, runp->name) == 0)
+ return 0;
+
+ runp = runp->next;
+ }
+
+ break;
+ }
+
+ /* Maybe the dynamic linker is not yet on the list. */
+ if ((mask & allow_ldso) != 0
+ && caller >= (const void *) GL(dl_rtld_map).l_map_start
+ && caller < (const void *) GL(dl_rtld_map).l_text_end)
+ return 0;
+
+ /* No valid caller. */
+ return 1;
+}
unallocated. Then jump into the normal segment-mapping loop to
handle the portion of the segment past the end of the file
mapping. */
- __mprotect ((caddr_t) (l->l_addr + c->mapend),
+ __mprotect ((caddr_t) l->l_text_end,
loadcmds[nloadcmds - 1].allocend - c->mapend,
PROT_NONE);
goto map_error;
postmap:
+ if (c->prot & PROT_EXEC)
+ l->l_text_end = l->l_addr + c->mapend;
+
if (l->l_phdr == 0
&& (ElfW(Off)) c->mapoff <= header->e_phoff
&& ((size_t) (c->mapend - c->mapstart + c->mapoff)
#include <bits/libc-lock.h>
#include <ldsodefs.h>
#include <bp-sym.h>
-#include <gnu/lib-names.h>
+#include <caller.h>
#include <dl-dst.h>
}
-#ifdef SHARED
-static int
-internal_function
-check_libc_caller (const void *caller)
-{
- static const char expected1[] = LIBC_SO;
- static const char expected2[] = LIBDL_SO;
-
- /* If we already know the address ranges, just test. */
- static const void *expected1_from;
- static const void *expected1_to;
- static const void *expected2_from;
- static const void *expected2_to;
-
- if (expected1_from == NULL)
- {
- /* The only other DSO which is allowed to call these functions is
- libdl. Find the address range containing the caller. */
- struct link_map *l;
-
- for (l = GL(dl_loaded); l != NULL; l = l->l_next)
- if (strcmp (expected1, l->l_name) == 0)
- {
- is_1:
- expected1_from = (const void *) l->l_map_start;
- expected1_to = (const void *) l->l_map_end;
- }
- else if (strcmp (expected2, l->l_name) == 0)
- {
- is_2:
- expected2_from = (const void *) l->l_map_start;
- expected2_to = (const void *) l->l_map_end;
- }
- else
- {
- struct libname_list *runp = l->l_libname;
-
- while (runp != NULL)
- {
- if (strcmp (expected1, runp->name) == 0)
- goto is_1;
- else if (strcmp (expected2, runp->name) == 0)
- goto is_2;
-
- runp = runp->next;
- }
- }
-
- assert (expected1_from != NULL);
- }
-
- /* When there would be more than two expected caller we could use an
- array for the values but for now this is cheaper. */
- if ((caller >= expected1_from && caller < expected1_to)
- || (caller >= expected2_from && caller < expected2_to))
- return 0;
-
- return 1;
-}
-#endif
-
-
static void
dl_open_worker (void *a)
{
bool any_tls;
#endif
-#ifdef SHARED
/* Check whether _dl_open() has been called from a valid DSO. */
- if (check_libc_caller (args->caller_dl_open) != 0)
+ if (__check_caller (args->caller_dl_open, allow_libc|allow_libdl) != 0)
GLRO(dl_signal_error) (0, "dlopen", NULL, N_("invalid caller"));
-#endif
/* Maybe we have to expand a DST. */
dst = strchr (file, '$');
._dl_start_profile = _dl_start_profile,
._dl_mcount = _dl_mcount_internal,
._dl_lookup_symbol_x = _dl_lookup_symbol_x,
+ ._dl_check_caller = _dl_check_caller
};
/* If we would use strong_alias here the compiler would see a
non-hidden definition. This would undo the effect of the previous
/* These defined magically in the linker script. */
extern char _begin[] attribute_hidden;
+extern char _etext[] attribute_hidden;
extern char _end[] attribute_hidden;
GL(dl_rtld_map).l_opencount = 1;
GL(dl_rtld_map).l_map_start = (ElfW(Addr)) _begin;
GL(dl_rtld_map).l_map_end = (ElfW(Addr)) _end;
+ GL(dl_rtld_map).l_text_end = (ElfW(Addr)) _etext;
/* Copy the TLS related data if necessary. */
#if USE_TLS && !defined DONT_USE_BOOTSTRAP_MAP
# if USE___THREAD
}
GL(dl_loaded)->l_map_end = 0;
+ GL(dl_loaded)->l_text_end = 0;
/* Perhaps the executable has no PT_LOAD header entries at all. */
GL(dl_loaded)->l_map_start = ~0;
/* We opened the file, account for it. */
allocend = GL(dl_loaded)->l_addr + ph->p_vaddr + ph->p_memsz;
if (GL(dl_loaded)->l_map_end < allocend)
GL(dl_loaded)->l_map_end = allocend;
+ if ((ph->p_flags & PF_X) && allocend > GL(dl_loaded)->l_text_end)
+ GL(dl_loaded)->l_text_end = allocend;
}
break;
#ifdef USE_TLS
#endif
if (! GL(dl_loaded)->l_map_end)
GL(dl_loaded)->l_map_end = ~0;
+ if (! GL(dl_loaded)->l_text_end)
+ GL(dl_loaded)->l_text_end = ~0;
if (! GL(dl_rtld_map).l_libname && GL(dl_rtld_map).l_name)
{
/* We were invoked directly, so the program might not have a
l->l_addr = ph->p_vaddr;
else if (ph->p_vaddr + ph->p_memsz >= l->l_map_end)
l->l_map_end = ph->p_vaddr + ph->p_memsz;
+ else if ((ph->p_flags & PF_X)
+ && ph->p_vaddr + ph->p_memsz >= l->l_text_end)
+ l->l_text_end = ph->p_vaddr + ph->p_memsz;
}
}
l->l_map_start = (ElfW(Addr)) GLRO(dl_sysinfo_dso);
l->l_addr = l->l_map_start - l->l_addr;
l->l_map_end += l->l_addr;
+ l->l_text_end += l->l_addr;
l->l_ld = (void *) ((ElfW(Addr)) l->l_ld + l->l_addr);
elf_get_dynamic_info (l, dyn_temp);
_dl_setup_hash (l);
/* Start and finish of memory map for this object. l_map_start
need not be the same as l_addr. */
ElfW(Addr) l_map_start, l_map_end;
+ /* End of the executable part of the mapping. */
+ ElfW(Addr) l_text_end;
/* Default array for 'l_scope'. */
struct r_scope_elem *l_scope_mem[4];
+2004-03-26 Ulrich Drepper <drepper@redhat.com>
+
+ * allocatestack.c (_make_stacks_executable): Call
+ _dl_make_stack_executable first.
+
2004-03-24 Roland McGrath <roland@redhat.com>
* sysdeps/i386/pthread_spin_lock.c (pthread_spin_lock): Use "m"
internal_function
__make_stacks_executable (void **stack_endp)
{
- /* Challenge the caller. */
- if (*stack_endp != __libc_stack_end)
- return EPERM;
+ /* First the main thread's stack. */
+ int err = _dl_make_stack_executable (stack_endp);
+ if (err != 0)
+ return err;
#ifdef NEED_SEPARATE_REGISTER_STACK
const size_t pagemask = ~(__getpagesize () - 1);
lll_lock (stack_cache_lock);
- int err = 0;
list_t *runp;
list_for_each (runp, &stack_used)
{
lll_unlock (stack_cache_lock);
- if (err == 0)
- err = _dl_make_stack_executable (stack_endp);
-
return err;
}
};
+/* Bit masks for the objects which valid callers can come from to
+ functions with restricted interface. */
+enum allowmask
+ {
+ allow_libc = 1,
+ allow_libdl = 2,
+ allow_libpthread = 4,
+ allow_ldso = 8
+ };
+
+
/* Test whether given NAME matches any of the names of the given object. */
extern int _dl_name_match_p (const char *__name, struct link_map *__map)
internal_function;
const struct r_found_version *,
int, int,
struct link_map *);
+ int (*_dl_check_caller) (const void *, enum allowmask);
};
# define __rtld_global_attribute__
extern char *_dl_dst_substitute (struct link_map *l, const char *name,
char *result, int is_path) attribute_hidden;
+/* Check validity of the caller. */
+extern int _dl_check_caller (const void *caller, enum allowmask mask)
+ attribute_hidden;
+
__END_DECLS
#endif /* ldsodefs.h */
#include <ldsodefs.h>
#include <sys/mman.h>
#include <errno.h>
+#include <libintl.h>
#include <stdbool.h>
#include <stackinfo.h>
+#include <caller.h>
#include "kernel-features.h"
_dl_make_stack_executable (void **stack_endp)
{
/* This gives us the highest/lowest page that needs to be changed. */
- uintptr_t page = ((uintptr_t) __libc_stack_end
+ uintptr_t page = ((uintptr_t) *stack_endp
& -(intptr_t) GLRO(dl_pagesize));
/* Challenge the caller. */
- if (__builtin_expect (*stack_endp != __libc_stack_end, 0))
+ if (__builtin_expect (__check_caller (__builtin_return_address (0),
+ allow_ldso|allow_libpthread) != 0, 0)
+ || __builtin_expect (*stack_endp != __libc_stack_end, 0))
return EPERM;
- *stack_endp = NULL;
#if _STACK_GROWS_DOWN
/* Newer Linux kernels support a flag to make our job easy. */
#endif
return_success:
+ /* Clear the address. */
+ *stack_endp = NULL;
+
/* Remember that we changed the permission. */
GL(dl_stack_flags) |= PF_X;
projects / platform / upstream / linaro-glibc.git / commitdiff