[PATCH v4 0/4] Args adjustment with ./ld.so exe [BZ #23293]

[PATCH v4 0/4] Args adjustment with ./ld.so exe [BZ #23293]

[Szabolcs Nagy]

Instead of opt-in, now all targets use the same logic.  This may be a
slight regression on targets where argv does not have to be moved,
but in exchange ld.so behaviour is more consistent.

I only tested on aarch64, the patches are available in nsz/bug23293
branch and may need runtime testing on other targets too.
(run the tests without --enable-hardcoded-path-in-tests)

Szabolcs Nagy (4):
  rtld: Use generic argv adjustment in ld.so [BZ #23293]
  rtld: Remove DL_ARGV_NOT_RELRO
  linux: Add a getauxval test [BZ #23293]
  aarch64: Move ld.so _start to separate file and drop _dl_skip_args

 elf/rtld.c                               | 90 ++++++++++++++++++------
 sysdeps/aarch64/Makefile                 |  1 +
 sysdeps/aarch64/dl-machine.h             | 77 +-------------------
 sysdeps/aarch64/dl-start.S               | 53 ++++++++++++++
 sysdeps/aarch64/dl-sysdep.h              |  4 --
 sysdeps/alpha/dl-sysdep.h                | 23 ------
 sysdeps/arc/dl-sysdep.h                  |  4 --
 sysdeps/arm/dl-sysdep.h                  |  4 --
 sysdeps/csky/dl-sysdep.h                 | 23 ------
 sysdeps/generic/ldsodefs.h               | 15 ++--
 sysdeps/ia64/dl-sysdep.h                 | 23 ------
 sysdeps/nios2/dl-sysdep.h                |  4 --
 sysdeps/s390/s390-32/dl-sysdep.h         | 23 ------
 sysdeps/sparc/dl-sysdep.h                | 23 ------
 sysdeps/unix/sysv/linux/Makefile         |  1 +
 sysdeps/unix/sysv/linux/dl-sysdep.c      |  5 +-
 sysdeps/unix/sysv/linux/ia64/dl-sysdep.h |  4 --
 sysdeps/unix/sysv/linux/tst-getauxval.c  | 74 +++++++++++++++++++
 18 files changed, 206 insertions(+), 245 deletions(-)
 create mode 100644 sysdeps/aarch64/dl-start.S
 delete mode 100644 sysdeps/alpha/dl-sysdep.h
 delete mode 100644 sysdeps/csky/dl-sysdep.h
 delete mode 100644 sysdeps/ia64/dl-sysdep.h
 delete mode 100644 sysdeps/s390/s390-32/dl-sysdep.h
 delete mode 100644 sysdeps/sparc/dl-sysdep.h
 create mode 100644 sysdeps/unix/sysv/linux/tst-getauxval.c

-- 
2.25.1

[PATCH v4 1/4] rtld: Use generic argv adjustment in ld.so [BZ #23293]

[Szabolcs Nagy]

When an executable is invoked as

  ./ld.so [ld.so-args] ./exe [exe-args]

then the argv is adujusted in ld.so before calling the entry point of
the executable so ld.so args are not visible to it.  On most targets
this requires moving argv, env and auxv on the stack to ensure correct
stack alignment at the entry point.  This had several issues:

- The code for this adjustment on the stack is written in asm as part
  of the target specific ld.so _start code which is hard to maintain.

- The adjustment is done after _dl_start returns, where it's too late
  to update GLRO(dl_auxv), as it is already readonly, so it points to
  memory that was clobbered by the adjustment. This is bug 23293.

- _environ is also wrong in ld.so after the adjustment, but it is
  likely not used after _dl_start returns so this is not user visible.

- _dl_argv was updated, but for this it was moved out of relro, which
  changes security properties across targets unnecessarily.

This patch introduces a generic _dl_start_args_adjust function that
handles the argument adjustments after ld.so processed its own args
and before relro protection is applied.  The initial sp at ld.so entry
is passed down to dl_main so it can do the adjustment.

The same algorithm is used on all targets, _dl_skip_args is now 0, so
existing target specific adjustment code is no longer used.  The bug
affects aarch64, alpha, arc, arm, csky, ia64, nios2, s390-32 and sparc,
other targets don't need the change in principle, but it does not hurt
and makes the behaviour more consistent.

Follow up patches can remove _dl_skip_args and DL_ARGV_NOT_RELRO.

---
v4:
- New code is unconditionally used on all targets.
- Hide auxv adjustments behind HAVE_AUX_VECTOR.
- DL_NEED_START_ARGS_ADJUST macro is removed.
- _dl_skip_args is no longer unused.
- start_argptr is passed down to dl_main instead of using a global.
- moved aarch64 DL_ARGV_NOT_RELRO removal to separate patch.
v2:
- use p != NULL, and a_type != AT_NULL
- remove the confusing paragraph from the commit message.
---
 elf/rtld.c                          | 83 +++++++++++++++++++++++------
 sysdeps/generic/ldsodefs.h          |  3 +-
 sysdeps/unix/sysv/linux/dl-sysdep.c |  5 +-
 3 files changed, 73 insertions(+), 18 deletions(-)

diff --git a/elf/rtld.c b/elf/rtld.c
index 3b2e05bf4c..d959dab0d0 100644
--- a/elf/rtld.c
+++ b/elf/rtld.c
@@ -397,7 +397,8 @@ extern struct rtld_global_ro _rtld_local_ro
 
 
 static void dl_main (const ElfW(Phdr) *phdr, ElfW(Word) phnum,
-		     ElfW(Addr) *user_entry, ElfW(auxv_t) *auxv);
+		     ElfW(Addr) *user_entry, ElfW(auxv_t) *auxv,
+		     void **start_argptr);
 
 /* These two variables cannot be moved into .data.rel.ro.  */
 static struct libname_list _dl_rtld_libname;
@@ -1306,11 +1307,60 @@ rtld_setup_main_map (struct link_map *main_map)
   return has_interp;
 }
 
+static void
+_dl_start_args_adjust (void **start_argptr, int skip_args)
+{
+  void **sp = start_argptr;
+  void **p;
+  long argc;
+  char **argv;
+
+  if (skip_args == 0)
+    return;
+
+  /* Adjust argc on stack.  */
+  argc = (long) sp[0] - skip_args;
+  sp[0] = (void *) argc;
+
+  argv = (char **) (sp + 1); /* Necessary aliasing violation.  */
+  p = sp + skip_args;
+  /* Shuffle argv down.  */
+  do
+    *++sp = *++p;
+  while (*p != NULL);
+
+  /* Shuffle envp down.  */
+  do
+    *++sp = *++p;
+  while (*p != NULL);
+
+  /* Update globals in rtld.  */
+  _dl_argv = argv;
+  _environ = argv + argc + 1;
+#ifdef HAVE_AUX_VECTOR
+  GLRO(dl_auxv) = (ElfW(auxv_t) *) (sp + 1); /* Aliasing violation.  */
+
+  /* Shuffle auxv down. */
+  void *a, *b; /* Use a pair of pointers for an auxv entry.  */
+  unsigned long a_type;
+  do
+    {
+      a_type = ((ElfW(auxv_t) *) (p + 1))->a_type;
+      a = *++p;
+      b = *++p;
+      *++sp = a;
+      *++sp = b;
+    }
+  while (a_type != AT_NULL);
+#endif
+}
+
 static void
 dl_main (const ElfW(Phdr) *phdr,
 	 ElfW(Word) phnum,
 	 ElfW(Addr) *user_entry,
-	 ElfW(auxv_t) *auxv)
+	 ElfW(auxv_t) *auxv,
+	 void **start_argptr)
 {
   struct link_map *main_map;
   size_t file_size;
@@ -1359,6 +1409,7 @@ dl_main (const ElfW(Phdr) *phdr,
       rtld_is_main = true;
 
       char *argv0 = NULL;
+      int skip_args = 0;
 
       /* Note the place where the dynamic linker actually came from.  */
       GL(dl_rtld_map).l_name = rtld_progname;
@@ -1373,7 +1424,7 @@ dl_main (const ElfW(Phdr) *phdr,
 		GLRO(dl_lazy) = -1;
 	      }
 
-	    ++_dl_skip_args;
+	    ++skip_args;
 	    --_dl_argc;
 	    ++_dl_argv;
 	  }
@@ -1382,14 +1433,14 @@ dl_main (const ElfW(Phdr) *phdr,
 	    if (state.mode != rtld_mode_help)
 	      state.mode = rtld_mode_verify;
 
-	    ++_dl_skip_args;
+	    ++skip_args;
 	    --_dl_argc;
 	    ++_dl_argv;
 	  }
 	else if (! strcmp (_dl_argv[1], "--inhibit-cache"))
 	  {
 	    GLRO(dl_inhibit_cache) = 1;
-	    ++_dl_skip_args;
+	    ++skip_args;
 	    --_dl_argc;
 	    ++_dl_argv;
 	  }
@@ -1399,7 +1450,7 @@ dl_main (const ElfW(Phdr) *phdr,
 	    state.library_path = _dl_argv[2];
 	    state.library_path_source = "--library-path";
 
-	    _dl_skip_args += 2;
+	    skip_args += 2;
 	    _dl_argc -= 2;
 	    _dl_argv += 2;
 	  }
@@ -1408,7 +1459,7 @@ dl_main (const ElfW(Phdr) *phdr,
 	  {
 	    GLRO(dl_inhibit_rpath) = _dl_argv[2];
 
-	    _dl_skip_args += 2;
+	    skip_args += 2;
 	    _dl_argc -= 2;
 	    _dl_argv += 2;
 	  }
@@ -1416,14 +1467,14 @@ dl_main (const ElfW(Phdr) *phdr,
 	  {
 	    audit_list_add_string (&state.audit_list, _dl_argv[2]);
 
-	    _dl_skip_args += 2;
+	    skip_args += 2;
 	    _dl_argc -= 2;
 	    _dl_argv += 2;
 	  }
 	else if (! strcmp (_dl_argv[1], "--preload") && _dl_argc > 2)
 	  {
 	    state.preloadarg = _dl_argv[2];
-	    _dl_skip_args += 2;
+	    skip_args += 2;
 	    _dl_argc -= 2;
 	    _dl_argv += 2;
 	  }
@@ -1431,7 +1482,7 @@ dl_main (const ElfW(Phdr) *phdr,
 	  {
 	    argv0 = _dl_argv[2];
 
-	    _dl_skip_args += 2;
+	    skip_args += 2;
 	    _dl_argc -= 2;
 	    _dl_argv += 2;
 	  }
@@ -1439,7 +1490,7 @@ dl_main (const ElfW(Phdr) *phdr,
 		 && _dl_argc > 2)
 	  {
 	    state.glibc_hwcaps_prepend = _dl_argv[2];
-	    _dl_skip_args += 2;
+	    skip_args += 2;
 	    _dl_argc -= 2;
 	    _dl_argv += 2;
 	  }
@@ -1447,7 +1498,7 @@ dl_main (const ElfW(Phdr) *phdr,
 		 && _dl_argc > 2)
 	  {
 	    state.glibc_hwcaps_mask = _dl_argv[2];
-	    _dl_skip_args += 2;
+	    skip_args += 2;
 	    _dl_argc -= 2;
 	    _dl_argv += 2;
 	  }
@@ -1456,7 +1507,7 @@ dl_main (const ElfW(Phdr) *phdr,
 	  {
 	    state.mode = rtld_mode_list_tunables;
 
-	    ++_dl_skip_args;
+	    ++skip_args;
 	    --_dl_argc;
 	    ++_dl_argv;
 	  }
@@ -1465,7 +1516,7 @@ dl_main (const ElfW(Phdr) *phdr,
 	  {
 	    state.mode = rtld_mode_list_diagnostics;
 
-	    ++_dl_skip_args;
+	    ++skip_args;
 	    --_dl_argc;
 	    ++_dl_argv;
 	  }
@@ -1511,7 +1562,7 @@ dl_main (const ElfW(Phdr) *phdr,
 	    _dl_usage (ld_so_name, NULL);
 	}
 
-      ++_dl_skip_args;
+      ++skip_args;
       --_dl_argc;
       ++_dl_argv;
 
@@ -1610,6 +1661,8 @@ dl_main (const ElfW(Phdr) *phdr,
       /* Set the argv[0] string now that we've processed the executable.  */
       if (argv0 != NULL)
         _dl_argv[0] = argv0;
+      /* Adjust arguments for the application entry point.  */
+      _dl_start_args_adjust (start_argptr, skip_args);
     }
   else
     {
diff --git a/sysdeps/generic/ldsodefs.h b/sysdeps/generic/ldsodefs.h
index 4a5e698db2..31de149f23 100644
--- a/sysdeps/generic/ldsodefs.h
+++ b/sysdeps/generic/ldsodefs.h
@@ -1165,7 +1165,8 @@ extern ElfW(Addr) _dl_sysdep_start (void **start_argptr,
 				    void (*dl_main) (const ElfW(Phdr) *phdr,
 						     ElfW(Word) phnum,
 						     ElfW(Addr) *user_entry,
-						     ElfW(auxv_t) *auxv))
+						     ElfW(auxv_t) *auxv,
+						     void **start_argptr))
      attribute_hidden;
 
 extern void _dl_sysdep_start_cleanup (void) attribute_hidden;
diff --git a/sysdeps/unix/sysv/linux/dl-sysdep.c b/sysdeps/unix/sysv/linux/dl-sysdep.c
index a67c454673..8c4a7e72b9 100644
--- a/sysdeps/unix/sysv/linux/dl-sysdep.c
+++ b/sysdeps/unix/sysv/linux/dl-sysdep.c
@@ -98,7 +98,8 @@ _dl_sysdep_parse_arguments (void **start_argptr,
 ElfW(Addr)
 _dl_sysdep_start (void **start_argptr,
 		  void (*dl_main) (const ElfW(Phdr) *phdr, ElfW(Word) phnum,
-				   ElfW(Addr) *user_entry, ElfW(auxv_t) *auxv))
+				   ElfW(Addr) *user_entry, ElfW(auxv_t) *auxv,
+				   void **start_argptr))
 {
   __libc_stack_end = DL_STACK_END (start_argptr);
 
@@ -138,7 +139,7 @@ _dl_sysdep_start (void **start_argptr,
     __libc_check_standard_fds ();
 
   (*dl_main) (dl_main_args.phdr, dl_main_args.phnum,
-              &dl_main_args.user_entry, GLRO(dl_auxv));
+	      &dl_main_args.user_entry, GLRO(dl_auxv), start_argptr);
   return dl_main_args.user_entry;
 }
 
-- 
2.25.1

[PATCH v4 2/4] rtld: Remove DL_ARGV_NOT_RELRO

[Szabolcs Nagy]

This is no longer needed because _dl_skip_args is always 0, so the
target specific code that modifies argv after relro protection is
applied is no longer used.

After the patch relro protection is applied to _dl_argv consistently
on all targets.
---
v4:
- New patch.
---
 elf/rtld.c                               |  7 -------
 sysdeps/aarch64/dl-sysdep.h              |  4 ----
 sysdeps/alpha/dl-sysdep.h                | 23 -----------------------
 sysdeps/arc/dl-sysdep.h                  |  4 ----
 sysdeps/arm/dl-sysdep.h                  |  4 ----
 sysdeps/csky/dl-sysdep.h                 | 23 -----------------------
 sysdeps/generic/ldsodefs.h               | 12 ++----------
 sysdeps/ia64/dl-sysdep.h                 | 23 -----------------------
 sysdeps/nios2/dl-sysdep.h                |  4 ----
 sysdeps/s390/s390-32/dl-sysdep.h         | 23 -----------------------
 sysdeps/sparc/dl-sysdep.h                | 23 -----------------------
 sysdeps/unix/sysv/linux/ia64/dl-sysdep.h |  4 ----
 12 files changed, 2 insertions(+), 152 deletions(-)
 delete mode 100644 sysdeps/alpha/dl-sysdep.h
 delete mode 100644 sysdeps/csky/dl-sysdep.h
 delete mode 100644 sysdeps/ia64/dl-sysdep.h
 delete mode 100644 sysdeps/s390/s390-32/dl-sysdep.h
 delete mode 100644 sysdeps/sparc/dl-sysdep.h

diff --git a/elf/rtld.c b/elf/rtld.c
index d959dab0d0..afff1b87fa 100644
--- a/elf/rtld.c
+++ b/elf/rtld.c
@@ -157,16 +157,9 @@ static void dl_main_state_init (struct dl_main_state *state);
 extern char **_environ attribute_hidden;
 static void process_envvars (struct dl_main_state *state);
 
-#ifdef DL_ARGV_NOT_RELRO
-int _dl_argc attribute_hidden;
-char **_dl_argv = NULL;
-/* Nonzero if we were run directly.  */
-unsigned int _dl_skip_args attribute_hidden;
-#else
 int _dl_argc attribute_relro attribute_hidden;
 char **_dl_argv attribute_relro = NULL;
 unsigned int _dl_skip_args attribute_relro attribute_hidden;
-#endif
 rtld_hidden_data_def (_dl_argv)
 
 #ifndef THREAD_SET_STACK_GUARD
diff --git a/sysdeps/aarch64/dl-sysdep.h b/sysdeps/aarch64/dl-sysdep.h
index 667786671c..1516dd7d3f 100644
--- a/sysdeps/aarch64/dl-sysdep.h
+++ b/sysdeps/aarch64/dl-sysdep.h
@@ -18,8 +18,4 @@
 
 #include_next <dl-sysdep.h>
 
-/* _dl_argv cannot be attribute_relro, because _dl_start_user
-   might write into it after _dl_start returns.  */
-#define DL_ARGV_NOT_RELRO 1
-
 #define DL_EXTERN_PROTECTED_DATA
diff --git a/sysdeps/alpha/dl-sysdep.h b/sysdeps/alpha/dl-sysdep.h
deleted file mode 100644
index 3099ee419f..0000000000
--- a/sysdeps/alpha/dl-sysdep.h
+++ /dev/null
@@ -1,23 +0,0 @@
-/* System-specific settings for dynamic linker code.  Alpha version.
-   Copyright (C) 2002-2022 Free Software Foundation, Inc.
-   This file is part of the GNU C Library.
-
-   The GNU C Library is free software; you can redistribute it and/or
-   modify it under the terms of the GNU Lesser General Public
-   License as published by the Free Software Foundation; either
-   version 2.1 of the License, or (at your option) any later version.
-
-   The GNU C Library is distributed in the hope that it will be useful,
-   but WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-   Lesser General Public License for more details.
-
-   You should have received a copy of the GNU Lesser General Public
-   License along with the GNU C Library.  If not, see
-   <https://www.gnu.org/licenses/>.  */
-
-#include_next <dl-sysdep.h>
-
-/* _dl_argv cannot be attribute_relro, because _dl_start_user
-   might write into it after _dl_start returns.  */
-#define DL_ARGV_NOT_RELRO 1
diff --git a/sysdeps/arc/dl-sysdep.h b/sysdeps/arc/dl-sysdep.h
index da060ceeee..cf4d160a73 100644
--- a/sysdeps/arc/dl-sysdep.h
+++ b/sysdeps/arc/dl-sysdep.h
@@ -18,8 +18,4 @@
 
 #include_next <dl-sysdep.h>
 
-/* _dl_argv cannot be attribute_relro, because _dl_start_user
-   might write into it after _dl_start returns.  */
-#define DL_ARGV_NOT_RELRO 1
-
 #define DL_EXTERN_PROTECTED_DATA
diff --git a/sysdeps/arm/dl-sysdep.h b/sysdeps/arm/dl-sysdep.h
index ce7a84a7de..7a99107436 100644
--- a/sysdeps/arm/dl-sysdep.h
+++ b/sysdeps/arm/dl-sysdep.h
@@ -18,8 +18,4 @@
 
 #include_next <dl-sysdep.h>
 
-/* _dl_argv cannot be attribute_relro, because _dl_start_user
-   might write into it after _dl_start returns.  */
-#define DL_ARGV_NOT_RELRO 1
-
 #define DL_EXTERN_PROTECTED_DATA
diff --git a/sysdeps/csky/dl-sysdep.h b/sysdeps/csky/dl-sysdep.h
deleted file mode 100644
index fc8a58b94c..0000000000
--- a/sysdeps/csky/dl-sysdep.h
+++ /dev/null
@@ -1,23 +0,0 @@
-/* System-specific settings for dynamic linker code.  C-SKY version.
-   Copyright (C) 2018-2022 Free Software Foundation, Inc.
-   This file is part of the GNU C Library.
-
-   The GNU C Library is free software; you can redistribute it and/or
-   modify it under the terms of the GNU Lesser General Public
-   License as published by the Free Software Foundation; either
-   version 2.1 of the License, or (at your option) any later version.
-
-   The GNU C Library is distributed in the hope that it will be useful,
-   but WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-   Lesser General Public License for more details.
-
-   You should have received a copy of the GNU Lesser General Public
-   License along with the GNU C Library.  If not, see
-   <https://www.gnu.org/licenses/>.  */
-
-#include_next <dl-sysdep.h>
-
-/* _dl_argv cannot be attribute_relro, because _dl_start_user
-   might write into it after _dl_start returns.  */
-#define DL_ARGV_NOT_RELRO 1
diff --git a/sysdeps/generic/ldsodefs.h b/sysdeps/generic/ldsodefs.h
index 31de149f23..e3c4d09bc6 100644
--- a/sysdeps/generic/ldsodefs.h
+++ b/sysdeps/generic/ldsodefs.h
@@ -762,18 +762,10 @@ rtld_hidden_proto (__libc_stack_end)
 
 /* Parameters passed to the dynamic linker.  */
 extern int _dl_argc attribute_hidden attribute_relro;
-extern char **_dl_argv
-#ifndef DL_ARGV_NOT_RELRO
-     attribute_relro
-#endif
-     ;
+extern char **_dl_argv attribute_relro;
 rtld_hidden_proto (_dl_argv)
 #if IS_IN (rtld)
-extern unsigned int _dl_skip_args attribute_hidden
-# ifndef DL_ARGV_NOT_RELRO
-     attribute_relro
-# endif
-     ;
+extern unsigned int _dl_skip_args attribute_hidden attribute_relro;
 #endif
 #define rtld_progname _dl_argv[0]
 
diff --git a/sysdeps/ia64/dl-sysdep.h b/sysdeps/ia64/dl-sysdep.h
deleted file mode 100644
index e3a58bec24..0000000000
--- a/sysdeps/ia64/dl-sysdep.h
+++ /dev/null
@@ -1,23 +0,0 @@
-/* System-specific settings for dynamic linker code.  IA-64 version.
-   Copyright (C) 2002-2022 Free Software Foundation, Inc.
-   This file is part of the GNU C Library.
-
-   The GNU C Library is free software; you can redistribute it and/or
-   modify it under the terms of the GNU Lesser General Public
-   License as published by the Free Software Foundation; either
-   version 2.1 of the License, or (at your option) any later version.
-
-   The GNU C Library is distributed in the hope that it will be useful,
-   but WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-   Lesser General Public License for more details.
-
-   You should have received a copy of the GNU Lesser General Public
-   License along with the GNU C Library; if not, see
-   <https://www.gnu.org/licenses/>.  */
-
-#include_next <dl-sysdep.h>
-
-/* _dl_argv cannot be attribute_relro, because _dl_start_user
-   might write into it after _dl_start returns.  */
-#define DL_ARGV_NOT_RELRO 1
diff --git a/sysdeps/nios2/dl-sysdep.h b/sysdeps/nios2/dl-sysdep.h
index 0354650042..257b37c258 100644
--- a/sysdeps/nios2/dl-sysdep.h
+++ b/sysdeps/nios2/dl-sysdep.h
@@ -18,8 +18,4 @@
 
 #include_next <dl-sysdep.h>
 
-/* _dl_argv cannot be attribute_relro, because _dl_start_user
-   might write into it after _dl_start returns.  */
-#define DL_ARGV_NOT_RELRO 1
-
 #define DL_EXTERN_PROTECTED_DATA
diff --git a/sysdeps/s390/s390-32/dl-sysdep.h b/sysdeps/s390/s390-32/dl-sysdep.h
deleted file mode 100644
index 699b50f156..0000000000
--- a/sysdeps/s390/s390-32/dl-sysdep.h
+++ /dev/null
@@ -1,23 +0,0 @@
-/* System-specific settings for dynamic linker code.  S/390 version.
-   Copyright (C) 2014-2022 Free Software Foundation, Inc.
-   This file is part of the GNU C Library.
-
-   The GNU C Library is free software; you can redistribute it and/or
-   modify it under the terms of the GNU Lesser General Public
-   License as published by the Free Software Foundation; either
-   version 2.1 of the License, or (at your option) any later version.
-
-   The GNU C Library is distributed in the hope that it will be useful,
-   but WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-   Lesser General Public License for more details.
-
-   You should have received a copy of the GNU Lesser General Public
-   License along with the GNU C Library.  If not, see
-   <https://www.gnu.org/licenses/>.  */
-
-#include_next <dl-sysdep.h>
-
-/* _dl_argv cannot be attribute_relro, because _dl_start_user
-   might write into it after _dl_start returns.  */
-#define DL_ARGV_NOT_RELRO 1
diff --git a/sysdeps/sparc/dl-sysdep.h b/sysdeps/sparc/dl-sysdep.h
deleted file mode 100644
index f32f16a107..0000000000
--- a/sysdeps/sparc/dl-sysdep.h
+++ /dev/null
@@ -1,23 +0,0 @@
-/* System-specific settings for dynamic linker code.  SPARC version.
-   Copyright (C) 2002-2022 Free Software Foundation, Inc.
-   This file is part of the GNU C Library.
-
-   The GNU C Library is free software; you can redistribute it and/or
-   modify it under the terms of the GNU Lesser General Public
-   License as published by the Free Software Foundation; either
-   version 2.1 of the License, or (at your option) any later version.
-
-   The GNU C Library is distributed in the hope that it will be useful,
-   but WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-   Lesser General Public License for more details.
-
-   You should have received a copy of the GNU Lesser General Public
-   License along with the GNU C Library; if not, see
-   <https://www.gnu.org/licenses/>.  */
-
-#include_next <dl-sysdep.h>
-
-/* _dl_argv cannot be attribute_relro, because _dl_start_user
-   might write into it after _dl_start returns.  */
-#define DL_ARGV_NOT_RELRO 1
diff --git a/sysdeps/unix/sysv/linux/ia64/dl-sysdep.h b/sysdeps/unix/sysv/linux/ia64/dl-sysdep.h
index 0d2a1d093a..aa1de6b361 100644
--- a/sysdeps/unix/sysv/linux/ia64/dl-sysdep.h
+++ b/sysdeps/unix/sysv/linux/ia64/dl-sysdep.h
@@ -48,8 +48,4 @@ extern int _dl_sysinfo_break attribute_hidden;
        ".previous");
 #endif
 
-/* _dl_argv cannot be attribute_relro, because _dl_start_user
-   might write into it after _dl_start returns.  */
-#define DL_ARGV_NOT_RELRO 1
-
 #endif	/* dl-sysdep.h */
-- 
2.25.1

[PATCH v4 3/4] linux: Add a getauxval test [BZ #23293]

[Szabolcs Nagy]

This is for bug 23293 and it relies on the glibc test system running
tests via explicit ld.so invokation by default.

---
v4:
- New patch.
---
 sysdeps/unix/sysv/linux/Makefile        |  1 +
 sysdeps/unix/sysv/linux/tst-getauxval.c | 74 +++++++++++++++++++++++++
 2 files changed, 75 insertions(+)
 create mode 100644 sysdeps/unix/sysv/linux/tst-getauxval.c

diff --git a/sysdeps/unix/sysv/linux/Makefile b/sysdeps/unix/sysv/linux/Makefile
index ca953804d0..89cb005c7d 100644
--- a/sysdeps/unix/sysv/linux/Makefile
+++ b/sysdeps/unix/sysv/linux/Makefile
@@ -126,6 +126,7 @@ tests += tst-clone tst-clone2 tst-clone3 tst-fanotify tst-personality \
   tst-prctl \
   tst-scm_rights \
   tst-epoll \
+  tst-getauxval \
   # tests
 
 # For +depfiles in Makerules.
diff --git a/sysdeps/unix/sysv/linux/tst-getauxval.c b/sysdeps/unix/sysv/linux/tst-getauxval.c
new file mode 100644
index 0000000000..c4b6195743
--- /dev/null
+++ b/sysdeps/unix/sysv/linux/tst-getauxval.c
@@ -0,0 +1,74 @@
+/* Basic test for getauxval.
+   Copyright (C) 2022 Free Software Foundation, Inc.
+   This file is part of the GNU C Library.
+
+   The GNU C Library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 2.1 of the License, or (at your option) any later version.
+
+   The GNU C Library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with the GNU C Library; if not, see
+   <https://www.gnu.org/licenses/>.  */
+
+#include <unistd.h>
+#include <stdio.h>
+#include <support/check.h>
+#include <sys/auxv.h>
+
+static int missing;
+static int mismatch;
+
+static void
+check_nonzero (unsigned long t, const char *s)
+{
+  unsigned long v = getauxval (t);
+  printf ("%s: %lu (0x%lx)\n", s, v, v);
+  if (v == 0)
+    missing++;
+}
+
+static void
+check_eq (unsigned long t, const char *s, unsigned long want)
+{
+  unsigned long v = getauxval (t);
+  printf ("%s: %lu want: %lu\n", s, v, want);
+  if (v != want)
+    mismatch++;
+}
+
+#define NZ(x) check_nonzero (x, #x)
+#define EQ(x, want) check_eq (x, #x, want)
+
+static int
+do_test (void)
+{
+  /* These auxv entries should be non-zero on Linux.  */
+  NZ (AT_PHDR);
+  NZ (AT_PHENT);
+  NZ (AT_PHNUM);
+  NZ (AT_PAGESZ);
+  NZ (AT_ENTRY);
+  NZ (AT_CLKTCK);
+  NZ (AT_RANDOM);
+  NZ (AT_EXECFN);
+  if (missing)
+    FAIL_EXIT1 ("Found %d missing auxv entries.\n", missing);
+
+  /* Check against syscalls.  */
+  EQ (AT_UID, getuid ());
+  EQ (AT_EUID, geteuid ());
+  EQ (AT_GID, getgid ());
+  EQ (AT_EGID, getegid ());
+  if (mismatch)
+    FAIL_EXIT1 ("Found %d mismatching auxv entries.\n", mismatch);
+
+  return 0;
+}
+
+#include <support/test-driver.c>
-- 
2.25.1

[PATCH v4 4/4] aarch64: Move ld.so _start to separate file and drop _dl_skip_args

[Szabolcs Nagy]

A separate asm file is easier to maintain than a macro that expands to
inline asm.

The RTLD_START macro is only needed now because _dl_start is local in
rtld.c, but _start has to call it, if _dl_start was made hidden then it
could be empty.

_dl_skip_args is no longer needed.

---
v4:
- adjust commit message about _dl_skip_args.
v3:
- mention _dl_skip_args
v2:
- fix typo in commit message.
---
 sysdeps/aarch64/Makefile     |  1 +
 sysdeps/aarch64/dl-machine.h | 77 +-----------------------------------
 sysdeps/aarch64/dl-start.S   | 53 +++++++++++++++++++++++++
 3 files changed, 56 insertions(+), 75 deletions(-)
 create mode 100644 sysdeps/aarch64/dl-start.S

diff --git a/sysdeps/aarch64/Makefile b/sysdeps/aarch64/Makefile
index 7183895d04..17fb1c5b72 100644
--- a/sysdeps/aarch64/Makefile
+++ b/sysdeps/aarch64/Makefile
@@ -33,6 +33,7 @@ tst-audit27-ENV = LD_AUDIT=$(objpfx)tst-auditmod27.so
 endif
 
 ifeq ($(subdir),elf)
+sysdep-rtld-routines += dl-start
 sysdep-dl-routines += tlsdesc dl-tlsdesc
 gen-as-const-headers += dl-link.sym
 
diff --git a/sysdeps/aarch64/dl-machine.h b/sysdeps/aarch64/dl-machine.h
index b40050a981..fe120bb507 100644
--- a/sysdeps/aarch64/dl-machine.h
+++ b/sysdeps/aarch64/dl-machine.h
@@ -105,81 +105,8 @@ elf_machine_runtime_setup (struct link_map *l, struct r_scope_elem *scope[],
   return lazy;
 }
 
-/* Initial entry point for the dynamic linker. The C function
-   _dl_start is the real entry point, its return value is the user
-   program's entry point */
-#ifdef __LP64__
-# define RTLD_START RTLD_START_1 ("x", "3", "sp")
-#else
-# define RTLD_START RTLD_START_1 ("w", "2", "wsp")
-#endif
-
-
-#define RTLD_START_1(PTR, PTR_SIZE_LOG, PTR_SP) asm ("\
-.text									\n\
-.globl _start								\n\
-.type _start, %function							\n\
-.globl _dl_start_user							\n\
-.type _dl_start_user, %function						\n\
-_start:									\n\
-	// bti c							\n\
-	hint	34							\n\
-	mov	" PTR "0, " PTR_SP "					\n\
-	bl	_dl_start						\n\
-	// returns user entry point in x0				\n\
-	mov	x21, x0							\n\
-_dl_start_user:								\n\
-	// get the original arg count					\n\
-	ldr	" PTR "1, [sp]						\n\
-	// get the argv address						\n\
-	add	" PTR "2, " PTR_SP ", #(1<<"  PTR_SIZE_LOG ")		\n\
-	// get _dl_skip_args to see if we were				\n\
-	// invoked as an executable					\n\
-	adrp	x4, _dl_skip_args					\n\
-        ldr	w4, [x4, #:lo12:_dl_skip_args]				\n\
-	// do we need to adjust argc/argv				\n\
-        cmp	w4, 0							\n\
-	beq	.L_done_stack_adjust					\n\
-	// subtract _dl_skip_args from original arg count		\n\
-	sub	" PTR "1, " PTR "1, " PTR "4				\n\
-	// store adjusted argc back to stack				\n\
-	str	" PTR "1, [sp]						\n\
-	// find the first unskipped argument				\n\
-	mov	" PTR "3, " PTR "2					\n\
-	add	" PTR "4, " PTR "2, " PTR "4, lsl #" PTR_SIZE_LOG "	\n\
-	// shuffle argv down						\n\
-1:	ldr	" PTR "5, [x4], #(1<<"  PTR_SIZE_LOG ")			\n\
-	str	" PTR "5, [x3], #(1<<"  PTR_SIZE_LOG ")			\n\
-	cmp	" PTR "5, #0						\n\
-	bne	1b							\n\
-	// shuffle envp down						\n\
-1:	ldr	" PTR "5, [x4], #(1<<"  PTR_SIZE_LOG ")			\n\
-	str	" PTR "5, [x3], #(1<<"  PTR_SIZE_LOG ")			\n\
-	cmp	" PTR "5, #0						\n\
-	bne	1b							\n\
-	// shuffle auxv down						\n\
-1:	ldp	" PTR "0, " PTR "5, [x4, #(2<<"  PTR_SIZE_LOG ")]!	\n\
-	stp	" PTR "0, " PTR "5, [x3], #(2<<"  PTR_SIZE_LOG ")	\n\
-	cmp	" PTR "0, #0						\n\
-	bne	1b							\n\
-	// Update _dl_argv						\n\
-	adrp	x3, __GI__dl_argv					\n\
-	str	" PTR "2, [x3, #:lo12:__GI__dl_argv]			\n\
-.L_done_stack_adjust:							\n\
-	// compute envp							\n\
-	add	" PTR "3, " PTR "2, " PTR "1, lsl #" PTR_SIZE_LOG "	\n\
-	add	" PTR "3, " PTR "3, #(1<<"  PTR_SIZE_LOG ")		\n\
-	adrp	x16, _rtld_local					\n\
-        add	" PTR "16, " PTR "16, #:lo12:_rtld_local		\n\
-        ldr	" PTR "0, [x16]						\n\
-	bl	_dl_init						\n\
-	// load the finalizer function					\n\
-	adrp	x0, _dl_fini						\n\
-	add	" PTR "0, " PTR "0, #:lo12:_dl_fini			\n\
-	// jump to the user_s entry point				\n\
-	mov     x16, x21						\n\
-	br      x16							\n\
-");
+/* In elf/rtld.c _dl_start should be global so dl-start.S can reference it.  */
+#define RTLD_START asm (".globl _dl_start");
 
 #define elf_machine_type_class(type)					\
   ((((type) == AARCH64_R(JUMP_SLOT)					\
diff --git a/sysdeps/aarch64/dl-start.S b/sysdeps/aarch64/dl-start.S
new file mode 100644
index 0000000000..a3a57bd5a1
--- /dev/null
+++ b/sysdeps/aarch64/dl-start.S
@@ -0,0 +1,53 @@
+/* ld.so _start code.
+   Copyright (C) 2022 Free Software Foundation, Inc.
+
+   This file is part of the GNU C Library.
+
+   The GNU C Library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 2.1 of the License, or (at your option) any later version.
+
+   The GNU C Library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with the GNU C Library; if not, see
+   <https://www.gnu.org/licenses/>.  */
+
+#include <sysdep.h>
+
+ENTRY (_start)
+	/* Create an initial frame with 0 LR and FP */
+	cfi_undefined (x30)
+	mov	x29, #0
+	mov	x30, #0
+
+	mov	x0, sp
+	PTR_ARG (0)
+	bl	_dl_start
+	/* Returns user entry point in x0.  */
+	mov	PTR_REG (21), PTR_REG (0)
+.globl _dl_start_user
+.type _dl_start_user, %function
+_dl_start_user:
+	/* Get argc.  */
+	ldr	PTR_REG (1), [sp]
+	/* Get argv.  */
+	add	x2, sp, PTR_SIZE
+	/* Compute envp.  */
+	add	PTR_REG (3), PTR_REG (2), PTR_REG (1), lsl PTR_LOG_SIZE
+	add	PTR_REG (3), PTR_REG (3), PTR_SIZE
+	adrp	x16, _rtld_local
+	add	PTR_REG (16), PTR_REG (16), :lo12:_rtld_local
+	ldr	PTR_REG (0), [x16]
+	bl	_dl_init
+	/* Load the finalizer function.  */
+	adrp	x0, _dl_fini
+	add	PTR_REG (0), PTR_REG (0), :lo12:_dl_fini
+	/* Jump to the user's entry point.  */
+	mov     x16, x21
+	br      x16
+END (_start)
-- 
2.25.1

Re: [PATCH v4 1/4] rtld: Use generic argv adjustment in ld.so [BZ #23293]

[Florian Weimer]

* Szabolcs Nagy via Libc-alpha:

> When an executable is invoked as
>
>   ./ld.so [ld.so-args] ./exe [exe-args]
>
> then the argv is adujusted in ld.so before calling the entry point of
> the executable so ld.so args are not visible to it.  On most targets
> this requires moving argv, env and auxv on the stack to ensure correct
> stack alignment at the entry point.  This had several issues:
>
> - The code for this adjustment on the stack is written in asm as part
>   of the target specific ld.so _start code which is hard to maintain.
>
> - The adjustment is done after _dl_start returns, where it's too late
>   to update GLRO(dl_auxv), as it is already readonly, so it points to
>   memory that was clobbered by the adjustment. This is bug 23293.
>
> - _environ is also wrong in ld.so after the adjustment, but it is
>   likely not used after _dl_start returns so this is not user visible.
>
> - _dl_argv was updated, but for this it was moved out of relro, which
>   changes security properties across targets unnecessarily.
>
> This patch introduces a generic _dl_start_args_adjust function that
> handles the argument adjustments after ld.so processed its own args
> and before relro protection is applied.  The initial sp at ld.so entry
> is passed down to dl_main so it can do the adjustment.
>
> The same algorithm is used on all targets, _dl_skip_args is now 0, so
> existing target specific adjustment code is no longer used.  The bug
> affects aarch64, alpha, arc, arm, csky, ia64, nios2, s390-32 and sparc,
> other targets don't need the change in principle, but it does not hurt
> and makes the behaviour more consistent.
>
> Follow up patches can remove _dl_skip_args and DL_ARGV_NOT_RELRO.

I believe this causes a Hurd build failure:

In file included from ../sysdeps/mach/hurd/x86/dl-sysdep.c:21:
../sysdeps/mach/hurd/dl-sysdep.c:72:1: error: conflicting types for ‘_dl_sysdep_start’; have ‘Elf32_Addr(void **, void (*)(const Elf32_Phdr *, Elf32_Word,  Elf32_Addr *, Elf32_auxv_t *))’ {aka ‘unsigned int(void **, void (*)(const Elf32_Phdr *, unsigned int,  unsigned int *, Elf32_auxv_t *))’}
   72 | _dl_sysdep_start (void **start_argptr,
      | ^~~~~~~~~~~~~~~~
In file included from ../sysdeps/x86/ldsodefs.h:65,
                 from ../sysdeps/gnu/ldsodefs.h:46,
                 from ../sysdeps/x86/dl-procinfo.h:21,
                 from /home/bmg/build/glibcs/i686-gnu/glibc/dl-tunable-list.h:6,
                 from ../elf/dl-tunables.h:52,
                 from ../sysdeps/x86/cpu-tunables.c:24,
                 from ../sysdeps/mach/hurd/x86/dl-sysdep.c:20:
../sysdeps/generic/ldsodefs.h:1156:19: note: previous declaration of ‘_dl_sysdep_start’ with type ‘Elf32_Addr(void **, void (*)(const Elf32_Phdr *, Elf32_Word,  Elf32_Addr *, Elf32_auxv_t *, void **))’ {aka ‘unsigned int(void **, void (*)(const Elf32_Phdr *, unsigned int,  unsigned int *, Elf32_auxv_t *, void **))’}
 1156 | extern ElfW(Addr) _dl_sysdep_start (void **start_argptr,
      |                   ^~~~~~~~~~~~~~~~


Rest looks okay.

Thanks,
Florian

Re: [PATCH v4 2/4] rtld: Remove DL_ARGV_NOT_RELRO

[Florian Weimer]

* Szabolcs Nagy via Libc-alpha:

> This is no longer needed because _dl_skip_args is always 0, so the
> target specific code that modifies argv after relro protection is
> applied is no longer used.
>
> After the patch relro protection is applied to _dl_argv consistently
> on all targets.

I double-checked and as far as I can tell, the _dl_argv update is indeed
conditional on _dl_skip_args != 0.  Maybe you could define _dl_skip_args
as const and add a comment that it is there for the benefit of
non-yet-ported startup code, but maybe we can clean this up quickly so
that it does not matter.

Tested on s390-linux-gnu and s390x-linux-gnu, powerpc64le-linux-gnu.

Reviewed-by: Florian Weimer <fweimer@redhat.com>
Tested-by: Florian Weimer <fweimer@redhat.com>

Thanks,
Florian

Re: [PATCH v4 3/4] linux: Add a getauxval test [BZ #23293]

[Florian Weimer]

* Szabolcs Nagy via Libc-alpha:

> This is for bug 23293 and it relies on the glibc test system running
> tests via explicit ld.so invokation by default.
>
> ---
> v4:
> - New patch.

Looks okay.

Reviewed-by: Florian Weimer <fweimer@redhat.com>

Thanks,
Florian

Re: [PATCH v4 4/4] aarch64: Move ld.so _start to separate file and drop _dl_skip_args

[Florian Weimer]

* Szabolcs Nagy via Libc-alpha:

> A separate asm file is easier to maintain than a macro that expands to
> inline asm.
>
> The RTLD_START macro is only needed now because _dl_start is local in
> rtld.c, but _start has to call it, if _dl_start was made hidden then it
> could be empty.
>
> _dl_skip_args is no longer needed.

Still looks okay.

Thanks,
Florian