[Bug dynamic-link/28340] New: ld.so crashes while loading a DSO with a read-only dynamic section

[Bug dynamic-link/28340] New: ld.so crashes while loading a DSO with a read-only dynamic section

[siddhesh at sourceware dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=28340

            Bug ID: 28340
           Summary: ld.so crashes while loading a DSO with a read-only
                    dynamic section
           Product: glibc
           Version: unspecified
            Status: NEW
          Severity: normal
          Priority: P2
         Component: dynamic-link
          Assignee: siddhesh at sourceware dot org
          Reporter: siddhesh at sourceware dot org
  Target Milestone: ---

ld.so crashes when trying to verify DSO with read-only dynamic section, e.g.
vdso64.so as shipped by the Linux kernel.

$ elf/ld.so --verify $(find /usr -name vdso64.so | head -1)

Actual Result:
Segfault

Expected Result:
Not crash

Since there's no way to load a dynamic object that has a read-only .dynamic
section and at the same time, has entries in the .dynamic section that need
adjustment during relocation, e.g. .plt.got address, .symtab address, etc.,
fail to load and return an error.

Patch coming up.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug dynamic-link/28340] ld.so crashes while loading a DSO with a read-only dynamic section

[siddhesh at sourceware dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=28340

Siddhesh Poyarekar <siddhesh at sourceware dot org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug dynamic-link/28340] ld.so crashes while loading a DSO with a read-only dynamic section

[cvs-commit at gcc dot gnu.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=28340

--- Comment #1 from cvs-commit at gcc dot gnu.org <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by H.J. Lu <hjl@sourceware.org>:

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=b413280cfb16834450f66f554bc0d618bb513851

commit b413280cfb16834450f66f554bc0d618bb513851
Author: H.J. Lu <hjl.tools@gmail.com>
Date:   Thu Sep 16 08:15:29 2021 -0700

    ld.so: Replace DL_RO_DYN_SECTION with dl_relocate_ld [BZ #28340]

    We can't relocate entries in dynamic section if it is readonly:

    1. Add a l_ld_readonly field to struct link_map to indicate if dynamic
    section is readonly and set it based on p_flags of PT_DYNAMIC segment.
    2. Replace DL_RO_DYN_SECTION with dl_relocate_ld to decide if dynamic
    section should be relocated.
    3. Remove DL_RO_DYN_TEMP_CNT.
    4. Don't use a static dynamic section to make readonly dynamic section
    in vDSO writable.
    5. Remove the temp argument from elf_get_dynamic_info.

    This fixes BZ #28340.

    Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug dynamic-link/28340] ld.so crashes while loading a DSO with a read-only dynamic section

[hjl.tools at gmail dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=28340

H.J. Lu <hjl.tools at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Version|unspecified                 |2.34
         Resolution|---                         |FIXED
   Target Milestone|---                         |2.35
             Status|ASSIGNED                    |RESOLVED

--- Comment #2 from H.J. Lu <hjl.tools at gmail dot com> ---
Fixed for 2.35.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug dynamic-link/28340] ld.so crashes while loading a DSO with a read-only dynamic section

[fweimer at redhat dot com]

https://sourceware.org/bugzilla/show_bug.cgi?id=28340

Florian Weimer <fweimer at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
              Flags|                            |security-
                 CC|                            |fweimer at redhat dot com

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug dynamic-link/28340] ld.so crashes while loading a DSO with a read-only dynamic section

[cvs-commit at gcc dot gnu.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=28340

--- Comment #3 from cvs-commit at gcc dot gnu.org <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by H.J. Lu <hjl@sourceware.org>:

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=15e6d6785ac2935bb963506b47a37b3d1f728952

commit 15e6d6785ac2935bb963506b47a37b3d1f728952
Author: H.J. Lu <hjl.tools@gmail.com>
Date:   Fri Sep 24 08:56:42 2021 -0700

    Avoid warning: overriding recipe for .../tst-ro-dynamic-mod.so

    Add tst-ro-dynamic-mod to modules-names-nobuild to avoid

    ../Makerules:767: warning: ignoring old recipe for target
'.../elf/tst-ro-dynamic-mod.so'

    This updates BZ #28340 fix.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug dynamic-link/28340] ld.so crashes while loading a DSO with a read-only dynamic section

[cvs-commit at gcc dot gnu.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=28340

--- Comment #4 from cvs-commit at gcc dot gnu.org <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by H.J. Lu <hjl@sourceware.org>:

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=2ec99d8c42b2ff1a1231e4df462a0910a9b7fdef

commit 2ec99d8c42b2ff1a1231e4df462a0910a9b7fdef
Author: H.J. Lu <hjl.tools@gmail.com>
Date:   Thu Sep 23 09:06:49 2021 -0700

    ld.so: Initialize bootstrap_map.l_ld_readonly [BZ #28340]

    1. Define DL_RO_DYN_SECTION to initalize bootstrap_map.l_ld_readonly
    before calling elf_get_dynamic_info to get dynamic info in bootstrap_map,
    2. Define a single

    static inline bool
    dl_relocate_ld (const struct link_map *l)
    {
      /* Don't relocate dynamic section if it is readonly  */
      return !(l->l_ld_readonly || DL_RO_DYN_SECTION);
    }

    This updates BZ #28340 fix.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug dynamic-link/28340] ld.so crashes while loading a DSO with a read-only dynamic section

[cvs-commit at gcc dot gnu.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=28340

--- Comment #5 from cvs-commit at gcc dot gnu.org <cvs-commit at gcc dot gnu.org> ---
The release/2.34/master branch has been updated by Florian Weimer
<fw@sourceware.org>:

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=f42373f911a28d34325a5bfc1ed5a962c89da7eb

commit f42373f911a28d34325a5bfc1ed5a962c89da7eb
Author: H.J. Lu <hjl.tools@gmail.com>
Date:   Thu Sep 16 08:15:29 2021 -0700

    ld.so: Replace DL_RO_DYN_SECTION with dl_relocate_ld [BZ #28340]

    We can't relocate entries in dynamic section if it is readonly:

    1. Add a l_ld_readonly field to struct link_map to indicate if dynamic
    section is readonly and set it based on p_flags of PT_DYNAMIC segment.
    2. Replace DL_RO_DYN_SECTION with dl_relocate_ld to decide if dynamic
    section should be relocated.
    3. Remove DL_RO_DYN_TEMP_CNT.
    4. Don't use a static dynamic section to make readonly dynamic section
    in vDSO writable.
    5. Remove the temp argument from elf_get_dynamic_info.

    This fixes BZ #28340.

    Reviewed-by: Siddhesh Poyarekar <siddhesh@sourceware.org>
    (cherry picked from commit b413280cfb16834450f66f554bc0d618bb513851)

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug dynamic-link/28340] ld.so crashes while loading a DSO with a read-only dynamic section

[cvs-commit at gcc dot gnu.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=28340

--- Comment #6 from cvs-commit at gcc dot gnu.org <cvs-commit at gcc dot gnu.org> ---
The release/2.34/master branch has been updated by Florian Weimer
<fw@sourceware.org>:

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=5f36e5c70107ecb59281ef57f9f1c0e37ec3076d

commit 5f36e5c70107ecb59281ef57f9f1c0e37ec3076d
Author: H.J. Lu <hjl.tools@gmail.com>
Date:   Thu Sep 23 09:06:49 2021 -0700

    ld.so: Initialize bootstrap_map.l_ld_readonly [BZ #28340]

    1. Define DL_RO_DYN_SECTION to initalize bootstrap_map.l_ld_readonly
    before calling elf_get_dynamic_info to get dynamic info in bootstrap_map,
    2. Define a single

    static inline bool
    dl_relocate_ld (const struct link_map *l)
    {
      /* Don't relocate dynamic section if it is readonly  */
      return !(l->l_ld_readonly || DL_RO_DYN_SECTION);
    }

    This updates BZ #28340 fix.

    (cherry picked from commit 2ec99d8c42b2ff1a1231e4df462a0910a9b7fdef)

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug dynamic-link/28340] ld.so crashes while loading a DSO with a read-only dynamic section

[cvs-commit at gcc dot gnu.org]

https://sourceware.org/bugzilla/show_bug.cgi?id=28340

--- Comment #7 from cvs-commit at gcc dot gnu.org <cvs-commit at gcc dot gnu.org> ---
The release/2.34/master branch has been updated by Florian Weimer
<fw@sourceware.org>:

https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=6548a9bdba95b3e1fcdbd85445342467e4b0cd4f

commit 6548a9bdba95b3e1fcdbd85445342467e4b0cd4f
Author: H.J. Lu <hjl.tools@gmail.com>
Date:   Fri Sep 24 08:56:42 2021 -0700

    Avoid warning: overriding recipe for .../tst-ro-dynamic-mod.so

    Add tst-ro-dynamic-mod to modules-names-nobuild to avoid

    ../Makerules:767: warning: ignoring old recipe for target
'.../elf/tst-ro-dynamic-mod.so'

    This updates BZ #28340 fix.

    (cherry picked from commit 15e6d6785ac2935bb963506b47a37b3d1f728952)

-- 
You are receiving this mail because:
You are on the CC list for the bug.

[Bug dynamic-link/28340] ld.so crashes while loading a DSO with a read-only dynamic section

[sam at gentoo dot org]

https://sourceware.org/bugzilla/show_bug.cgi?id=28340

Sam James <sam at gentoo dot org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |sam at gentoo dot org

-- 
You are receiving this mail because:
You are on the CC list for the bug.