[Bug libc/18801] New: PIE binary with STT_GNU_IFUNC symbol and TEXTREL segfaults on x86_64

[Bug libc/18801] New: PIE binary with STT_GNU_IFUNC symbol and TEXTREL segfaults on x86_64

[tmsriram at google dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=18801

            Bug ID: 18801
           Summary: PIE binary with STT_GNU_IFUNC symbol and TEXTREL
                    segfaults on x86_64
           Product: glibc
           Version: 2.21
            Status: NEW
          Severity: normal
          Priority: P2
         Component: libc
          Assignee: unassigned at sourceware dot org
          Reporter: tmsriram at google dot com
                CC: drepper.fsp at gmail dot com, hjl.tools at gmail dot com,
                    ppluzhnikov at google dot com
  Target Milestone: ---

Created attachment 8500
  --> https://sourceware.org/bugzilla/attachment.cgi?id=8500&action=edit
Preserve the original segment's execute permissions when protecting the page
for writing it.

We have a PIE binary with TEXTREL and a STT_GNU_IFUNC symbol that segfaults at
start-up.

How to reproduce the problem:

zoo.cc
-------
int zoo_1 () {
  return 0;
}

extern "C"
void *selector () {
  return (void *)&zoo_1;
}

int zoo() __attribute__ ((ifunc ("selector")));

int main() {
  return zoo ();
}

$ g++ -mcmodel=large -pie foo.cc

$readelf -Wta ./a.out | grep TEXTREL
0x0000000000000016 (TEXTREL)            0x0
0x000000000000001e (FLAGS)              TEXTREL

$ ./a.out
Segmentation Fault

Notes:
* Use mcmodel=large and -pie to create Text relocations.

$ gdb ./a.out
bt

(gdb) bt
#0  0x000055555555476b in selector ()
#1  0x00007ffff7de6638 in _dl_relocate_object () from
/usr/grte/v4/lib64/ld-linux-x86-64.so.2
#2  0x00007ffff7ddc84d in dl_main () from
/usr/grte/v4/lib64/ld-linux-x86-64.so.2


The segfault happens due to this:

 if (__glibc_unlikely (l->l_info[DT_TEXTREL] != NULL)) 
    {
       .....

           if (__mprotect (newp->start, newp->len, PROT_READ|PROT_WRITE) < 0)
             {
               ...
             }

The execute permission of the PT_LOAD segment is removed in the process of
marking for write.  

The attached patch seems to fix the problem.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/18801] PIE binary with STT_GNU_IFUNC symbol and TEXTREL segfaults on x86_64

[tmsriram at google dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=18801

Sriraman Tallam <tmsriram at google dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |tmsriram at google dot com

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/18801] PIE binary with STT_GNU_IFUNC symbol and TEXTREL segfaults on x86_64

[ppluzhnikov at google dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=18801

Paul Pluzhnikov <ppluzhnikov at google dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|unassigned at sourceware dot org   |ppluzhnikov at google dot com

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/18801] PIE binary with STT_GNU_IFUNC symbol and TEXTREL segfaults on x86_64

[hjl.tools at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=18801

--- Comment #1 from H.J. Lu <hjl.tools at gmail dot com> ---
(In reply to Sriraman Tallam from comment #0)
> Created attachment 8500 [details]
> Preserve the original segment's execute permissions when protecting the page
> for writing it.
> 
> We have a PIE binary with TEXTREL and a STT_GNU_IFUNC symbol that segfaults
> at start-up.
> 
> How to reproduce the problem:
> 
> zoo.cc
> -------
> int zoo_1 () {
>   return 0;
> }
> 
> extern "C"
> void *selector () {
>   return (void *)&zoo_1;
> }
> 
> int zoo() __attribute__ ((ifunc ("selector")));
> 
> int main() {
>   return zoo ();
> }
> 
> $ g++ -mcmodel=large -pie foo.cc
> 
> $readelf -Wta ./a.out | grep TEXTREL
> 0x0000000000000016 (TEXTREL)            0x0
> 0x000000000000001e (FLAGS)              TEXTREL
> 
> $ ./a.out
> Segmentation Fault
> 
> Notes:
> * Use mcmodel=large and -pie to create Text relocations.

Please add the testcase to your patch.  Please don't use

__attribute__ ((ifunc ("selector")));

since older compilers don't support it.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/18801] PIE binary with STT_GNU_IFUNC symbol and TEXTREL segfaults on x86_64

[tmsriram at google dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=18801

Sriraman Tallam <tmsriram at google dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Attachment #8500|0                           |1
        is obsolete|                            |

--- Comment #2 from Sriraman Tallam <tmsriram at google dot com> ---
Created attachment 8503
  --> https://sourceware.org/bugzilla/attachment.cgi?id=8503&action=edit
Preserve the original segment's execute permissions when protecting the page
for writing it

Added test case.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/18801] PIE binary with STT_GNU_IFUNC symbol and TEXTREL segfaults on x86_64

[ppluzhnikov at google dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=18801

--- Comment #3 from Paul Pluzhnikov <ppluzhnikov at google dot com> ---
Google ref: b/20921387

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/18801] PIE binary with STT_GNU_IFUNC symbol and TEXTREL segfaults on x86_64

[hjl.tools at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=18801

--- Comment #4 from H.J. Lu <hjl.tools at gmail dot com> ---
(In reply to Sriraman Tallam from comment #2)
> Created attachment 8503 [details]
> Preserve the original segment's execute permissions when protecting the page
> for writing it
> 
> Added test case.

diff --git a/sysdeps/x86_64/Makefile b/sysdeps/x86_64/Makefile
index ef70a50..da06361 100644
--- a/sysdeps/x86_64/Makefile
+++ b/sysdeps/x86_64/Makefile
@@ -34,6 +34,12 @@ tests-pie += $(quad-pie-test)
 $(objpfx)tst-quad1pie: $(objpfx)tst-quadmod1pie.o
 $(objpfx)tst-quad2pie: $(objpfx)tst-quadmod2pie.o

+ifunc-pie-txtrel-test += tst-pie-ifunc-txtrel 
+tests += $(ifunc-pie-txtrel-test)
+tests-pie += $(ifunc-pie-txtrel-test)
+
+$(objpfx)tst-pie-ifunc-txtrel: $(objpfx)tst-pie-ifunc-txtrel.o
+

Do we need

$(objpfx)tst-pie-ifunc-txtrel: $(objpfx)tst-pie-ifunc-txtrel.o

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/18801] PIE binary with STT_GNU_IFUNC symbol and TEXTREL segfaults on x86_64

[tmsriram at google dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=18801

Sriraman Tallam <tmsriram at google dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |iant at google dot com

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/18801] PIE binary with STT_GNU_IFUNC symbol and TEXTREL segfaults on x86_64

[tmsriram at google dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=18801

Sriraman Tallam <tmsriram at google dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Attachment #8503|0                           |1
        is obsolete|                            |

--- Comment #5 from Sriraman Tallam <tmsriram at google dot com> ---
Created attachment 8504
  --> https://sourceware.org/bugzilla/attachment.cgi?id=8504&action=edit
Preserve the original segment's execute permissions when protecting the page
for writing it

Patch Updated.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/18801] PIE binary with STT_GNU_IFUNC symbol and TEXTREL segfaults on x86_64

[hjl.tools at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=18801

--- Comment #6 from H.J. Lu <hjl.tools at gmail dot com> ---
(In reply to Sriraman Tallam from comment #5)
> Created attachment 8504 [details]
> Preserve the original segment's execute permissions when protecting the page
> for writing it
> 
> Patch Updated.

main:
+       movabsq $selector, %rax
+       call    *%rax
+       movl    $0, %eax

Remove this line since foo returns 0.

+       ret

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/18801] PIE binary with STT_GNU_IFUNC symbol and TEXTREL segfaults on x86_64

[tmsriram at google dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=18801

Sriraman Tallam <tmsriram at google dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Attachment #8504|0                           |1
        is obsolete|                            |

--- Comment #7 from Sriraman Tallam <tmsriram at google dot com> ---
Created attachment 8505
  --> https://sourceware.org/bugzilla/attachment.cgi?id=8505&action=edit
Preserve the original segment's execute permissions when protecting the page
for writing it

Patch updated.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug libc/18801] PIE binary with STT_GNU_IFUNC symbol and TEXTREL segfaults on x86_64

[hjl.tools at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=18801

--- Comment #8 from H.J. Lu <hjl.tools at gmail dot com> ---
(In reply to Sriraman Tallam from comment #7)
> Created attachment 8505 [details]
> Preserve the original segment's execute permissions when protecting the page
> for writing it
> 
> Patch updated.

Looks good to me.  Please send it to libc-alpha@sourceware.org.  Thanks.

-- 
You are receiving this mail because:
You are on the CC list for the bug.