[Bug dynamic-link/26926] New: aarch64: library dependencies are not bti protected

[Bug dynamic-link/26926] New: aarch64: library dependencies are not bti protected

[nsz at gcc dot gnu.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=26926

            Bug ID: 26926
           Summary: aarch64: library dependencies are not bti protected
           Product: glibc
           Version: 2.32
            Status: NEW
          Severity: normal
          Priority: P2
         Component: dynamic-link
          Assignee: unassigned at sourceware dot org
          Reporter: nsz at gcc dot gnu.org
  Target Milestone: ---

dl_open_check is only called on dlopened libraries not on
theirs dependencies, same for rtld_main_check: dependencies
are not checked.

the aarch64 backend *_check adds bti protection but it only
considers the passed linkmap, not its dependencies, so bti
protection is missing on those.

the bt VmFlag in /proc/self/smaps indicates bti protection, on
a bti enabled system it should be on all exec pages, but i see:

cat /proc/self/smaps |grep -E '(r-xp|VmFlags.*ex)'
00400000-004ff000 r-xp 00000000 00:14 10783380                          
/bin/busybox
VmFlags: rd ex mr mw me dw bt
fffff7d80000-fffff7edf000 r-xp 00000000 00:14 10759514                  
/lib64/libc-2.32.9000.so
VmFlags: rd ex mr mw me
fffff7ef7000-fffff7f0a000 r-xp 00000000 00:14 10759538                  
/lib64/libresolv-2.32.9000.so
VmFlags: rd ex mr mw me
fffff7f1e000-fffff7fb9000 r-xp 00000000 00:14 10759520                  
/lib64/libm-2.32.9000.so
VmFlags: rd ex mr mw me
fffff7fca000-fffff7fed000 r-xp 00000000 00:14 10759508                  
/lib64/ld-2.32.9000.so
VmFlags: rd ex mr mw me dw bt
fffff7ffc000-fffff7ffd000 r-xp 00000000 00:00 0                          [vdso]
VmFlags: rd ex mr mw me de bt

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug dynamic-link/26926] aarch64: library dependencies are not bti protected

[nsz at gcc dot gnu.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=26926

Szabolcs Nagy <nsz at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|unassigned at sourceware dot org   |nsz at gcc dot gnu.org

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug dynamic-link/26926] aarch64: library dependencies are not bti protected

[cvs-commit at gcc dot gnu.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=26926

--- Comment #1 from cvs-commit at gcc dot gnu.org <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Szabolcs Nagy <nsz@sourceware.org>:

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=72739c79f61989a76b7dd719f34fcfb7b8eadde9

commit 72739c79f61989a76b7dd719f34fcfb7b8eadde9
Author: Szabolcs Nagy <szabolcs.nagy@arm.com>
Date:   Fri Nov 20 15:27:06 2020 +0000

    aarch64: Fix missing BTI protection from dependencies [BZ #26926]

    The _dl_open_check and _rtld_main_check hooks are not called on the
    dependencies of a loaded module, so BTI protection was missed on
    every module other than the main executable and directly dlopened
    libraries.

    The fix just iterates over dependencies to enable BTI.

    Fixes bug 26926.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug dynamic-link/26926] aarch64: library dependencies are not bti protected

[nsz at gcc dot gnu.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=26926

Szabolcs Nagy <nsz at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
   Target Milestone|---                         |2.33
         Resolution|---                         |FIXED

--- Comment #2 from Szabolcs Nagy <nsz at gcc dot gnu.org> ---
fixed for 2.33, needs backport.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug dynamic-link/26926] aarch64: library dependencies are not bti protected

[cvs-commit at gcc dot gnu.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=26926

--- Comment #3 from cvs-commit at gcc dot gnu.org <cvs-commit at gcc dot gnu.org> ---
The release/2.32/master branch has been updated by Szabolcs Nagy
<nsz@sourceware.org>:

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=610e2c515045a5924f28d8c4fb0a5ddacc90980a

commit 610e2c515045a5924f28d8c4fb0a5ddacc90980a
Author: Szabolcs Nagy <szabolcs.nagy@arm.com>
Date:   Fri Nov 20 15:27:06 2020 +0000

    aarch64: Fix missing BTI protection from dependencies [BZ #26926]

    The _dl_open_check and _rtld_main_check hooks are not called on the
    dependencies of a loaded module, so BTI protection was missed on
    every module other than the main executable and directly dlopened
    libraries.

    The fix just iterates over dependencies to enable BTI.

    Fixes bug 26926.

    (cherry picked from commit 72739c79f61989a76b7dd719f34fcfb7b8eadde9)

-- 
You are receiving this mail because:
You are on the CC list for the bug.