From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from EUR04-DB3-obe.outbound.protection.outlook.com (mail-eopbgr60079.outbound.protection.outlook.com [40.107.6.79]) by sourceware.org (Postfix) with ESMTPS id 2A611386188A for ; Thu, 21 Jan 2021 10:45:47 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.3.2 sourceware.org 2A611386188A Received: from AM5PR0701CA0022.eurprd07.prod.outlook.com (2603:10a6:203:51::32) by VI1PR08MB3104.eurprd08.prod.outlook.com (2603:10a6:803:42::17) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3763.11; Thu, 21 Jan 2021 10:45:45 +0000 Received: from AM5EUR03FT026.eop-EUR03.prod.protection.outlook.com (2603:10a6:203:51:cafe::16) by AM5PR0701CA0022.outlook.office365.com (2603:10a6:203:51::32) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3805.5 via Frontend Transport; Thu, 21 Jan 2021 10:45:45 +0000 X-MS-Exchange-Authentication-Results: spf=pass (sender IP is 63.35.35.123) smtp.mailfrom=arm.com; sourceware.org; dkim=pass (signature was verified) header.d=armh.onmicrosoft.com;sourceware.org; dmarc=pass action=none header.from=arm.com; Received-SPF: Pass (protection.outlook.com: domain of arm.com designates 63.35.35.123 as permitted sender) receiver=protection.outlook.com; client-ip=63.35.35.123; helo=64aa7808-outbound-1.mta.getcheckrecipient.com; Received: from 64aa7808-outbound-1.mta.getcheckrecipient.com (63.35.35.123) by AM5EUR03FT026.mail.protection.outlook.com (10.152.16.155) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3784.11 via Frontend Transport; Thu, 21 Jan 2021 10:45:45 +0000 Received: ("Tessian outbound f362b81824dc:v71"); Thu, 21 Jan 2021 10:45:45 +0000 X-CheckRecipientChecked: true X-CR-MTA-CID: 86b0775bf4088e67 X-CR-MTA-TID: 64aa7808 Received: from 9cd8ad40dd1d.1 by 64aa7808-outbound-1.mta.getcheckrecipient.com id D62724FA-5AAE-40F6-B902-F712DF1CD7AD.1; Thu, 21 Jan 2021 10:45:39 +0000 Received: from EUR04-HE1-obe.outbound.protection.outlook.com by 64aa7808-outbound-1.mta.getcheckrecipient.com with ESMTPS id 9cd8ad40dd1d.1 (version=TLSv1.2 cipher=ECDHE-RSA-AES256-GCM-SHA384); Thu, 21 Jan 2021 10:45:39 +0000 ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none; b=oUKxFV04ZxCmCeOECB9t+qIyFJVsmNYNekf63D08oWV+j2ty0/JUkcQZQzMsH/GjAmxVtgIQT1Qgum2vDi6tYUNzUA4PynBtbmf7W7UnJ+eLyV76zQfWOKPPpruJYon+4jKG9zhmclCfMz6+5jcydG7tzXFZ/QNM8lPjsDR7q3W+/zxcz6m6GR1SPeXMZpLHdjpW1I5olYzGKeEK3eYvfaAzEbrl2OHkmSmOAKNDNvEC5W4d02u32xeeTzEaK30AWimuQlQP+woE1iUhch98jg3lIn1TVyypfQEXnDlFu3sK842sLDZfYgOUl4MyA5S/HUKCsKbtDVoa4hT5F9IG4A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector9901; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=vR4ur7iqSWpnpWRb7Yz1stveWX/w1au+jifBOAHaxPE=; b=gNXb1E2TiJiSMfg9JASiDmx2y2hc8dwTrIiB9uokH+sTiPvZrmW60de78Hfs5puTc8/35pvXBRT8X8sZwQMSQPeL+ORbMbIaQkfPB1egTnn7CY1COJ+9po/P4BOkVmzvwOAaBhPwfZTyExxJh0zgNy0PXNrWPkTlUCEUTH/oZV+1aQiSp+mw+3YutSfbF15hZXuTvv7OW20e3/Z5HmraQ1WigiPTo6sEwvr1SUPySaSIIO6vtuqTn7gZFAPp28oCG1bYh/czcnoXeLPy8MhGUQEgyXQNjJsl8ZvOp3Opa4t31XqphrUiCCiCm2Dol/UeYBfihoy9o5saCac2BQLn5w== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=arm.com; dmarc=pass action=none header.from=arm.com; dkim=pass header.d=arm.com; arc=none Authentication-Results-Original: sourceware.org; dkim=none (message not signed) header.d=none;sourceware.org; dmarc=none action=none header.from=arm.com; Received: from PA4PR08MB6320.eurprd08.prod.outlook.com (2603:10a6:102:e5::9) by PR3PR08MB5753.eurprd08.prod.outlook.com (2603:10a6:102:87::24) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3763.10; Thu, 21 Jan 2021 10:45:38 +0000 Received: from PA4PR08MB6320.eurprd08.prod.outlook.com ([fe80::700f:ddbe:a347:ee4f]) by PA4PR08MB6320.eurprd08.prod.outlook.com ([fe80::700f:ddbe:a347:ee4f%7]) with mapi id 15.20.3763.014; Thu, 21 Jan 2021 10:45:38 +0000 From: Szabolcs Nagy To: libc-stable@sourceware.org Subject: [2.32 COMMITTED 5/5] aarch64: Use mmap to add PROT_BTI instead of mprotect [BZ #26831] Date: Thu, 21 Jan 2021 10:45:32 +0000 Message-Id: <20210121104532.21418-1-szabolcs.nagy@arm.com> X-Mailer: git-send-email 2.17.1 Content-Type: text/plain X-Originating-IP: [217.140.106.55] X-ClientProxiedBy: LO2P265CA0505.GBRP265.PROD.OUTLOOK.COM (2603:10a6:600:13b::12) To PA4PR08MB6320.eurprd08.prod.outlook.com (2603:10a6:102:e5::9) MIME-Version: 1.0 X-MS-Exchange-MessageSentRepresentingType: 1 Received: from localhost.localdomain (217.140.106.55) by LO2P265CA0505.GBRP265.PROD.OUTLOOK.COM (2603:10a6:600:13b::12) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.3784.12 via Frontend Transport; Thu, 21 Jan 2021 10:45:37 +0000 X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-HT: Tenant X-MS-Office365-Filtering-Correlation-Id: 409571ab-8902-412d-4d1b-08d8bdf9b4cf X-MS-TrafficTypeDiagnostic: PR3PR08MB5753:|VI1PR08MB3104: X-Microsoft-Antispam-PRVS: x-checkrecipientrouted: true NoDisclaimer: true X-MS-Oob-TLC-OOBClassifiers: OLM:285;OLM:285; X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam-Untrusted: BCL:0; X-Microsoft-Antispam-Message-Info-Original: WYoPj4jlSNTTU8vXeYr0qvu0xu0Ngx+vEiQuD+AF1fw1RObPCsKoE6QlSgUMw6Qj+b+Ozk6WnXgPLgtnLi9ERI7/W9VAJbR49gfcJwhDKkgJZaoRZfHN88BBFqpKQT9T1XTzwmskClX99C2uvop4DldkCgLjqUThZFWr/p54YOdX4SbQZaZ6OTsry+JIvvmO0IYaIRiZgSDOMlIZd22DIFbA8ktHJUBktGi5hxBiVrTpyiiytHSq0Dm0q8XxjSmogPfCl2iOXjKfnoy8UMN+/+J7lgnkZG/ZdVzAC1D+uqJvGBlriDSMtJU8PuMpTVe7dvnzo0z3MlpMnVo+EvI2YnkXIARcZTI4HWzskj+o2DZ43faMKqn05PvWRP+6PS8V6EY9MLr2UO68Jq/plPAugfP0IPcgKaCpaUz3+zgubWxDa1uytoTR6DC/it4DTLIbbhuV9BSUyjRwtT0vsnBVacf+gNsyfAkOeqKuPrU8fwzoMygf7iMg8VgsQuT1sBYUP9ZiaP7Y2bZG1TndlgSyNwhuuc2r6Ucdb2dnCf7aSfS0UXeifKTv3Ah2k/CcxWJv8igK7ZzqRwvCav02y+mhsw== X-Forefront-Antispam-Report-Untrusted: CIP:255.255.255.255; CTRY:; LANG:en; SCL:1; SRV:; IPV:NLI; SFV:NSPM; H:PA4PR08MB6320.eurprd08.prod.outlook.com; PTR:; CAT:NONE; SFS:(4636009)(396003)(39860400002)(366004)(376002)(346002)(136003)(69590400011)(1076003)(5660300002)(6506007)(44832011)(478600001)(6512007)(66946007)(36756003)(26005)(6916009)(66476007)(86362001)(956004)(186003)(52116002)(316002)(16526019)(2616005)(6666004)(8936002)(2906002)(8676002)(83380400001)(66556008)(6486002); DIR:OUT; SFP:1101; X-MS-Exchange-AntiSpam-MessageData: =?us-ascii?Q?SoIjbOFLSoZJFCCG+EIhdo7owYX8wwaI25hIdund0gnNiVka8Jt5fXr+0zFd?= =?us-ascii?Q?l/Lhw5nrjUyQu/ywf16heF31a0M2KuxxPpPQg4ln7HptE6mXIjZcKZF684vv?= =?us-ascii?Q?y3SkxD7MX2oeaO8gZhyHXO2WhLnMgWEkTUPl4/uxkfACv8GxevdG58YHZMRJ?= =?us-ascii?Q?8TAPKIxwVXvpfhrgW8376DYouUjQajKaIpKRdcHxFgEGVXMkSGWG4hzTpHx6?= =?us-ascii?Q?Ayw807cHUU3ubEz90WzCAAkbSsTadWjQUHdApdciOObkOOTLMNiZ7LfJx1Wq?= =?us-ascii?Q?CICATucr8d2cMnhmbaaMw1trKRMQdhcGNFU9iCrAcC3R/mtyjuM+0yZF9X1j?= =?us-ascii?Q?Nq+5hHPVcBINRTkjj65g8rpi+/kdcgv0GQHoYbwaLqfWGqCi33qnphgnVkGp?= =?us-ascii?Q?OchbWzJysOeWjwkV006roSV/6VgZHcDnSsUGpk5ib/iYMoNnMeHonpyfodkm?= =?us-ascii?Q?Sux9vZKD0L7u9nPvXo0soAG10UfuMvu3OcHHMnAFWuGUQ+bUolzuTe9kCJrz?= =?us-ascii?Q?MrKYzh0xIIqLbVPp3RUJwd3UvLaH84TYcvqe5FzKASkc5LtIp95tlpg0nnwy?= =?us-ascii?Q?fqY+r7DLOlrLit7pX2WBLZ+VW/iDDi39uBmxR3qc8x0bJycczrtxcE1qD30K?= =?us-ascii?Q?fAOiINOecaML2FsRZrJ6ANIxkKAMguBjfQHj5GCppGf7g6xQe8YMbXXDWNG0?= =?us-ascii?Q?omOSPGsHIijYUzsGuob+KffNe6Lei8EPmq2LPqiIdeOpP84ml2W93rYehV/n?= =?us-ascii?Q?MypSH/Zvp4YFe9ygz3WECFSx/dTS3pfvzGXoXpjlICTjUmMuzHfRz07Mk9LO?= =?us-ascii?Q?xzJi8unfeLv2Gg7yFfOt6/R1oQDMkl2gIKQG8mPQjJTpMoh9OpZepRCNgb0c?= =?us-ascii?Q?FEUTDXqJr0qC+NAKA4Zm9SHSMZiNoLgKQx7+0s5x0u4Hugz551iPXn1G31SE?= =?us-ascii?Q?Bdi8KVhQYZBt4ydqjuhR1DurLwlS0puY8Mh1sVYQiGONZa3ZnOJjXu+RSVVX?= =?us-ascii?Q?sufw?= X-MS-Exchange-Transport-CrossTenantHeadersStamped: PR3PR08MB5753 Original-Authentication-Results: sourceware.org; dkim=none (message not signed) header.d=none; sourceware.org; dmarc=none action=none header.from=arm.com; X-EOPAttributedMessage: 0 X-MS-Exchange-Transport-CrossTenantHeadersStripped: AM5EUR03FT026.eop-EUR03.prod.protection.outlook.com X-MS-Office365-Filtering-Correlation-Id-Prvs: 78fc3678-e316-4fd8-09ed-08d8bdf9b098 X-Microsoft-Antispam: BCL:0; X-Microsoft-Antispam-Message-Info: gYtfzhN5kwGXdWGHwg9X7523JRTDEXrIKqGhlon/zLCjYFe4FQUI+4oZTipPv8j2/8uppJRI7I5c6+Qr9wfQ1gMp4qaPYBsaARq5xCFFjL8I63LlzbijlZRKPiTKosu78lgB92/oaSdWdIL8It7H4U2eW2vWjsDpAQE3hvrz24tRCjhHAgDhyorRAjJB9bD6bx3kaIHtfL6EgPWhf2V15SUp22wKQu4KKoE0dmoKA3uBg2YJKCfRWijP7cwV340IELpqibrsAQ9YADofzVT0tFGez4RM1xtZPjAcFY5fQA7MevQ1HdC6r2VCG8J+zpv3oAwtcryGemUF17kaiNmLCrCtoeeqgdQHIOBZa+PB5pXydqtbLn8hWPmAyjegFVHRZqlOFF78AFTb/MYYx2MgSxcnmou1UHG10OWdzGcrHmF4KK1zwrNhMV1jJydpwsZeZYzBpbQhY7MqqFZW5Xz8Ku9j1xf9iqAJjYWTbzk1o08WG9eb8nO25g4XVehDWLWp X-Forefront-Antispam-Report: CIP:63.35.35.123; CTRY:IE; LANG:en; SCL:1; SRV:; IPV:CAL; SFV:NSPM; H:64aa7808-outbound-1.mta.getcheckrecipient.com; PTR:ec2-63-35-35-123.eu-west-1.compute.amazonaws.com; CAT:NONE; SFS:(4636009)(396003)(376002)(346002)(39860400002)(136003)(46966006)(82310400003)(6666004)(86362001)(83380400001)(316002)(81166007)(336012)(8676002)(2906002)(82740400003)(956004)(356005)(6486002)(186003)(1076003)(36756003)(16526019)(2616005)(6512007)(5660300002)(26005)(478600001)(47076005)(44832011)(70206006)(8936002)(70586007)(6916009)(6506007)(69590400011); DIR:OUT; SFP:1101; X-OriginatorOrg: arm.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 21 Jan 2021 10:45:45.0266 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 409571ab-8902-412d-4d1b-08d8bdf9b4cf X-MS-Exchange-CrossTenant-Id: f34e5979-57d9-4aaa-ad4d-b122a662184d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=f34e5979-57d9-4aaa-ad4d-b122a662184d; Ip=[63.35.35.123]; Helo=[64aa7808-outbound-1.mta.getcheckrecipient.com] X-MS-Exchange-CrossTenant-AuthSource: AM5EUR03FT026.eop-EUR03.prod.protection.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: VI1PR08MB3104 X-Spam-Status: No, score=-14.4 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, GIT_PATCH_0, MSGID_FROM_MTA_HEADER, RCVD_IN_DNSWL_LOW, RCVD_IN_MSPIKE_H2, SPF_HELO_PASS, SPF_PASS, TXREP, UNPARSEABLE_RELAY autolearn=ham autolearn_force=no version=3.4.2 X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on server2.sourceware.org X-BeenThere: libc-stable@sourceware.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Libc-stable mailing list List-Unsubscribe: , List-Archive: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 21 Jan 2021 10:45:49 -0000 Re-mmap executable segments if possible instead of using mprotect to add PROT_BTI. This allows using BTI protection with security policies that prevent mprotect with PROT_EXEC. If the fd of the ELF module is not available because it was kernel mapped then mprotect is used and failures are ignored. To protect the main executable even when mprotect is filtered the linux kernel will have to be changed to add PROT_BTI to it. The delayed failure reporting is mainly needed because currently _dl_process_gnu_properties does not propagate failures such that the required cleanups happen. Using the link_map_machine struct for error propagation is not ideal, but this seemed to be the least intrusive solution. Fixes bug 26831. Reviewed-by: Adhemerval Zanella (cherry picked from commit cd543b5eb3642d76e365a131ce676f31fe3f1dd4) --- sysdeps/aarch64/dl-bti.c | 52 ++++++++++++++++++++++++++------------- sysdeps/aarch64/dl-prop.h | 8 +++++- sysdeps/aarch64/linkmap.h | 2 +- 3 files changed, 43 insertions(+), 19 deletions(-) diff --git a/sysdeps/aarch64/dl-bti.c b/sysdeps/aarch64/dl-bti.c index 779d0fe488..cf7624aaa2 100644 --- a/sysdeps/aarch64/dl-bti.c +++ b/sysdeps/aarch64/dl-bti.c @@ -19,9 +19,17 @@ #include #include #include +#include -static void -enable_bti (struct link_map *map, const char *program) +/* See elf/dl-load.h. */ +#ifndef MAP_COPY +# define MAP_COPY (MAP_PRIVATE | MAP_DENYWRITE) +#endif + +/* Enable BTI protection for MAP. */ + +void +_dl_bti_protect (struct link_map *map, int fd) { const size_t pagesz = GLRO(dl_pagesize); const ElfW(Phdr) *phdr; @@ -41,18 +49,30 @@ enable_bti (struct link_map *map, const char *program) if (phdr->p_flags & PF_W) prot |= PROT_WRITE; - if (__mprotect (start, len, prot) < 0) - { - if (program) - _dl_fatal_printf ("%s: mprotect failed to turn on BTI\n", - map->l_name); - else - _dl_signal_error (errno, map->l_name, "dlopen", - N_("mprotect failed to turn on BTI")); - } + if (fd == -1) + /* Ignore failures for kernel mapped binaries. */ + __mprotect (start, len, prot); + else + map->l_mach.bti_fail = __mmap (start, len, prot, + MAP_FIXED|MAP_COPY|MAP_FILE, + fd, off) == MAP_FAILED; } } + +static void +bti_failed (struct link_map *l, const char *program) +{ + if (program) + _dl_fatal_printf ("%s: %s: failed to turn on BTI protection\n", + program, l->l_name); + else + /* Note: the errno value is not available any more. */ + _dl_signal_error (0, l->l_name, "dlopen", + N_("failed to turn on BTI protection")); +} + + /* Enable BTI for L and its dependencies. */ void @@ -61,16 +81,14 @@ _dl_bti_check (struct link_map *l, const char *program) if (!GLRO(dl_aarch64_cpu_features).bti) return; - if (l->l_mach.bti) - enable_bti (l, program); + if (l->l_mach.bti_fail) + bti_failed (l, program); unsigned int i = l->l_searchlist.r_nlist; while (i-- > 0) { struct link_map *dep = l->l_initfini[i]; - if (dep->l_init_called) - continue; - if (dep->l_mach.bti) - enable_bti (dep, program); + if (dep->l_mach.bti_fail) + bti_failed (dep, program); } } diff --git a/sysdeps/aarch64/dl-prop.h b/sysdeps/aarch64/dl-prop.h index 2016d1472e..e926e54984 100644 --- a/sysdeps/aarch64/dl-prop.h +++ b/sysdeps/aarch64/dl-prop.h @@ -19,6 +19,8 @@ #ifndef _DL_PROP_H #define _DL_PROP_H +extern void _dl_bti_protect (struct link_map *, int) attribute_hidden; + extern void _dl_bti_check (struct link_map *, const char *) attribute_hidden; @@ -43,6 +45,10 @@ static inline int _dl_process_gnu_property (struct link_map *l, int fd, uint32_t type, uint32_t datasz, void *data) { + if (!GLRO(dl_aarch64_cpu_features).bti) + /* Skip note processing. */ + return 0; + if (type == GNU_PROPERTY_AARCH64_FEATURE_1_AND) { /* Stop if the property note is ill-formed. */ @@ -51,7 +57,7 @@ _dl_process_gnu_property (struct link_map *l, int fd, uint32_t type, unsigned int feature_1 = *(unsigned int *) data; if (feature_1 & GNU_PROPERTY_AARCH64_FEATURE_1_BTI) - l->l_mach.bti = true; + _dl_bti_protect (l, fd); /* Stop if we processed the property note. */ return 0; diff --git a/sysdeps/aarch64/linkmap.h b/sysdeps/aarch64/linkmap.h index 847a03ace2..b3f7663b07 100644 --- a/sysdeps/aarch64/linkmap.h +++ b/sysdeps/aarch64/linkmap.h @@ -22,5 +22,5 @@ struct link_map_machine { ElfW(Addr) plt; /* Address of .plt */ void *tlsdesc_table; /* Address of TLS descriptor hash table. */ - bool bti; /* Branch Target Identification is enabled. */ + bool bti_fail; /* Failed to enable Branch Target Identification. */ }; -- 2.17.1