[PATCH v3 30/32] elf: Put critical _dl_find_object pointers into protected memory area

[Florian Weimer <fweimer@redhat.com>]

With this change, all control data for _dl_find_object is either
RELRO data, or in the protected area, or tightly constrained
(the version counter is always masked using & 1 before array
indexing).

This commit can serve as an example how to extend the protected
memory area.
---
 elf/dl-find_object.c       | 39 +++++++++++++++++++-------------------
 sysdeps/generic/ldsodefs.h |  9 +++++++++
 2 files changed, 29 insertions(+), 19 deletions(-)

diff --git a/elf/dl-find_object.c b/elf/dl-find_object.c
index 82f493d817..baab80fdb7 100644
--- a/elf/dl-find_object.c
+++ b/elf/dl-find_object.c
@@ -120,13 +120,6 @@ struct dlfo_mappings_segment
   struct dl_find_object_internal objects[]; /* Read in the TM region.  */
 };
 
-/* To achieve async-signal-safety, two copies of the data structure
-   are used, so that a signal handler can still use this data even if
-   dlopen or dlclose modify the other copy.  The the least significant
-   bit in _dlfo_loaded_mappings_version determines which array element
-   is the currently active region.  */
-static struct dlfo_mappings_segment *_dlfo_loaded_mappings[2];
-
 /* Returns the number of actually used elements in all segments
    starting at SEG.  */
 static inline size_t
@@ -192,10 +185,17 @@ _dlfo_mappings_segment_allocate (size_t size,
 }
 
 /* Monotonic counter for software transactional memory.  The lowest
-   bit indicates which element of the _dlfo_loaded_mappings contains
-   up-to-date data.  */
+   bit indicates which element of the GLPM (dlfo_loaded_mappings)
+   contains up-to-date data.  This achieves async-signal-safety for
+   _dl_find_object: a signal handler can still use the
+   GLPM (dlfo_loaded_mappings) data even if dlopen or dlclose
+   modify the other copy.  */
 static __atomic_wide_counter _dlfo_loaded_mappings_version;
 
+#ifndef SHARED
+struct dlfo_mappings_segment *_dlfo_loaded_mappings[2];
+#endif
+
 /* TM version at the start of the read operation.  */
 static inline uint64_t
 _dlfo_read_start_version (void)
@@ -263,7 +263,7 @@ _dlfo_read_success (uint64_t start_version)
 static struct dlfo_mappings_segment *
 _dlfo_mappings_active_segment (uint64_t start_version)
 {
-  return _dlfo_loaded_mappings[start_version & 1];
+  return GLPM (dlfo_loaded_mappings)[start_version & 1];
 }
 
 /* Searches PC among the address-sorted array [FIRST1, FIRST1 +
@@ -472,10 +472,10 @@ _dlfo_process_initial (void)
             }
           else if (l->l_type == lt_loaded)
             {
-              if (_dlfo_loaded_mappings[0] != NULL)
+              if (GLPM (dlfo_loaded_mappings)[0] != NULL)
                 /* Second pass only.  */
                 _dl_find_object_from_map
-                  (l, &_dlfo_loaded_mappings[0]->objects[loaded]);
+                  (l, &GLPM (dlfo_loaded_mappings)[0]->objects[loaded]);
               ++loaded;
             }
         }
@@ -535,10 +535,10 @@ _dl_find_object_init (void)
     = _dl_protmem_allocate (_dlfo_nodelete_mappings_size
                             * sizeof (*_dlfo_nodelete_mappings));
   if (loaded_size > 0)
-    _dlfo_loaded_mappings[0]
+    GLPM (dlfo_loaded_mappings)[0]
       = _dlfo_mappings_segment_allocate (loaded_size, NULL);
   if (_dlfo_nodelete_mappings == NULL
-      || (loaded_size > 0 && _dlfo_loaded_mappings[0] == NULL))
+      || (loaded_size > 0 && GLPM (dlfo_loaded_mappings)[0] == NULL))
     _dl_fatal_printf ("\
 Fatal glibc error: cannot allocate memory for find-object data\n");
   /* Fill in the data with the second call.  */
@@ -554,8 +554,8 @@ Fatal glibc error: cannot allocate memory for find-object data\n");
       _dlfo_nodelete_mappings_end = _dlfo_nodelete_mappings[last_idx].map_end;
     }
   if (loaded_size > 0)
-    _dlfo_sort_mappings (_dlfo_loaded_mappings[0]->objects,
-                         _dlfo_loaded_mappings[0]->size);
+    _dlfo_sort_mappings (GLPM (dlfo_loaded_mappings)[0]->objects,
+                         GLPM (dlfo_loaded_mappings)[0]->size);
 }
 
 static void
@@ -609,11 +609,11 @@ _dl_find_object_update_1 (struct link_map_private **loaded, size_t count)
   int active_idx = _dlfo_read_version_locked () & 1;
 
   struct dlfo_mappings_segment *current_seg
-    = _dlfo_loaded_mappings[active_idx];
+    = GLPM (dlfo_loaded_mappings)[active_idx];
   size_t current_used = _dlfo_mappings_segment_count_used (current_seg);
 
   struct dlfo_mappings_segment *target_seg
-    = _dlfo_loaded_mappings[!active_idx];
+    = GLPM (dlfo_loaded_mappings)[!active_idx];
   size_t remaining_to_add = current_used + count;
 
   /* Ensure that the new segment chain has enough space.  */
@@ -634,7 +634,8 @@ _dl_find_object_update_1 (struct link_map_private **loaded, size_t count)
 
         /* The barrier ensures that a concurrent TM read or fork does
            not see a partially initialized segment.  */
-        atomic_store_release (&_dlfo_loaded_mappings[!active_idx], target_seg);
+        atomic_store_release (&GLPM (dlfo_loaded_mappings)[!active_idx],
+                              target_seg);
       }
     else
       /* Start update cycle without allocation.  */
diff --git a/sysdeps/generic/ldsodefs.h b/sysdeps/generic/ldsodefs.h
index b2bb42e8c6..eaa144cc4e 100644
--- a/sysdeps/generic/ldsodefs.h
+++ b/sysdeps/generic/ldsodefs.h
@@ -523,6 +523,8 @@ extern struct rtld_global _rtld_global __rtld_global_attribute__;
 # undef __rtld_global_attribute__
 #endif
 
+struct dlfo_mappings_segment;
+
 #ifdef SHARED
 /* Implementation structure for the protected memory area.  In static
    builds, the protected memory area is just regular (.data) memory,
@@ -532,6 +534,13 @@ struct rtld_protmem
 {
   /* Structure describing the dynamic linker itself.  */
   EXTERN struct link_map_private _dl_rtld_map;
+#endif /* SHARED */
+
+  /* Two copies of the data structures for _dl_find_object.  See
+     _dlfo_loaded_mappings_version in dl-find_object.c.  */
+  EXTERN struct dlfo_mappings_segment *_dlfo_loaded_mappings[2];
+
+#ifdef SHARED
 };
 #endif /* SHARED */
 
-- 
2.43.0