From: Florian Weimer <fweimer@redhat.com>
To: libc-alpha@sourceware.org
Subject: [PATCH 31/33] elf: Put critical _dl_find_object pointers into protected memory area
Date: Tue, 04 Jul 2023 22:04:31 +0200 [thread overview]
Message-ID: <62ebfeddb192dae9fdac593d82238c34e1dcd5f8.1688499219.git.fweimer@redhat.com> (raw)
In-Reply-To: <cover.1688499219.git.fweimer@redhat.com>
With this change, all control data for _dl_find_object is either
RELRO data, or in the protected area, or tightly constrained
(the version counter is always masked using & 1 before array
indexing).
This commit can serve as an example how to extend the protected
memory area.
---
elf/dl-find_object.c | 39 +++++++++++++++++++-------------------
sysdeps/generic/ldsodefs.h | 9 +++++++++
2 files changed, 29 insertions(+), 19 deletions(-)
diff --git a/elf/dl-find_object.c b/elf/dl-find_object.c
index 82f493d817..baab80fdb7 100644
--- a/elf/dl-find_object.c
+++ b/elf/dl-find_object.c
@@ -120,13 +120,6 @@ struct dlfo_mappings_segment
struct dl_find_object_internal objects[]; /* Read in the TM region. */
};
-/* To achieve async-signal-safety, two copies of the data structure
- are used, so that a signal handler can still use this data even if
- dlopen or dlclose modify the other copy. The the least significant
- bit in _dlfo_loaded_mappings_version determines which array element
- is the currently active region. */
-static struct dlfo_mappings_segment *_dlfo_loaded_mappings[2];
-
/* Returns the number of actually used elements in all segments
starting at SEG. */
static inline size_t
@@ -192,10 +185,17 @@ _dlfo_mappings_segment_allocate (size_t size,
}
/* Monotonic counter for software transactional memory. The lowest
- bit indicates which element of the _dlfo_loaded_mappings contains
- up-to-date data. */
+ bit indicates which element of the GLPM (dlfo_loaded_mappings)
+ contains up-to-date data. This achieves async-signal-safety for
+ _dl_find_object: a signal handler can still use the
+ GLPM (dlfo_loaded_mappings) data even if dlopen or dlclose
+ modify the other copy. */
static __atomic_wide_counter _dlfo_loaded_mappings_version;
+#ifndef SHARED
+struct dlfo_mappings_segment *_dlfo_loaded_mappings[2];
+#endif
+
/* TM version at the start of the read operation. */
static inline uint64_t
_dlfo_read_start_version (void)
@@ -263,7 +263,7 @@ _dlfo_read_success (uint64_t start_version)
static struct dlfo_mappings_segment *
_dlfo_mappings_active_segment (uint64_t start_version)
{
- return _dlfo_loaded_mappings[start_version & 1];
+ return GLPM (dlfo_loaded_mappings)[start_version & 1];
}
/* Searches PC among the address-sorted array [FIRST1, FIRST1 +
@@ -472,10 +472,10 @@ _dlfo_process_initial (void)
}
else if (l->l_type == lt_loaded)
{
- if (_dlfo_loaded_mappings[0] != NULL)
+ if (GLPM (dlfo_loaded_mappings)[0] != NULL)
/* Second pass only. */
_dl_find_object_from_map
- (l, &_dlfo_loaded_mappings[0]->objects[loaded]);
+ (l, &GLPM (dlfo_loaded_mappings)[0]->objects[loaded]);
++loaded;
}
}
@@ -535,10 +535,10 @@ _dl_find_object_init (void)
= _dl_protmem_allocate (_dlfo_nodelete_mappings_size
* sizeof (*_dlfo_nodelete_mappings));
if (loaded_size > 0)
- _dlfo_loaded_mappings[0]
+ GLPM (dlfo_loaded_mappings)[0]
= _dlfo_mappings_segment_allocate (loaded_size, NULL);
if (_dlfo_nodelete_mappings == NULL
- || (loaded_size > 0 && _dlfo_loaded_mappings[0] == NULL))
+ || (loaded_size > 0 && GLPM (dlfo_loaded_mappings)[0] == NULL))
_dl_fatal_printf ("\
Fatal glibc error: cannot allocate memory for find-object data\n");
/* Fill in the data with the second call. */
@@ -554,8 +554,8 @@ Fatal glibc error: cannot allocate memory for find-object data\n");
_dlfo_nodelete_mappings_end = _dlfo_nodelete_mappings[last_idx].map_end;
}
if (loaded_size > 0)
- _dlfo_sort_mappings (_dlfo_loaded_mappings[0]->objects,
- _dlfo_loaded_mappings[0]->size);
+ _dlfo_sort_mappings (GLPM (dlfo_loaded_mappings)[0]->objects,
+ GLPM (dlfo_loaded_mappings)[0]->size);
}
static void
@@ -609,11 +609,11 @@ _dl_find_object_update_1 (struct link_map_private **loaded, size_t count)
int active_idx = _dlfo_read_version_locked () & 1;
struct dlfo_mappings_segment *current_seg
- = _dlfo_loaded_mappings[active_idx];
+ = GLPM (dlfo_loaded_mappings)[active_idx];
size_t current_used = _dlfo_mappings_segment_count_used (current_seg);
struct dlfo_mappings_segment *target_seg
- = _dlfo_loaded_mappings[!active_idx];
+ = GLPM (dlfo_loaded_mappings)[!active_idx];
size_t remaining_to_add = current_used + count;
/* Ensure that the new segment chain has enough space. */
@@ -634,7 +634,8 @@ _dl_find_object_update_1 (struct link_map_private **loaded, size_t count)
/* The barrier ensures that a concurrent TM read or fork does
not see a partially initialized segment. */
- atomic_store_release (&_dlfo_loaded_mappings[!active_idx], target_seg);
+ atomic_store_release (&GLPM (dlfo_loaded_mappings)[!active_idx],
+ target_seg);
}
else
/* Start update cycle without allocation. */
diff --git a/sysdeps/generic/ldsodefs.h b/sysdeps/generic/ldsodefs.h
index 7719e3af26..c13a686267 100644
--- a/sysdeps/generic/ldsodefs.h
+++ b/sysdeps/generic/ldsodefs.h
@@ -523,6 +523,8 @@ extern struct rtld_global _rtld_global __rtld_global_attribute__;
# undef __rtld_global_attribute__
#endif
+struct dlfo_mappings_segment;
+
#ifdef SHARED
/* Implementation structure for the protected memory area. In static
builds, the protected memory area is just regular (.data) memory,
@@ -532,6 +534,13 @@ struct rtld_protmem
{
/* Structure describing the dynamic linker itself. */
EXTERN struct link_map_private _dl_rtld_map;
+#endif /* SHARED */
+
+ /* Two copies of the data structures for _dl_find_object. See
+ _dlfo_loaded_mappings_version in dl-find_object.c. */
+ EXTERN struct dlfo_mappings_segment *_dlfo_loaded_mappings[2];
+
+#ifdef SHARED
};
#endif /* SHARED */
--
2.41.0
next prev parent reply other threads:[~2023-07-04 20:04 UTC|newest]
Thread overview: 45+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-07-04 20:02 [PATCH 00/33] RFC: RELRO link maps Florian Weimer
2023-07-04 20:02 ` [PATCH 01/33] support: Add <support/memprobe.h> for protection flags probing Florian Weimer
2023-07-04 20:02 ` [PATCH 02/33] misc: Enable internal use of memory protection keys Florian Weimer
2023-07-04 20:02 ` [PATCH 03/33] elf: Remove _dl_sysdep_open_object hook function Florian Weimer
2023-07-04 20:02 ` [PATCH 04/33] elf: Eliminate second loop in find_version in dl-version.c Florian Weimer
2023-07-04 20:02 ` [PATCH 05/33] elf: In rtld_setup_main_map, assume ld.so has a DYNAMIC segment Florian Weimer
2023-07-04 20:02 ` [PATCH 06/33] elf: Remove version assert in check_match in elf/dl-lookup.c Florian Weimer
2023-07-04 20:02 ` [PATCH 07/33] elf: Disambiguate some failures in _dl_load_cache_lookup Florian Weimer
2023-07-04 20:02 ` [PATCH 08/33] elf: Eliminate alloca in open_verify Florian Weimer
2023-07-04 20:02 ` [PATCH 09/33] Do not export <alloc_buffer.h> functions from libc Florian Weimer
2023-07-04 20:02 ` [PATCH 10/33] elf: Make <alloc_buffer.h> usable in ld.so Florian Weimer
2023-07-04 20:03 ` [PATCH 11/33] elf: Merge the three implementations of _dl_dst_substitute Florian Weimer
2023-07-04 20:03 ` [PATCH 12/33] elf: _dl_find_object may return 1 during early startup (bug 30515) Florian Weimer
2023-07-04 20:03 ` [PATCH 13/33] elf: Move __rtld_malloc_init_stubs call into _dl_start_final Florian Weimer
2023-07-04 20:03 ` [PATCH 14/33] elf: Merge __dl_libc_freemem into __rtld_libc_freeres Florian Weimer
2023-07-04 20:03 ` [PATCH 15/33] elf: Use struct link_map_private for the internal link map Florian Weimer
2023-07-04 20:03 ` [PATCH 16/33] elf: Remove run-time-writable fields from struct link_map_private Florian Weimer
2023-07-04 20:03 ` [PATCH 17/33] elf: Move l_tls_offset into read-write part of link map Florian Weimer
2023-07-04 20:03 ` [PATCH 18/33] elf: Allocate auditor state after read-write " Florian Weimer
2023-07-04 20:03 ` [PATCH 19/33] elf: Move link map fields used by dependency sorting to writable part Florian Weimer
2023-07-04 20:03 ` [PATCH 20/33] elf: Split _dl_lookup_map, _dl_map_new_object from _dl_map_object Florian Weimer
2023-07-04 20:03 ` [PATCH 21/33] elf: Add l_soname accessor function for DT_SONAME values Florian Weimer
2023-07-04 20:03 ` [PATCH 22/33] elf: _dl_rtld_map should not exist in static builds Florian Weimer
2023-07-04 20:03 ` [PATCH 23/33] elf: Introduce GLPM accessor for the protected memory area Florian Weimer
2023-07-04 20:04 ` [PATCH 24/33] elf: Bootstrap allocation for future protected memory allocator Florian Weimer
2023-07-04 20:04 ` [PATCH 25/33] elf: Implement a basic " Florian Weimer
2023-07-04 20:04 ` [PATCH 26/33] elf: Move most of the _dl_find_object data to the protected heap Florian Weimer
2023-07-04 20:04 ` [PATCH 27/33] elf: Switch to a region-based protected memory allocator Florian Weimer
2023-07-04 20:04 ` [PATCH 28/33] elf: Determine the caller link map in _dl_open Florian Weimer
2023-07-04 20:04 ` [PATCH 29/33] elf: Add fast path to dlopen for fully-opened maps Florian Weimer
2023-07-04 20:04 ` [PATCH 30/33] elf: Use _dl_find_object instead of _dl_find_dso_for_object in dlopen Florian Weimer
2023-07-04 20:04 ` Florian Weimer [this message]
2023-07-04 20:04 ` [PATCH 32/33] elf: Add hash tables to speed up DT_NEEDED, dlopen lookups Florian Weimer
2023-07-04 20:04 ` [PATCH 33/33] elf: Use memory protection keys for the protected memory allocator Florian Weimer
2023-07-04 20:07 ` [PATCH 00/33] RFC: RELRO link maps Florian Weimer
2023-07-05 15:54 ` Carlos O'Donell
2023-07-05 15:57 ` Florian Weimer
2023-07-05 17:48 ` Carlos O'Donell
2023-07-05 17:58 ` Adhemerval Zanella Netto
2023-07-07 11:10 ` Florian Weimer
2023-07-07 12:42 ` Florian Weimer
2023-07-07 12:48 ` Adhemerval Zanella Netto
2023-07-07 13:18 ` Florian Weimer
2023-07-07 13:58 ` Adhemerval Zanella Netto
2023-07-07 14:55 ` Florian Weimer
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=62ebfeddb192dae9fdac593d82238c34e1dcd5f8.1688499219.git.fweimer@redhat.com \
--to=fweimer@redhat.com \
--cc=libc-alpha@sourceware.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).