xref: /freebsd/libexec/rtld-elf/map_object.c (revision d0b2dbfa0ecf2bbc9709efc5e20baf8e4b44bbbf)
1 /*-
2  * SPDX-License-Identifier: BSD-2-Clause
3  *
4  * Copyright 1996-1998 John D. Polstra.
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  *
16  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
17  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
18  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
19  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
20  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
21  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
22  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
23  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
24  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
25  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
26  */
27 
28 #define _WANT_P_OSREL
29 #include <sys/param.h>
30 #include <sys/mman.h>
31 #include <sys/stat.h>
32 
33 #include <errno.h>
34 #include <stddef.h>
35 #include <stdlib.h>
36 #include <string.h>
37 #include <unistd.h>
38 
39 #include "debug.h"
40 #include "rtld.h"
41 
42 static Elf_Ehdr *get_elf_header(int, const char *, const struct stat *,
43     Elf_Phdr **phdr);
44 static int convert_flags(int); /* Elf flags -> mmap flags */
45 
46 int __getosreldate(void);
47 
48 static bool
49 phdr_in_zero_page(const Elf_Ehdr *hdr)
50 {
51 	return (hdr->e_phoff + hdr->e_phnum * sizeof(Elf_Phdr) <= page_size);
52 }
53 
54 /*
55  * Map a shared object into memory.  The "fd" argument is a file descriptor,
56  * which must be open on the object and positioned at its beginning.
57  * The "path" argument is a pathname that is used only for error messages.
58  *
59  * The return value is a pointer to a newly-allocated Obj_Entry structure
60  * for the shared object.  Returns NULL on failure.
61  */
62 Obj_Entry *
63 map_object(int fd, const char *path, const struct stat *sb)
64 {
65     Obj_Entry *obj;
66     Elf_Ehdr *hdr;
67     int i;
68     Elf_Phdr *phdr;
69     Elf_Phdr *phlimit;
70     Elf_Phdr **segs;
71     int nsegs;
72     Elf_Phdr *phdyn;
73     Elf_Phdr *phinterp;
74     Elf_Phdr *phtls;
75     caddr_t mapbase;
76     size_t mapsize;
77     Elf_Addr base_vaddr;
78     Elf_Addr base_vlimit;
79     caddr_t base_addr;
80     int base_flags;
81     Elf_Off data_offset;
82     Elf_Addr data_vaddr;
83     Elf_Addr data_vlimit;
84     caddr_t data_addr;
85     int data_prot;
86     int data_flags;
87     Elf_Addr clear_vaddr;
88     caddr_t clear_addr;
89     caddr_t clear_page;
90     Elf_Addr phdr_vaddr;
91     size_t nclear, phsize;
92     Elf_Addr bss_vaddr;
93     Elf_Addr bss_vlimit;
94     caddr_t bss_addr;
95     Elf_Word stack_flags;
96     Elf_Addr relro_page;
97     size_t relro_size;
98     Elf_Addr note_start;
99     Elf_Addr note_end;
100     char *note_map;
101     size_t note_map_len;
102     Elf_Addr text_end;
103 
104     hdr = get_elf_header(fd, path, sb, &phdr);
105     if (hdr == NULL)
106 	return (NULL);
107 
108     /*
109      * Scan the program header entries, and save key information.
110      * We expect that the loadable segments are ordered by load address.
111      */
112     phsize  = hdr->e_phnum * sizeof(phdr[0]);
113     phlimit = phdr + hdr->e_phnum;
114     nsegs = -1;
115     phdyn = phinterp = phtls = NULL;
116     phdr_vaddr = 0;
117     relro_page = 0;
118     relro_size = 0;
119     note_start = 0;
120     note_end = 0;
121     note_map = NULL;
122     note_map_len = 0;
123     segs = alloca(sizeof(segs[0]) * hdr->e_phnum);
124     stack_flags = PF_X | PF_R | PF_W;
125     text_end = 0;
126     while (phdr < phlimit) {
127 	switch (phdr->p_type) {
128 
129 	case PT_INTERP:
130 	    phinterp = phdr;
131 	    break;
132 
133 	case PT_LOAD:
134 	    segs[++nsegs] = phdr;
135 	    if ((segs[nsegs]->p_align & (page_size - 1)) != 0) {
136 		_rtld_error("%s: PT_LOAD segment %d not page-aligned",
137 		    path, nsegs);
138 		goto error;
139 	    }
140 	    if ((segs[nsegs]->p_flags & PF_X) == PF_X) {
141 		text_end = MAX(text_end,
142 		    rtld_round_page(segs[nsegs]->p_vaddr +
143 		    segs[nsegs]->p_memsz));
144 	    }
145 	    break;
146 
147 	case PT_PHDR:
148 	    phdr_vaddr = phdr->p_vaddr;
149 	    phsize = phdr->p_memsz;
150 	    break;
151 
152 	case PT_DYNAMIC:
153 	    phdyn = phdr;
154 	    break;
155 
156 	case PT_TLS:
157 	    phtls = phdr;
158 	    break;
159 
160 	case PT_GNU_STACK:
161 	    stack_flags = phdr->p_flags;
162 	    break;
163 
164 	case PT_GNU_RELRO:
165 	    relro_page = phdr->p_vaddr;
166 	    relro_size = phdr->p_memsz;
167 	    break;
168 
169 	case PT_NOTE:
170 	    if (phdr->p_offset > page_size ||
171 	      phdr->p_offset + phdr->p_filesz > page_size) {
172 		note_map_len = rtld_round_page(phdr->p_offset +
173 		  phdr->p_filesz) - rtld_trunc_page(phdr->p_offset);
174 		note_map = mmap(NULL, note_map_len, PROT_READ,
175 		  MAP_PRIVATE, fd, rtld_trunc_page(phdr->p_offset));
176 		if (note_map == MAP_FAILED) {
177 		    _rtld_error("%s: error mapping PT_NOTE (%d)", path, errno);
178 		    goto error;
179 		}
180 		note_start = (Elf_Addr)(note_map + phdr->p_offset -
181 		  rtld_trunc_page(phdr->p_offset));
182 	    } else {
183 		note_start = (Elf_Addr)(char *)hdr + phdr->p_offset;
184 	    }
185 	    note_end = note_start + phdr->p_filesz;
186 	    break;
187 	}
188 
189 	++phdr;
190     }
191     if (phdyn == NULL) {
192 	_rtld_error("%s: object is not dynamically-linked", path);
193 	goto error;
194     }
195 
196     if (nsegs < 0) {
197 	_rtld_error("%s: too few PT_LOAD segments", path);
198 	goto error;
199     }
200 
201     /*
202      * Map the entire address space of the object, to stake out our
203      * contiguous region, and to establish the base address for relocation.
204      */
205     base_vaddr = rtld_trunc_page(segs[0]->p_vaddr);
206     base_vlimit = rtld_round_page(segs[nsegs]->p_vaddr + segs[nsegs]->p_memsz);
207     mapsize = base_vlimit - base_vaddr;
208     base_addr = (caddr_t) base_vaddr;
209     base_flags = __getosreldate() >= P_OSREL_MAP_GUARD ? MAP_GUARD :
210 	MAP_PRIVATE | MAP_ANON | MAP_NOCORE;
211     if (npagesizes > 1 && rtld_round_page(segs[0]->p_filesz) >= pagesizes[1])
212 	base_flags |= MAP_ALIGNED_SUPER;
213     if (base_vaddr != 0)
214 	base_flags |= MAP_FIXED | MAP_EXCL;
215 
216     mapbase = mmap(base_addr, mapsize, PROT_NONE, base_flags, -1, 0);
217     if (mapbase == MAP_FAILED) {
218 	_rtld_error("%s: mmap of entire address space failed: %s",
219 	  path, rtld_strerror(errno));
220 	goto error;
221     }
222     if (base_addr != NULL && mapbase != base_addr) {
223 	_rtld_error("%s: mmap returned wrong address: wanted %p, got %p",
224 	  path, base_addr, mapbase);
225 	goto error1;
226     }
227 
228     for (i = 0; i <= nsegs; i++) {
229 	/* Overlay the segment onto the proper region. */
230 	data_offset = rtld_trunc_page(segs[i]->p_offset);
231 	data_vaddr = rtld_trunc_page(segs[i]->p_vaddr);
232 	data_vlimit = rtld_round_page(segs[i]->p_vaddr + segs[i]->p_filesz);
233 	data_addr = mapbase + (data_vaddr - base_vaddr);
234 	data_prot = convert_prot(segs[i]->p_flags);
235 	data_flags = convert_flags(segs[i]->p_flags) | MAP_FIXED;
236 	if (data_vlimit != data_vaddr &&
237 	    mmap(data_addr, data_vlimit - data_vaddr, data_prot,
238 	    data_flags | MAP_PREFAULT_READ, fd, data_offset) == MAP_FAILED) {
239 		_rtld_error("%s: mmap of data failed: %s", path,
240 		    rtld_strerror(errno));
241 		goto error1;
242 	}
243 
244 	/* Do BSS setup */
245 	if (segs[i]->p_filesz != segs[i]->p_memsz) {
246 
247 	    /* Clear any BSS in the last page of the segment. */
248 	    clear_vaddr = segs[i]->p_vaddr + segs[i]->p_filesz;
249 	    clear_addr = mapbase + (clear_vaddr - base_vaddr);
250 	    clear_page = mapbase + (rtld_trunc_page(clear_vaddr) - base_vaddr);
251 
252 	    if ((nclear = data_vlimit - clear_vaddr) > 0) {
253 		/* Make sure the end of the segment is writable */
254 		if ((data_prot & PROT_WRITE) == 0 && -1 ==
255 		     mprotect(clear_page, page_size, data_prot|PROT_WRITE)) {
256 			_rtld_error("%s: mprotect failed: %s", path,
257 			    rtld_strerror(errno));
258 			goto error1;
259 		}
260 
261 		memset(clear_addr, 0, nclear);
262 
263 		/* Reset the data protection back */
264 		if ((data_prot & PROT_WRITE) == 0)
265 		    mprotect(clear_page, page_size, data_prot);
266 	    }
267 
268 	    /* Overlay the BSS segment onto the proper region. */
269 	    bss_vaddr = data_vlimit;
270 	    bss_vlimit = rtld_round_page(segs[i]->p_vaddr + segs[i]->p_memsz);
271 	    bss_addr = mapbase +  (bss_vaddr - base_vaddr);
272 	    if (bss_vlimit > bss_vaddr) {	/* There is something to do */
273 		if (mmap(bss_addr, bss_vlimit - bss_vaddr, data_prot,
274 		    data_flags | MAP_ANON, -1, 0) == MAP_FAILED) {
275 		    _rtld_error("%s: mmap of bss failed: %s", path,
276 			rtld_strerror(errno));
277 		    goto error1;
278 		}
279 	    }
280 	}
281 
282 	if (phdr_vaddr == 0 && data_offset <= hdr->e_phoff &&
283 	  (data_vlimit - data_vaddr + data_offset) >=
284 	  (hdr->e_phoff + hdr->e_phnum * sizeof (Elf_Phdr))) {
285 	    phdr_vaddr = data_vaddr + hdr->e_phoff - data_offset;
286 	}
287     }
288 
289     obj = obj_new();
290     if (sb != NULL) {
291 	obj->dev = sb->st_dev;
292 	obj->ino = sb->st_ino;
293     }
294     obj->mapbase = mapbase;
295     obj->mapsize = mapsize;
296     obj->vaddrbase = base_vaddr;
297     obj->relocbase = mapbase - base_vaddr;
298     obj->dynamic = (const Elf_Dyn *)(obj->relocbase + phdyn->p_vaddr);
299     if (hdr->e_entry != 0)
300 	obj->entry = (caddr_t)(obj->relocbase + hdr->e_entry);
301     if (phdr_vaddr != 0) {
302 	obj->phdr = (const Elf_Phdr *)(obj->relocbase + phdr_vaddr);
303     } else {
304 	obj->phdr = malloc(phsize);
305 	if (obj->phdr == NULL) {
306 	    obj_free(obj);
307 	    _rtld_error("%s: cannot allocate program header", path);
308 	    goto error1;
309 	}
310 	memcpy(__DECONST(char *, obj->phdr), (char *)hdr + hdr->e_phoff, phsize);
311 	obj->phdr_alloc = true;
312     }
313     obj->phsize = phsize;
314     if (phinterp != NULL)
315 	obj->interp = (const char *)(obj->relocbase + phinterp->p_vaddr);
316     if (phtls != NULL) {
317 	tls_dtv_generation++;
318 	obj->tlsindex = ++tls_max_index;
319 	obj->tlssize = phtls->p_memsz;
320 	obj->tlsalign = phtls->p_align;
321 	obj->tlspoffset = phtls->p_offset;
322 	obj->tlsinitsize = phtls->p_filesz;
323 	obj->tlsinit = mapbase + phtls->p_vaddr;
324     }
325     obj->stack_flags = stack_flags;
326     obj->relro_page = obj->relocbase + rtld_trunc_page(relro_page);
327     obj->relro_size = rtld_trunc_page(relro_page + relro_size) -
328       rtld_trunc_page(relro_page);
329     if (note_start < note_end)
330 	digest_notes(obj, note_start, note_end);
331     if (note_map != NULL)
332 	munmap(note_map, note_map_len);
333     munmap(hdr, page_size);
334     return (obj);
335 
336 error1:
337     munmap(mapbase, mapsize);
338 error:
339     if (note_map != NULL && note_map != MAP_FAILED)
340 	munmap(note_map, note_map_len);
341     if (!phdr_in_zero_page(hdr))
342 	munmap(phdr, hdr->e_phnum * sizeof(phdr[0]));
343     munmap(hdr, page_size);
344     return (NULL);
345 }
346 
347 bool
348 check_elf_headers(const Elf_Ehdr *hdr, const char *path)
349 {
350 	if (!IS_ELF(*hdr)) {
351 		_rtld_error("%s: invalid file format", path);
352 		return (false);
353 	}
354 	if (hdr->e_ident[EI_CLASS] != ELF_TARG_CLASS ||
355 	    hdr->e_ident[EI_DATA] != ELF_TARG_DATA) {
356 		_rtld_error("%s: unsupported file layout", path);
357 		return (false);
358 	}
359 	if (hdr->e_ident[EI_VERSION] != EV_CURRENT ||
360 	    hdr->e_version != EV_CURRENT) {
361 		_rtld_error("%s: unsupported file version", path);
362 		return (false);
363 	}
364 	if (hdr->e_type != ET_EXEC && hdr->e_type != ET_DYN) {
365 		_rtld_error("%s: unsupported file type", path);
366 		return (false);
367 	}
368 	if (hdr->e_machine != ELF_TARG_MACH) {
369 		_rtld_error("%s: unsupported machine", path);
370 		return (false);
371 	}
372 	if (hdr->e_phentsize != sizeof(Elf_Phdr)) {
373 		_rtld_error(
374 	    "%s: invalid shared object: e_phentsize != sizeof(Elf_Phdr)", path);
375 		return (false);
376 	}
377 	return (true);
378 }
379 
380 static Elf_Ehdr *
381 get_elf_header(int fd, const char *path, const struct stat *sbp,
382     Elf_Phdr **phdr_p)
383 {
384 	Elf_Ehdr *hdr;
385 	Elf_Phdr *phdr;
386 
387 	/* Make sure file has enough data for the ELF header */
388 	if (sbp != NULL && sbp->st_size < (off_t)sizeof(Elf_Ehdr)) {
389 		_rtld_error("%s: invalid file format", path);
390 		return (NULL);
391 	}
392 
393 	hdr = mmap(NULL, page_size, PROT_READ, MAP_PRIVATE | MAP_PREFAULT_READ,
394 	    fd, 0);
395 	if (hdr == MAP_FAILED) {
396 		_rtld_error("%s: read error: %s", path, rtld_strerror(errno));
397 		return (NULL);
398 	}
399 
400 	/* Make sure the file is valid */
401 	if (!check_elf_headers(hdr, path))
402 		goto error;
403 
404 	/*
405 	 * We rely on the program header being in the first page.  This is
406 	 * not strictly required by the ABI specification, but it seems to
407 	 * always true in practice.  And, it simplifies things considerably.
408 	 */
409 	if (phdr_in_zero_page(hdr)) {
410 		phdr = (Elf_Phdr *)((char *)hdr + hdr->e_phoff);
411 	} else {
412 		phdr = mmap(NULL, hdr->e_phnum * sizeof(phdr[0]),
413 		    PROT_READ, MAP_PRIVATE | MAP_PREFAULT_READ, fd,
414 		    hdr->e_phoff);
415 		if (phdr == MAP_FAILED) {
416 			_rtld_error("%s: error mapping phdr: %s", path,
417 			    rtld_strerror(errno));
418 			goto error;
419 		}
420 	}
421 	*phdr_p = phdr;
422 	return (hdr);
423 
424 error:
425 	munmap(hdr, page_size);
426 	return (NULL);
427 }
428 
429 void
430 obj_free(Obj_Entry *obj)
431 {
432     Objlist_Entry *elm;
433 
434     if (obj->tls_static)
435 	free_tls_offset(obj);
436     while (obj->needed != NULL) {
437 	Needed_Entry *needed = obj->needed;
438 	obj->needed = needed->next;
439 	free(needed);
440     }
441     while (!STAILQ_EMPTY(&obj->names)) {
442 	Name_Entry *entry = STAILQ_FIRST(&obj->names);
443 	STAILQ_REMOVE_HEAD(&obj->names, link);
444 	free(entry);
445     }
446     while (!STAILQ_EMPTY(&obj->dldags)) {
447 	elm = STAILQ_FIRST(&obj->dldags);
448 	STAILQ_REMOVE_HEAD(&obj->dldags, link);
449 	free(elm);
450     }
451     while (!STAILQ_EMPTY(&obj->dagmembers)) {
452 	elm = STAILQ_FIRST(&obj->dagmembers);
453 	STAILQ_REMOVE_HEAD(&obj->dagmembers, link);
454 	free(elm);
455     }
456     if (obj->vertab)
457 	free(obj->vertab);
458     if (obj->origin_path)
459 	free(obj->origin_path);
460     if (obj->z_origin)
461 	free(__DECONST(void*, obj->rpath));
462     if (obj->priv)
463 	free(obj->priv);
464     if (obj->path)
465 	free(obj->path);
466     if (obj->phdr_alloc)
467 	free(__DECONST(void *, obj->phdr));
468     free(obj);
469 }
470 
471 Obj_Entry *
472 obj_new(void)
473 {
474     Obj_Entry *obj;
475 
476     obj = CNEW(Obj_Entry);
477     STAILQ_INIT(&obj->dldags);
478     STAILQ_INIT(&obj->dagmembers);
479     STAILQ_INIT(&obj->names);
480     return obj;
481 }
482 
483 /*
484  * Given a set of ELF protection flags, return the corresponding protection
485  * flags for MMAP.
486  */
487 int
488 convert_prot(int elfflags)
489 {
490     int prot = 0;
491     if (elfflags & PF_R)
492 	prot |= PROT_READ;
493     if (elfflags & PF_W)
494 	prot |= PROT_WRITE;
495     if (elfflags & PF_X)
496 	prot |= PROT_EXEC;
497     return prot;
498 }
499 
500 static int
501 convert_flags(int elfflags)
502 {
503     int flags = MAP_PRIVATE; /* All mappings are private */
504 
505     /*
506      * Readonly mappings are marked "MAP_NOCORE", because they can be
507      * reconstructed by a debugger.
508      */
509     if (!(elfflags & PF_W))
510 	flags |= MAP_NOCORE;
511     return flags;
512 }
513