Merge "Add API to allow apps to attach extra information to tombstones." into main
diff --git a/android-changes-for-ndk-developers.md b/android-changes-for-ndk-developers.md
index ef5d34d..26e57b6 100644
--- a/android-changes-for-ndk-developers.md
+++ b/android-changes-for-ndk-developers.md
@@ -227,7 +227,7 @@
information using widely-available tools.)
```
-$ readelf --header libBroken.so | grep 'section headers'
+$ readelf --headers libBroken.so | grep 'section headers'
Start of section headers: 0 (bytes into file)
Size of section headers: 0 (bytes)
Number of section headers: 0
diff --git a/docs/32-bit-abi.md b/docs/32-bit-abi.md
index 3be6b1a..7a96e2f 100644
--- a/docs/32-bit-abi.md
+++ b/docs/32-bit-abi.md
@@ -109,3 +109,15 @@
mutexes for tids that don't fit in 16 bits. This typically manifests as
a hang in `pthread_mutex_lock` if the libc startup code doesn't detect
this condition and abort.
+
+
+## `getuid()` and friends wrongly set errno for very large results
+
+This doesn't generally affect Android devices, because we don't have any
+uids/gids/pids large enough, but 32-bit Android doesn't take into account
+that functions like getuid() potentially have return values that cover the
+entire 32-bit, and can't fail. This means that the usual "if the result is
+between -1 and -4096, set errno and return -1" code is inappropriate for
+these functions. Since LP32 is unlikely to be still supported long before
+those limits could ever matter, although -- unlike the others in this
+document -- this defect is actually fixable, it doesn't seem worth fixing.
diff --git a/libc/Android.bp b/libc/Android.bp
index 5afed1a..e4bedba 100644
--- a/libc/Android.bp
+++ b/libc/Android.bp
@@ -20,31 +20,6 @@
],
}
-libc_common_src_files = [
- "bionic/ether_aton.c",
- "bionic/ether_ntoa.c",
- "bionic/exit.cpp",
- "bionic/initgroups.c",
- "bionic/isatty.c",
- "bionic/sched_cpualloc.c",
- "bionic/sched_cpucount.c",
- "bionic/sysprop_helpers.cpp",
- "stdio/fmemopen.cpp",
- "stdio/parsefloat.c",
- "stdio/refill.c",
- "stdio/stdio.cpp",
- "stdio/stdio_ext.cpp",
- "stdio/vfscanf.cpp",
- "stdio/vfwscanf.cpp",
-]
-
-// off64_t/time64_t support on LP32.
-// ========================================================
-libc_common_src_files_32 = [
- "bionic/legacy_32_bit_support.cpp",
- "bionic/time64.c",
-]
-
libc_common_flags = [
"-D_LIBC=1",
"-D__BIONIC_LP32_USE_STAT64",
@@ -844,9 +819,12 @@
"bionic/dup.cpp",
"bionic/environ.cpp",
"bionic/error.cpp",
+ "bionic/ether_aton.c",
+ "bionic/ether_ntoa.c",
"bionic/eventfd.cpp",
"bionic/exec.cpp",
"bionic/execinfo.cpp",
+ "bionic/exit.cpp",
"bionic/faccessat.cpp",
"bionic/fchmod.cpp",
"bionic/fchmodat.cpp",
@@ -879,8 +857,10 @@
"bionic/iconv.cpp",
"bionic/icu_wrappers.cpp",
"bionic/ifaddrs.cpp",
+ "bionic/initgroups.c",
"bionic/inotify_init.cpp",
"bionic/ioctl.cpp",
+ "bionic/isatty.c",
"bionic/killpg.cpp",
"bionic/langinfo.cpp",
"bionic/lchown.cpp",
@@ -951,6 +931,8 @@
"bionic/rename.cpp",
"bionic/rmdir.cpp",
"bionic/scandir.cpp",
+ "bionic/sched_cpualloc.c",
+ "bionic/sched_cpucount.c",
"bionic/sched_getaffinity.cpp",
"bionic/sched_getcpu.cpp",
"bionic/semaphore.cpp",
@@ -988,6 +970,7 @@
"bionic/sys_time.cpp",
"bionic/sysinfo.cpp",
"bionic/syslog.cpp",
+ "bionic/sysprop_helpers.cpp",
"bionic/system.cpp",
"bionic/system_property_api.cpp",
"bionic/system_property_set.cpp",
@@ -1011,6 +994,16 @@
"bionic/wcwidth.cpp",
"bionic/wmempcpy.cpp",
+ // Forked but not yet cleaned up/rewritten stdio code.
+ // TODO: finish cleanup.
+ "stdio/fmemopen.cpp",
+ "stdio/parsefloat.c",
+ "stdio/refill.c",
+ "stdio/stdio.cpp",
+ "stdio/stdio_ext.cpp",
+ "stdio/vfscanf.cpp",
+ "stdio/vfwscanf.cpp",
+
// TODO: why isn't this in a static-libc-only module?
// This contains a weak stub implementation of __find_icu_symbol for wctype.cpp,
// which will be overridden by the actual one in libc.so.
@@ -1223,10 +1216,16 @@
},
},
- // TODO: move to libc/bionic/legacy_32_bit_support.cpp or #if __LP64__ instead.
multilib: {
lib32: {
- srcs: ["bionic/mmap.cpp"],
+ srcs: [
+ // off64_t/time64_t support on LP32.
+ "bionic/legacy_32_bit_support.cpp",
+ "bionic/time64.c",
+
+ // TODO: move to libc/bionic/legacy_32_bit_support.cpp or #if __LP64__ instead.
+ "bionic/mmap.cpp",
+ ],
},
},
@@ -1336,20 +1335,13 @@
}
// ========================================================
-// libc_common.a
+// libc_common.a --- everything shared by libc.a and libc.so
// ========================================================
cc_library_static {
defaults: ["libc_defaults"],
name: "libc_common",
- srcs: libc_common_src_files,
- multilib: {
- lib32: {
- srcs: libc_common_src_files_32,
- },
- },
-
whole_static_libs: [
"libarm-optimized-routines-string",
"libasync_safe",
@@ -1377,7 +1369,7 @@
}
// ========================================================
-// libc_static_dispatch.a
+// libc_static_dispatch.a --- libc.a ifuncs
// ========================================================
cc_library_static {
defaults: ["libc_defaults"],
@@ -1403,7 +1395,7 @@
}
// ========================================================
-// libc_dynamic_dispatch.a
+// libc_dynamic_dispatch.a --- libc.so ifuncs
// ========================================================
cc_library_static {
defaults: ["libc_defaults"],
@@ -1897,6 +1889,7 @@
"//external/gwp_asan",
"//external/jemalloc_new",
"//external/libunwind_llvm",
+ "//external/llvm-libc",
"//external/scudo",
"//system/core/property_service/libpropertyinfoparser",
"//system/extras/toolchain-extras",
diff --git a/libc/private/bsd_sys_param.h b/libc/private/bsd_sys_param.h
index be5f692..ab54aa0 100644
--- a/libc/private/bsd_sys_param.h
+++ b/libc/private/bsd_sys_param.h
@@ -20,4 +20,4 @@
/* OpenBSD has these in <sys/param.h>, but "ALIGN" isn't something we want to reserve. */
#define ALIGNBYTES (sizeof(uintptr_t) - 1)
-#define ALIGN(p) (((uintptr_t)(p) + ALIGNBYTES) & ~ALIGNBYTES)
+#define ALIGN(p) ((__BIONIC_CAST(reinterpret_cast, uintptr_t, p) + ALIGNBYTES) & ~ALIGNBYTES)
diff --git a/libc/stdio/local.h b/libc/stdio/local.h
index a5eb636..62efea1 100644
--- a/libc/stdio/local.h
+++ b/libc/stdio/local.h
@@ -236,7 +236,7 @@
/* OpenBSD exposes these in <stdio.h>, but we only want them exposed to the implementation. */
#define __sferror(p) (((p)->_flags & __SERR) != 0)
#define __sclearerr(p) ((void)((p)->_flags &= ~(__SERR | __SEOF)))
-#define __sgetc(p) (--(p)->_r < 0 ? __srget(p) : (int)(*(p)->_p++))
+#define __sgetc(p) (--(p)->_r < 0 ? __srget(p) : __BIONIC_CAST(static_cast, int, *(p)->_p++))
/* OpenBSD declares these in fvwrite.h, but we share them with C++ parts of the implementation. */
struct __siov {
@@ -288,7 +288,7 @@
char* __hldtoa(long double, const char*, int, int*, int*, char**);
char* __ldtoa(long double*, int, int, int*, int*, char**);
-#define WCIO_GET(fp) (_EXT(fp) ? &(_EXT(fp)->_wcio) : (struct wchar_io_data*)0)
+#define WCIO_GET(fp) (_EXT(fp) ? &(_EXT(fp)->_wcio) : NULL)
#define ORIENT_BYTES (-1)
#define ORIENT_UNKNOWN 0
diff --git a/libc/stdio/scanf_common.h b/libc/stdio/scanf_common.h
index 8132e90..1b6b87f 100644
--- a/libc/stdio/scanf_common.h
+++ b/libc/stdio/scanf_common.h
@@ -82,7 +82,7 @@
#define CT_FLOAT 4 // Float: strtod
#define to_digit(c) static_cast<int>((c) - '0')
-#define is_digit(c) ((unsigned)to_digit(c) <= 9)
+#define is_digit(c) (static_cast<unsigned>(to_digit(c)) <= 9)
// Append a digit to a value and check for overflow.
#define APPEND_DIGIT(val, dig) \
@@ -112,4 +112,4 @@
__fortify_fatal("%%w%s%d is unsupported", fast ? "f" : "", size);
}
-#pragma clang diagnostic pop
\ No newline at end of file
+#pragma clang diagnostic pop
diff --git a/libc/stdio/vfscanf.cpp b/libc/stdio/vfscanf.cpp
index 3607995..92ff541 100644
--- a/libc/stdio/vfscanf.cpp
+++ b/libc/stdio/vfscanf.cpp
@@ -629,10 +629,10 @@
* as `[-+]0`.
*/
if (flags & NDIGITS) {
- if (p > buf) (void)ungetc(*(u_char*)--p, fp);
+ if (p > buf) ungetc(*reinterpret_cast<u_char*>(--p), fp);
goto match_failure;
}
- c = ((u_char*)p)[-1];
+ c = reinterpret_cast<u_char*>(p)[-1];
if ((base == 2 && (c == 'b' || c == 'B')) || c == 'x' || c == 'X') {
--p;
(void)ungetc(c, fp);
@@ -647,7 +647,7 @@
res = strtoimax(buf, nullptr, base);
}
if (flags & POINTER) {
- *va_arg(ap, void**) = (void*)(uintptr_t)res;
+ *va_arg(ap, void**) = reinterpret_cast<void*>(res);
} else if (flags & MAXINT) {
*va_arg(ap, intmax_t*) = res;
} else if (flags & LLONG) {
@@ -685,7 +685,7 @@
float res = strtof(buf, &p);
*va_arg(ap, float*) = res;
}
- if ((size_t)(p - buf) != width) abort();
+ if (static_cast<size_t>(p - buf) != width) abort();
nassigned++;
}
nread += width;
diff --git a/libc/stdio/vfwscanf.cpp b/libc/stdio/vfwscanf.cpp
index 3df4a87..21d1783 100644
--- a/libc/stdio/vfwscanf.cpp
+++ b/libc/stdio/vfwscanf.cpp
@@ -32,6 +32,7 @@
*/
#include "scanf_common.h"
+
// An interpretive version of __sccl from vfscanf.c --- a table of all wchar_t values would
// be a little too expensive, and some kind of compressed version isn't worth the trouble.
static inline bool in_ccl(wchar_t wc, const wchar_t* ccl) {
@@ -335,7 +336,7 @@
if (!(flags & SUPPRESS)) p = va_arg(ap, wchar_t*);
n = 0;
while (width-- != 0 && (wi = __fgetwc_unlock(fp)) != WEOF) {
- if (!(flags & SUPPRESS)) *p++ = (wchar_t)wi;
+ if (!(flags & SUPPRESS)) *p++ = static_cast<wchar_t>(wi);
n++;
}
if (n == 0) goto input_failure;
@@ -348,10 +349,10 @@
while (width != 0 && (wi = __fgetwc_unlock(fp)) != WEOF) {
if (width >= MB_CUR_MAX && !(flags & SUPPRESS)) {
nconv = wcrtomb(mbp, wi, &mbs);
- if (nconv == (size_t)-1) goto input_failure;
+ if (nconv == static_cast<size_t>(-1)) goto input_failure;
} else {
nconv = wcrtomb(mbbuf, wi, &mbs);
- if (nconv == (size_t)-1) goto input_failure;
+ if (nconv == static_cast<size_t>(-1)) goto input_failure;
if (nconv > width) {
__ungetwc(wi, fp);
break;
@@ -373,7 +374,7 @@
case CT_STRING:
// CT_CCL: scan a (nonempty) character class (sets NOSKIP).
// CT_STRING: like CCL, but zero-length string OK, & no NOSKIP.
- if (width == 0) width = (size_t)~0; // 'infinity'.
+ if (width == 0) width = SIZE_MAX; // 'infinity'.
if ((flags & SUPPRESS) && (flags & LONG)) {
n = 0;
while ((wi = __fgetwc_unlock(fp)) != WEOF && width-- != 0 && ((c == CT_CCL && in_ccl(wi, ccl)) || (c == CT_STRING && !iswspace(wi)))) n++;
@@ -381,7 +382,7 @@
} else if (flags & LONG) {
p0 = p = va_arg(ap, wchar_t*);
while ((wi = __fgetwc_unlock(fp)) != WEOF && width-- != 0 && ((c == CT_CCL && in_ccl(wi, ccl)) || (c == CT_STRING && !iswspace(wi)))) {
- *p++ = (wchar_t)wi;
+ *p++ = static_cast<wchar_t>(wi);
}
if (wi != WEOF) __ungetwc(wi, fp);
n = p - p0;
@@ -392,10 +393,10 @@
while ((wi = __fgetwc_unlock(fp)) != WEOF && width != 0 && ((c == CT_CCL && in_ccl(wi, ccl)) || (c == CT_STRING && !iswspace(wi)))) {
if (width >= MB_CUR_MAX && !(flags & SUPPRESS)) {
nconv = wcrtomb(mbp, wi, &mbs);
- if (nconv == (size_t)-1) goto input_failure;
+ if (nconv == static_cast<size_t>(-1)) goto input_failure;
} else {
nconv = wcrtomb(mbbuf, wi, &mbs);
- if (nconv == (size_t)-1) goto input_failure;
+ if (nconv == static_cast<size_t>(-1)) goto input_failure;
if (nconv > width) break;
if (!(flags & SUPPRESS)) memcpy(mbp, mbbuf, nconv);
}
@@ -485,7 +486,7 @@
case 'e':
case 'f':
if (base == 0) base = 10;
- if (base != 16 && (int)(c - '0') >= base) break; /* not legal here */
+ if (base != 16 && static_cast<int>(c - '0') >= base) break; /* not legal here */
flags &= ~(SIGNOK | PFBOK | PFXOK | NDIGITS);
goto ok;
@@ -523,7 +524,7 @@
/*
* c is legal: store it and look at the next.
*/
- *p++ = (wchar_t)c;
+ *p++ = static_cast<wchar_t>(c);
}
/*
* If we had only a sign, it is no good; push back the sign.
@@ -548,7 +549,7 @@
else
res = wcstoumax(buf, NULL, base);
if (flags & POINTER)
- *va_arg(ap, void**) = (void*)(uintptr_t)res;
+ *va_arg(ap, void**) = reinterpret_cast<void*>(res);
else if (flags & MAXINT)
*va_arg(ap, intmax_t*) = res;
else if (flags & LLONG)
@@ -587,7 +588,7 @@
float res = wcstof(buf, &p);
*va_arg(ap, float*) = res;
}
- if (p - buf != (ptrdiff_t)width) abort();
+ if (static_cast<size_t>(p - buf) != width) abort();
nassigned++;
}
nread += width;
diff --git a/linker/NOTICE b/linker/NOTICE
index 7fd1877..9b66b4e 100644
--- a/linker/NOTICE
+++ b/linker/NOTICE
@@ -390,3 +390,31 @@
-------------------------------------------------------------------
+Copyright (C) 2024 The Android Open Source Project
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+ * Redistributions of source code must retain the above copyright
+ notice, this list of conditions and the following disclaimer.
+ * Redistributions in binary form must reproduce the above copyright
+ notice, this list of conditions and the following disclaimer in
+ the documentation and/or other materials provided with the
+ distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
+FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
+COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
+INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING,
+BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS
+OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
+AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGE.
+
+-------------------------------------------------------------------
+
diff --git a/linker/linker.cpp b/linker/linker.cpp
index 60c8e31..724f821 100644
--- a/linker/linker.cpp
+++ b/linker/linker.cpp
@@ -3354,7 +3354,7 @@
"\"%s\" has text relocations",
get_realpath());
add_dlwarning(get_realpath(), "text relocations");
- if (phdr_table_unprotect_segments(phdr, phnum, load_bias, should_pad_segments_) < 0) {
+ if (phdr_table_unprotect_segments(phdr, phnum, load_bias) < 0) {
DL_ERR("can't unprotect loadable segments for \"%s\": %s", get_realpath(), strerror(errno));
return false;
}
@@ -3370,7 +3370,7 @@
#if !defined(__LP64__)
if (has_text_relocations) {
// All relocations are done, we can protect our segments back to read-only.
- if (phdr_table_protect_segments(phdr, phnum, load_bias, should_pad_segments_) < 0) {
+ if (phdr_table_protect_segments(phdr, phnum, load_bias) < 0) {
DL_ERR("can't protect segments for \"%s\": %s",
get_realpath(), strerror(errno));
return false;
@@ -3408,7 +3408,7 @@
}
bool soinfo::protect_relro() {
- if (phdr_table_protect_gnu_relro(phdr, phnum, load_bias, should_pad_segments_) < 0) {
+ if (phdr_table_protect_gnu_relro(phdr, phnum, load_bias) < 0) {
DL_ERR("can't enable GNU RELRO protection for \"%s\": %s",
get_realpath(), strerror(errno));
return false;
diff --git a/linker/linker_main.cpp b/linker/linker_main.cpp
index 018a5eb..5f5eba4 100644
--- a/linker/linker_main.cpp
+++ b/linker/linker_main.cpp
@@ -201,7 +201,6 @@
const ElfW(Phdr)* phdr;
size_t phdr_count;
ElfW(Addr) entry_point;
- bool should_pad_segments;
};
static ExecutableInfo get_executable_info(const char* arg_path) {
@@ -294,7 +293,6 @@
result.phdr = elf_reader.loaded_phdr();
result.phdr_count = elf_reader.phdr_count();
result.entry_point = elf_reader.entry_point();
- result.should_pad_segments = elf_reader.should_pad_segments();
return result;
}
@@ -368,7 +366,6 @@
somain = si;
si->phdr = exe_info.phdr;
si->phnum = exe_info.phdr_count;
- si->set_should_pad_segments(exe_info.should_pad_segments);
get_elf_base_from_phdr(si->phdr, si->phnum, &si->base, &si->load_bias);
si->size = phdr_table_get_load_size(si->phdr, si->phnum);
si->dynamic = nullptr;
@@ -402,7 +399,7 @@
auto note_gnu_property = GnuPropertySection(somain);
if (note_gnu_property.IsBTICompatible() &&
(phdr_table_protect_segments(somain->phdr, somain->phnum, somain->load_bias,
- somain->should_pad_segments(), ¬e_gnu_property) < 0)) {
+ ¬e_gnu_property) < 0)) {
__linker_error("error: can't protect segments for \"%s\": %s", exe_info.path.c_str(),
strerror(errno));
}
diff --git a/linker/linker_phdr.cpp b/linker/linker_phdr.cpp
index af0ef1d..82b37a4 100644
--- a/linker/linker_phdr.cpp
+++ b/linker/linker_phdr.cpp
@@ -196,7 +196,7 @@
// For Armv8.5-A loaded executable segments may require PROT_BTI.
if (note_gnu_property_.IsBTICompatible()) {
did_load_ = (phdr_table_protect_segments(phdr_table_, phdr_num_, load_bias_,
- should_pad_segments_, ¬e_gnu_property_) == 0);
+ ¬e_gnu_property_) == 0);
}
#endif
}
@@ -717,13 +717,21 @@
continue;
}
+ // Some obfuscated ELFs may contain "empty" PT_NOTE program headers that don't
+ // point to any part of the ELF (p_memsz == 0). Skip these since there is
+ // nothing to decode. See: b/324468126
+ if (phdr->p_memsz == 0) {
+ continue;
+ }
+
// note_fragment is scoped to within the loop so that there is
// at most 1 PT_NOTE mapped at anytime during this search.
MappedFileFragment note_fragment;
if (!note_fragment.Map(fd_, file_offset_, phdr->p_offset, phdr->p_memsz)) {
- DL_WARN("\"%s\" note mmap failed: %s", name_.c_str(), strerror(errno));
- // If mmap failed, skip the optimization but don't block ELF loading
- return true;
+ DL_ERR("\"%s\": PT_NOTE mmap(nullptr, %p, PROT_READ, MAP_PRIVATE, %d, %p) failed: %m",
+ name_.c_str(), reinterpret_cast<void*>(phdr->p_memsz), fd_,
+ reinterpret_cast<void*>(page_start(file_offset_ + phdr->p_offset)));
+ return false;
}
const ElfW(Nhdr)* note_hdr = nullptr;
@@ -748,36 +756,6 @@
return true;
}
-static inline void _extend_load_segment_vma(const ElfW(Phdr)* phdr_table, size_t phdr_count,
- size_t phdr_idx, ElfW(Addr)* p_memsz,
- ElfW(Addr)* p_filesz) {
- const ElfW(Phdr)* phdr = &phdr_table[phdr_idx];
- const ElfW(Phdr)* next = nullptr;
- size_t next_idx = phdr_idx + 1;
- if (next_idx < phdr_count && phdr_table[next_idx].p_type == PT_LOAD) {
- next = &phdr_table[next_idx];
- }
-
- // If this is the last LOAD segment, no extension is needed
- if (!next || *p_memsz != *p_filesz) {
- return;
- }
-
- ElfW(Addr) next_start = page_start(next->p_vaddr);
- ElfW(Addr) curr_end = page_end(phdr->p_vaddr + *p_memsz);
-
- // If adjacent segment mappings overlap, no extension is needed.
- if (curr_end >= next_start) {
- return;
- }
-
- // Extend the LOAD segment mapping to be contiguous with that of
- // the next LOAD segment.
- ElfW(Addr) extend = next_start - curr_end;
- *p_memsz += extend;
- *p_filesz += extend;
-}
-
bool ElfReader::LoadSegments() {
for (size_t i = 0; i < phdr_num_; ++i) {
const ElfW(Phdr)* phdr = &phdr_table_[i];
@@ -786,24 +764,18 @@
continue;
}
- ElfW(Addr) p_memsz = phdr->p_memsz;
- ElfW(Addr) p_filesz = phdr->p_filesz;
- if (phdr->p_align > kPageSize && should_pad_segments_) {
- _extend_load_segment_vma(phdr_table_, phdr_num_, i, &p_memsz, &p_filesz);
- }
-
// Segment addresses in memory.
ElfW(Addr) seg_start = phdr->p_vaddr + load_bias_;
- ElfW(Addr) seg_end = seg_start + p_memsz;
+ ElfW(Addr) seg_end = seg_start + phdr->p_memsz;
ElfW(Addr) seg_page_start = page_start(seg_start);
ElfW(Addr) seg_page_end = page_end(seg_end);
- ElfW(Addr) seg_file_end = seg_start + p_filesz;
+ ElfW(Addr) seg_file_end = seg_start + phdr->p_filesz;
// File offsets.
ElfW(Addr) file_start = phdr->p_offset;
- ElfW(Addr) file_end = file_start + p_filesz;
+ ElfW(Addr) file_end = file_start + phdr->p_filesz;
ElfW(Addr) file_page_start = page_start(file_start);
ElfW(Addr) file_length = file_end - file_page_start;
@@ -813,12 +785,12 @@
return false;
}
- if (file_start + phdr->p_filesz > static_cast<size_t>(file_size_)) {
+ if (file_end > static_cast<size_t>(file_size_)) {
DL_ERR("invalid ELF file \"%s\" load segment[%zd]:"
" p_offset (%p) + p_filesz (%p) ( = %p) past end of file (0x%" PRIx64 ")",
name_.c_str(), i, reinterpret_cast<void*>(phdr->p_offset),
reinterpret_cast<void*>(phdr->p_filesz),
- reinterpret_cast<void*>(file_start + phdr->p_filesz), file_size_);
+ reinterpret_cast<void*>(file_end), file_size_);
return false;
}
@@ -858,18 +830,8 @@
// if the segment is writable, and does not end on a page boundary,
// zero-fill it until the page limit.
- //
- // The intention is to zero the partial page at that may exist at the
- // end of a file backed mapping. With the extended seg_file_end, this
- // file offset as calculated from the mapping start can overrun the end
- // of the file. However pages in that range cannot be touched by userspace
- // because the kernel will not be able to handle a file map fault past the
- // extent of the file. No need to try zeroing this untouchable region.
- // Zero the partial page at the end of the original unextended seg_file_end.
- ElfW(Addr) seg_file_end_orig = seg_start + phdr->p_filesz;
- if ((phdr->p_flags & PF_W) != 0 && page_offset(seg_file_end_orig) > 0) {
- memset(reinterpret_cast<void*>(seg_file_end_orig), 0,
- kPageSize - page_offset(seg_file_end_orig));
+ if ((phdr->p_flags & PF_W) != 0 && page_offset(seg_file_end) > 0) {
+ memset(reinterpret_cast<void*>(seg_file_end), 0, page_size() - page_offset(seg_file_end));
}
seg_file_end = page_end(seg_file_end);
@@ -902,23 +864,17 @@
* phdr_table_protect_segments and phdr_table_unprotect_segments.
*/
static int _phdr_table_set_load_prot(const ElfW(Phdr)* phdr_table, size_t phdr_count,
- ElfW(Addr) load_bias, int extra_prot_flags,
- bool should_pad_segments) {
- for (size_t i = 0; i < phdr_count; ++i) {
- const ElfW(Phdr)* phdr = &phdr_table[i];
+ ElfW(Addr) load_bias, int extra_prot_flags) {
+ const ElfW(Phdr)* phdr = phdr_table;
+ const ElfW(Phdr)* phdr_limit = phdr + phdr_count;
+ for (; phdr < phdr_limit; phdr++) {
if (phdr->p_type != PT_LOAD || (phdr->p_flags & PF_W) != 0) {
continue;
}
- ElfW(Addr) p_memsz = phdr->p_memsz;
- ElfW(Addr) p_filesz = phdr->p_filesz;
- if (phdr->p_align > kPageSize && should_pad_segments) {
- _extend_load_segment_vma(phdr_table, phdr_count, i, &p_memsz, &p_filesz);
- }
-
- ElfW(Addr) seg_page_start = page_start(phdr->p_vaddr + load_bias);
- ElfW(Addr) seg_page_end = page_end(phdr->p_vaddr + p_memsz + load_bias);
+ ElfW(Addr) seg_page_start = page_start(phdr->p_vaddr) + load_bias;
+ ElfW(Addr) seg_page_end = page_end(phdr->p_vaddr + phdr->p_memsz) + load_bias;
int prot = PFLAGS_TO_PROT(phdr->p_flags) | extra_prot_flags;
if ((prot & PROT_WRITE) != 0) {
@@ -953,21 +909,19 @@
* phdr_table -> program header table
* phdr_count -> number of entries in tables
* load_bias -> load bias
- * should_pad_segments -> Are segments extended to avoid gaps in the memory map
* prop -> GnuPropertySection or nullptr
* Return:
* 0 on success, -1 on failure (error code in errno).
*/
int phdr_table_protect_segments(const ElfW(Phdr)* phdr_table, size_t phdr_count,
- ElfW(Addr) load_bias, bool should_pad_segments,
- const GnuPropertySection* prop __unused) {
+ ElfW(Addr) load_bias, const GnuPropertySection* prop __unused) {
int prot = 0;
#if defined(__aarch64__)
if ((prop != nullptr) && prop->IsBTICompatible()) {
prot |= PROT_BTI;
}
#endif
- return _phdr_table_set_load_prot(phdr_table, phdr_count, load_bias, prot, should_pad_segments);
+ return _phdr_table_set_load_prot(phdr_table, phdr_count, load_bias, prot);
}
/* Change the protection of all loaded segments in memory to writable.
@@ -983,53 +937,19 @@
* phdr_table -> program header table
* phdr_count -> number of entries in tables
* load_bias -> load bias
- * should_pad_segments -> Are segments extended to avoid gaps in the memory map
* Return:
* 0 on success, -1 on failure (error code in errno).
*/
int phdr_table_unprotect_segments(const ElfW(Phdr)* phdr_table,
- size_t phdr_count, ElfW(Addr) load_bias,
- bool should_pad_segments) {
- return _phdr_table_set_load_prot(phdr_table, phdr_count, load_bias, PROT_WRITE,
- should_pad_segments);
-}
-
-static inline void _extend_gnu_relro_prot_end(const ElfW(Phdr)* relro_phdr,
- const ElfW(Phdr)* phdr_table, size_t phdr_count,
- ElfW(Addr) load_bias, ElfW(Addr)* seg_page_end) {
- // Find the index and phdr of the LOAD containing the GNU_RELRO segment
- for (size_t index = 0; index < phdr_count; ++index) {
- const ElfW(Phdr)* phdr = &phdr_table[index];
-
- if (phdr->p_type == PT_LOAD && phdr->p_vaddr == relro_phdr->p_vaddr) {
- // If the PT_GNU_RELRO mem size is not at least as large as the corresponding
- // LOAD segment mem size, we need to protect only a partial region of the
- // LOAD segment and therefore cannot avoid a VMA split.
- if (relro_phdr->p_memsz < phdr->p_memsz) {
- break;
- }
-
- ElfW(Addr) p_memsz = phdr->p_memsz;
- ElfW(Addr) p_filesz = phdr->p_filesz;
-
- // Attempt extending the VMA (mprotect range). Without extending the range
- // mprotect will only RO protect a part of the extend RW LOAD segment, which will
- // leave an extra split RW VMA (the gap).
- _extend_load_segment_vma(phdr_table, phdr_count, index, &p_memsz, &p_filesz);
-
- *seg_page_end = page_end(phdr->p_vaddr + p_memsz + load_bias);
-
- break;
- }
- }
+ size_t phdr_count, ElfW(Addr) load_bias) {
+ return _phdr_table_set_load_prot(phdr_table, phdr_count, load_bias, PROT_WRITE);
}
/* Used internally by phdr_table_protect_gnu_relro and
* phdr_table_unprotect_gnu_relro.
*/
static int _phdr_table_set_gnu_relro_prot(const ElfW(Phdr)* phdr_table, size_t phdr_count,
- ElfW(Addr) load_bias, int prot_flags,
- bool should_pad_segments) {
+ ElfW(Addr) load_bias, int prot_flags) {
const ElfW(Phdr)* phdr = phdr_table;
const ElfW(Phdr)* phdr_limit = phdr + phdr_count;
@@ -1054,16 +974,8 @@
// the program is likely to fail at runtime. So in effect the
// linker must only emit a PT_GNU_RELRO segment if it ensures
// that it starts on a page boundary.
- ElfW(Addr) seg_page_start = page_start(phdr->p_vaddr + load_bias);
- ElfW(Addr) seg_page_end = page_end(phdr->p_vaddr + phdr->p_memsz + load_bias);
-
- // Before extending the RO protection, we need to ensure that the segments were extended
- // by bionic, because the kernel won't map gaps so it usually contains unrelated
- // mappings which will be incorrectly protected as RO likely leading to
- // segmentation fault.
- if (phdr->p_align > kPageSize && should_pad_segments) {
- _extend_gnu_relro_prot_end(phdr, phdr_table, phdr_count, load_bias, &seg_page_end);
- }
+ ElfW(Addr) seg_page_start = page_start(phdr->p_vaddr) + load_bias;
+ ElfW(Addr) seg_page_end = page_end(phdr->p_vaddr + phdr->p_memsz) + load_bias;
int ret = mprotect(reinterpret_cast<void*>(seg_page_start),
seg_page_end - seg_page_start,
@@ -1088,14 +1000,12 @@
* phdr_table -> program header table
* phdr_count -> number of entries in tables
* load_bias -> load bias
- * should_pad_segments -> Were segments extended to avoid gaps in the memory map
* Return:
* 0 on success, -1 on failure (error code in errno).
*/
-int phdr_table_protect_gnu_relro(const ElfW(Phdr)* phdr_table, size_t phdr_count,
- ElfW(Addr) load_bias, bool should_pad_segments) {
- return _phdr_table_set_gnu_relro_prot(phdr_table, phdr_count, load_bias, PROT_READ,
- should_pad_segments);
+int phdr_table_protect_gnu_relro(const ElfW(Phdr)* phdr_table,
+ size_t phdr_count, ElfW(Addr) load_bias) {
+ return _phdr_table_set_gnu_relro_prot(phdr_table, phdr_count, load_bias, PROT_READ);
}
/* Serialize the GNU relro segments to the given file descriptor. This can be
diff --git a/linker/linker_phdr.h b/linker/linker_phdr.h
index 4deed33..e5b87bb 100644
--- a/linker/linker_phdr.h
+++ b/linker/linker_phdr.h
@@ -128,14 +128,13 @@
size_t phdr_table_get_maximum_alignment(const ElfW(Phdr)* phdr_table, size_t phdr_count);
int phdr_table_protect_segments(const ElfW(Phdr)* phdr_table, size_t phdr_count,
- ElfW(Addr) load_bias, bool should_pad_segments,
- const GnuPropertySection* prop = nullptr);
+ ElfW(Addr) load_bias, const GnuPropertySection* prop = nullptr);
int phdr_table_unprotect_segments(const ElfW(Phdr)* phdr_table, size_t phdr_count,
- ElfW(Addr) load_bias, bool should_pad_segments);
+ ElfW(Addr) load_bias);
int phdr_table_protect_gnu_relro(const ElfW(Phdr)* phdr_table, size_t phdr_count,
- ElfW(Addr) load_bias, bool should_pad_segments);
+ ElfW(Addr) load_bias);
int phdr_table_serialize_gnu_relro(const ElfW(Phdr)* phdr_table, size_t phdr_count,
ElfW(Addr) load_bias, int fd, size_t* file_offset);
diff --git a/linker/linker_relocate.cpp b/linker/linker_relocate.cpp
index 5b58895..952dade 100644
--- a/linker/linker_relocate.cpp
+++ b/linker/linker_relocate.cpp
@@ -187,8 +187,7 @@
auto protect_segments = [&]() {
// Make .text executable.
if (phdr_table_protect_segments(relocator.si->phdr, relocator.si->phnum,
- relocator.si->load_bias,
- relocator.si->should_pad_segments()) < 0) {
+ relocator.si->load_bias) < 0) {
DL_ERR("can't protect segments for \"%s\": %s",
relocator.si->get_realpath(), strerror(errno));
return false;
@@ -198,8 +197,7 @@
auto unprotect_segments = [&]() {
// Make .text writable.
if (phdr_table_unprotect_segments(relocator.si->phdr, relocator.si->phnum,
- relocator.si->load_bias,
- relocator.si->should_pad_segments()) < 0) {
+ relocator.si->load_bias) < 0) {
DL_ERR("can't unprotect loadable segments for \"%s\": %s",
relocator.si->get_realpath(), strerror(errno));
return false;
diff --git a/tests/dlext_test.cpp b/tests/dlext_test.cpp
index 6883da9..d078e50 100644
--- a/tests/dlext_test.cpp
+++ b/tests/dlext_test.cpp
@@ -31,7 +31,6 @@
#include <android-base/test_utils.h>
#include <sys/mman.h>
-#include <sys/stat.h>
#include <sys/types.h>
#include <sys/vfs.h>
#include <sys/wait.h>
@@ -2047,11 +2046,6 @@
-1, 0));
ASSERT_TRUE(reinterpret_cast<void*>(reserved_addr) != MAP_FAILED);
- struct stat file_stat;
- int ret = TEMP_FAILURE_RETRY(stat(private_library_absolute_path.c_str(), &file_stat));
- ASSERT_EQ(ret, 0) << "Failed to stat library";
- size_t file_size = file_stat.st_size;
-
for (const auto& rec : maps_to_copy) {
uintptr_t offset = rec.addr_start - addr_start;
size_t size = rec.addr_end - rec.addr_start;
@@ -2059,13 +2053,7 @@
void* map = mmap(addr, size, PROT_READ | PROT_WRITE,
MAP_ANON | MAP_PRIVATE | MAP_FIXED, -1, 0);
ASSERT_TRUE(map != MAP_FAILED);
- size_t seg_size = size;
- // See comment on file map fault in ElfReader::LoadSegments()
- // bionic/linker/linker_phdr.cpp
- if (rec.offset + size > file_size) {
- seg_size = file_size - rec.offset;
- }
- memcpy(map, reinterpret_cast<void*>(rec.addr_start), seg_size);
+ memcpy(map, reinterpret_cast<void*>(rec.addr_start), size);
mprotect(map, size, rec.perms);
}