linker.cpp revision d6ee917a85245259a8fe8cdfecd4b8e48029b7d0
1/* 2 * Copyright (C) 2008 The Android Open Source Project 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * * Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * * Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in 12 * the documentation and/or other materials provided with the 13 * distribution. 14 * 15 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 16 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 17 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 18 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 19 * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 21 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS 22 * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED 23 * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, 24 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT 25 * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26 * SUCH DAMAGE. 27 */ 28 29#include <android/api-level.h> 30#include <errno.h> 31#include <fcntl.h> 32#include <inttypes.h> 33#include <pthread.h> 34#include <stdio.h> 35#include <stdlib.h> 36#include <string.h> 37#include <sys/mman.h> 38#include <sys/param.h> 39#include <unistd.h> 40 41#include <new> 42#include <string> 43#include <unordered_map> 44#include <vector> 45 46// Private C library headers. 47#include "private/bionic_tls.h" 48#include "private/KernelArgumentBlock.h" 49#include "private/ScopedPthreadMutexLocker.h" 50#include "private/ScopeGuard.h" 51 52#include "linker.h" 53#include "linker_block_allocator.h" 54#include "linker_debug.h" 55#include "linker_sleb128.h" 56#include "linker_phdr.h" 57#include "linker_relocs.h" 58#include "linker_reloc_iterators.h" 59#include "linker_utils.h" 60 61#include "android-base/strings.h" 62#include "ziparchive/zip_archive.h" 63 64extern void __libc_init_globals(KernelArgumentBlock&); 65extern void __libc_init_AT_SECURE(KernelArgumentBlock&); 66 67// Override macros to use C++ style casts. 68#undef ELF_ST_TYPE 69#define ELF_ST_TYPE(x) (static_cast<uint32_t>(x) & 0xf) 70 71struct android_namespace_t { 72 public: 73 android_namespace_t() : name_(nullptr), is_isolated_(false) {} 74 75 const char* get_name() const { return name_; } 76 void set_name(const char* name) { name_ = name; } 77 78 bool is_isolated() const { return is_isolated_; } 79 void set_isolated(bool isolated) { is_isolated_ = isolated; } 80 81 const std::vector<std::string>& get_ld_library_paths() const { 82 return ld_library_paths_; 83 } 84 void set_ld_library_paths(std::vector<std::string>&& library_paths) { 85 ld_library_paths_ = library_paths; 86 } 87 88 const std::vector<std::string>& get_default_library_paths() const { 89 return default_library_paths_; 90 } 91 void set_default_library_paths(std::vector<std::string>&& library_paths) { 92 default_library_paths_ = library_paths; 93 } 94 95 void set_permitted_paths(std::vector<std::string>&& permitted_paths) { 96 permitted_paths_ = permitted_paths; 97 } 98 99 soinfo::soinfo_list_t& soinfo_list() { return soinfo_list_; } 100 101 // For isolated namespaces - checks if the file is on the search path; 102 // always returns true for not isolated namespace. 103 bool is_accessible(const std::string& path); 104 105 private: 106 const char* name_; 107 bool is_isolated_; 108 std::vector<std::string> ld_library_paths_; 109 std::vector<std::string> default_library_paths_; 110 std::vector<std::string> permitted_paths_; 111 soinfo::soinfo_list_t soinfo_list_; 112 113 DISALLOW_COPY_AND_ASSIGN(android_namespace_t); 114}; 115 116android_namespace_t g_default_namespace; 117android_namespace_t* g_anonymous_namespace = &g_default_namespace; 118 119static ElfW(Addr) get_elf_exec_load_bias(const ElfW(Ehdr)* elf); 120 121static LinkerTypeAllocator<soinfo> g_soinfo_allocator; 122static LinkerTypeAllocator<LinkedListEntry<soinfo>> g_soinfo_links_allocator; 123 124static LinkerTypeAllocator<android_namespace_t> g_namespace_allocator; 125 126static soinfo* solist; 127static soinfo* sonext; 128static soinfo* somain; // main process, always the one after libdl_info 129 130static const char* const kDefaultLdPaths[] = { 131#if defined(__LP64__) 132 "/vendor/lib64", 133 "/system/lib64", 134#else 135 "/vendor/lib", 136 "/system/lib", 137#endif 138 nullptr 139}; 140 141static const char* const kAsanDefaultLdPaths[] = { 142#if defined(__LP64__) 143 "/data/vendor/lib64", 144 "/vendor/lib64", 145 "/data/lib64", 146 "/system/lib64", 147#else 148 "/data/vendor/lib", 149 "/vendor/lib", 150 "/data/lib", 151 "/system/lib", 152#endif 153 nullptr 154}; 155 156// TODO(dimitry): This is workaround for http://b/26394120 - it will be removed before the release 157static bool is_greylisted(const char* name) { 158 static const char* const kLibraryGreyList[] = { 159 "libLLVM.so", 160 "libRScpp.so", 161 "libaudioutils.so", 162 "libbacktrace.so", 163 "libbase.so", 164 "libbinder.so", 165 "libc++.so", 166 "libcamera_client.so", 167 "libcamera_metadata.so", 168 "libcommon_time_client.so", 169 "libcrypto.so", 170 "libcutils.so", 171 "libdrmframework.so", 172 "libexpat.so", 173 "libgui.so", 174 "libhardware.so", 175 "libicui18n.so", 176 "libicuuc.so", 177 "libmediautils.so", 178 "libmedia.so", 179 "libnativehelper.so", 180 "libnbaio.so", 181 "libnetd_client.so", 182 "libopus.so", 183 "libpowermanager.so", 184 "libsonivox.so", 185 "libspeexresampler.so", 186 "libpowermanager.so", 187 "libssl.so", 188 "libstagefright_avc_common.so", 189 "libstagefright_enc_common.so", 190 "libstagefright_foundation.so", 191 "libstagefright_omx.so", 192 "libstagefright_yuv.so", 193 "libstagefright.so", 194 "libsync.so", 195 "libui.so", 196 "libunwind.so", 197 "libutils.so", 198 "libvorbisidec.so", 199 nullptr 200 }; 201 202 for (size_t i = 0; kLibraryGreyList[i] != nullptr; ++i) { 203 if (strcmp(name, kLibraryGreyList[i]) == 0) { 204 return true; 205 } 206 } 207 208 return false; 209} 210// END OF WORKAROUND 211 212static const ElfW(Versym) kVersymNotNeeded = 0; 213static const ElfW(Versym) kVersymGlobal = 1; 214 215static const char* const* g_default_ld_paths; 216static std::vector<std::string> g_ld_preload_names; 217 218static std::vector<soinfo*> g_ld_preloads; 219 220static bool g_public_namespace_initialized; 221static soinfo::soinfo_list_t g_public_namespace; 222 223__LIBC_HIDDEN__ int g_ld_debug_verbosity; 224 225__LIBC_HIDDEN__ abort_msg_t* g_abort_message = nullptr; // For debuggerd. 226 227static std::string dirname(const char *path) { 228 const char* last_slash = strrchr(path, '/'); 229 if (last_slash == path) return "/"; 230 else if (last_slash == nullptr) return "."; 231 else 232 return std::string(path, last_slash - path); 233} 234 235#if STATS 236struct linker_stats_t { 237 int count[kRelocMax]; 238}; 239 240static linker_stats_t linker_stats; 241 242void count_relocation(RelocationKind kind) { 243 ++linker_stats.count[kind]; 244} 245#else 246void count_relocation(RelocationKind) { 247} 248#endif 249 250#if COUNT_PAGES 251uint32_t bitmask[4096]; 252#endif 253 254static char __linker_dl_err_buf[768]; 255 256char* linker_get_error_buffer() { 257 return &__linker_dl_err_buf[0]; 258} 259 260size_t linker_get_error_buffer_size() { 261 return sizeof(__linker_dl_err_buf); 262} 263 264// This function is an empty stub where GDB locates a breakpoint to get notified 265// about linker activity. 266extern "C" 267void __attribute__((noinline)) __attribute__((visibility("default"))) rtld_db_dlactivity(); 268 269static pthread_mutex_t g__r_debug_mutex = PTHREAD_MUTEX_INITIALIZER; 270static r_debug _r_debug = 271 {1, nullptr, reinterpret_cast<uintptr_t>(&rtld_db_dlactivity), r_debug::RT_CONSISTENT, 0}; 272 273static link_map* r_debug_tail = 0; 274 275static void insert_soinfo_into_debug_map(soinfo* info) { 276 // Copy the necessary fields into the debug structure. 277 link_map* map = &(info->link_map_head); 278 map->l_addr = info->load_bias; 279 // link_map l_name field is not const. 280 map->l_name = const_cast<char*>(info->get_realpath()); 281 map->l_ld = info->dynamic; 282 283 // Stick the new library at the end of the list. 284 // gdb tends to care more about libc than it does 285 // about leaf libraries, and ordering it this way 286 // reduces the back-and-forth over the wire. 287 if (r_debug_tail) { 288 r_debug_tail->l_next = map; 289 map->l_prev = r_debug_tail; 290 map->l_next = 0; 291 } else { 292 _r_debug.r_map = map; 293 map->l_prev = 0; 294 map->l_next = 0; 295 } 296 r_debug_tail = map; 297} 298 299static void remove_soinfo_from_debug_map(soinfo* info) { 300 link_map* map = &(info->link_map_head); 301 302 if (r_debug_tail == map) { 303 r_debug_tail = map->l_prev; 304 } 305 306 if (map->l_prev) { 307 map->l_prev->l_next = map->l_next; 308 } 309 if (map->l_next) { 310 map->l_next->l_prev = map->l_prev; 311 } 312} 313 314static void notify_gdb_of_load(soinfo* info) { 315 if (info->is_main_executable()) { 316 // GDB already knows about the main executable 317 return; 318 } 319 320 ScopedPthreadMutexLocker locker(&g__r_debug_mutex); 321 322 _r_debug.r_state = r_debug::RT_ADD; 323 rtld_db_dlactivity(); 324 325 insert_soinfo_into_debug_map(info); 326 327 _r_debug.r_state = r_debug::RT_CONSISTENT; 328 rtld_db_dlactivity(); 329} 330 331static void notify_gdb_of_unload(soinfo* info) { 332 if (info->is_main_executable()) { 333 // GDB already knows about the main executable 334 return; 335 } 336 337 ScopedPthreadMutexLocker locker(&g__r_debug_mutex); 338 339 _r_debug.r_state = r_debug::RT_DELETE; 340 rtld_db_dlactivity(); 341 342 remove_soinfo_from_debug_map(info); 343 344 _r_debug.r_state = r_debug::RT_CONSISTENT; 345 rtld_db_dlactivity(); 346} 347 348void notify_gdb_of_libraries() { 349 _r_debug.r_state = r_debug::RT_ADD; 350 rtld_db_dlactivity(); 351 _r_debug.r_state = r_debug::RT_CONSISTENT; 352 rtld_db_dlactivity(); 353} 354 355bool android_namespace_t::is_accessible(const std::string& file) { 356 if (!is_isolated_) { 357 return true; 358 } 359 360 for (const auto& dir : ld_library_paths_) { 361 if (file_is_in_dir(file, dir)) { 362 return true; 363 } 364 } 365 366 for (const auto& dir : default_library_paths_) { 367 if (file_is_in_dir(file, dir)) { 368 return true; 369 } 370 } 371 372 for (const auto& dir : permitted_paths_) { 373 if (file_is_under_dir(file, dir)) { 374 return true; 375 } 376 } 377 378 return false; 379} 380 381LinkedListEntry<soinfo>* SoinfoListAllocator::alloc() { 382 return g_soinfo_links_allocator.alloc(); 383} 384 385void SoinfoListAllocator::free(LinkedListEntry<soinfo>* entry) { 386 g_soinfo_links_allocator.free(entry); 387} 388 389static soinfo* soinfo_alloc(android_namespace_t* ns, const char* name, 390 struct stat* file_stat, off64_t file_offset, 391 uint32_t rtld_flags) { 392 if (strlen(name) >= PATH_MAX) { 393 DL_ERR("library name \"%s\" too long", name); 394 return nullptr; 395 } 396 397 soinfo* si = new (g_soinfo_allocator.alloc()) soinfo(ns, name, file_stat, 398 file_offset, rtld_flags); 399 400 sonext->next = si; 401 sonext = si; 402 403 ns->soinfo_list().push_back(si); 404 405 TRACE("name %s: allocated soinfo @ %p", name, si); 406 return si; 407} 408 409static void soinfo_free(soinfo* si) { 410 if (si == nullptr) { 411 return; 412 } 413 414 if (si->base != 0 && si->size != 0) { 415 munmap(reinterpret_cast<void*>(si->base), si->size); 416 } 417 418 soinfo *prev = nullptr, *trav; 419 420 TRACE("name %s: freeing soinfo @ %p", si->get_realpath(), si); 421 422 for (trav = solist; trav != nullptr; trav = trav->next) { 423 if (trav == si) { 424 break; 425 } 426 prev = trav; 427 } 428 429 if (trav == nullptr) { 430 // si was not in solist 431 DL_ERR("name \"%s\"@%p is not in solist!", si->get_realpath(), si); 432 return; 433 } 434 435 // clear links to/from si 436 si->remove_all_links(); 437 438 // prev will never be null, because the first entry in solist is 439 // always the static libdl_info. 440 prev->next = si->next; 441 if (si == sonext) { 442 sonext = prev; 443 } 444 445 // remove from the namespace 446 si->get_namespace()->soinfo_list().remove_if([&](soinfo* candidate) { 447 return si == candidate; 448 }); 449 450 si->~soinfo(); 451 g_soinfo_allocator.free(si); 452} 453 454// For every path element this function checks of it exists, and is a directory, 455// and normalizes it: 456// 1. For regular path it converts it to realpath() 457// 2. For path in a zip file it uses realpath on the zipfile 458// normalizes entry name by calling normalize_path function. 459static void resolve_paths(std::vector<std::string>& paths, 460 std::vector<std::string>* resolved_paths) { 461 resolved_paths->clear(); 462 for (const auto& path : paths) { 463 char resolved_path[PATH_MAX]; 464 const char* original_path = path.c_str(); 465 if (realpath(original_path, resolved_path) != nullptr) { 466 struct stat s; 467 if (stat(resolved_path, &s) == 0) { 468 if (S_ISDIR(s.st_mode)) { 469 resolved_paths->push_back(resolved_path); 470 } else { 471 DL_WARN("Warning: \"%s\" is not a directory (excluding from path)", resolved_path); 472 continue; 473 } 474 } else { 475 DL_WARN("Warning: cannot stat file \"%s\": %s", resolved_path, strerror(errno)); 476 continue; 477 } 478 } else { 479 std::string zip_path; 480 std::string entry_path; 481 482 std::string normalized_path; 483 484 if (!normalize_path(original_path, &normalized_path)) { 485 DL_WARN("Warning: unable to normalize \"%s\"", original_path); 486 continue; 487 } 488 489 if (parse_zip_path(normalized_path.c_str(), &zip_path, &entry_path)) { 490 if (realpath(zip_path.c_str(), resolved_path) == nullptr) { 491 DL_WARN("Warning: unable to resolve \"%s\": %s", zip_path.c_str(), strerror(errno)); 492 continue; 493 } 494 495 ZipArchiveHandle handle = nullptr; 496 if (OpenArchive(resolved_path, &handle) != 0) { 497 DL_WARN("Warning: unable to open zip archive: %s", resolved_path); 498 continue; 499 } 500 501 // Check if zip-file has a dir with entry_path name 502 void* cookie = nullptr; 503 std::string prefix_str = entry_path + "/"; 504 ZipString prefix(prefix_str.c_str()); 505 506 ZipEntry out_data; 507 ZipString out_name; 508 509 int32_t error_code; 510 511 if ((error_code = StartIteration(handle, &cookie, &prefix, nullptr)) != 0) { 512 DL_WARN("Unable to iterate over zip-archive entries \"%s\";" 513 " error code: %d", zip_path.c_str(), error_code); 514 continue; 515 } 516 517 if (Next(cookie, &out_data, &out_name) != 0) { 518 DL_WARN("Unable to find entries starting with \"%s\" in \"%s\"", 519 prefix_str.c_str(), zip_path.c_str()); 520 continue; 521 } 522 523 auto zip_guard = make_scope_guard([&]() { 524 if (cookie != nullptr) { 525 EndIteration(cookie); 526 } 527 CloseArchive(handle); 528 }); 529 530 resolved_paths->push_back(std::string(resolved_path) + kZipFileSeparator + entry_path); 531 } 532 } 533 } 534} 535 536static void split_path(const char* path, const char* delimiters, 537 std::vector<std::string>* paths) { 538 if (path != nullptr && path[0] != 0) { 539 *paths = android::base::Split(path, delimiters); 540 } 541} 542 543static void parse_path(const char* path, const char* delimiters, 544 std::vector<std::string>* resolved_paths) { 545 std::vector<std::string> paths; 546 split_path(path, delimiters, &paths); 547 resolve_paths(paths, resolved_paths); 548} 549 550static void parse_LD_LIBRARY_PATH(const char* path) { 551 std::vector<std::string> ld_libary_paths; 552 parse_path(path, ":", &ld_libary_paths); 553 g_default_namespace.set_ld_library_paths(std::move(ld_libary_paths)); 554} 555 556void soinfo::set_dt_runpath(const char* path) { 557 if (!has_min_version(3)) { 558 return; 559 } 560 561 std::vector<std::string> runpaths; 562 563 split_path(path, ":", &runpaths); 564 565 std::string origin = dirname(get_realpath()); 566 // FIXME: add $LIB and $PLATFORM. 567 std::pair<std::string, std::string> substs[] = {{"ORIGIN", origin}}; 568 for (auto&& s : runpaths) { 569 size_t pos = 0; 570 while (pos < s.size()) { 571 pos = s.find("$", pos); 572 if (pos == std::string::npos) break; 573 for (const auto& subst : substs) { 574 const std::string& token = subst.first; 575 const std::string& replacement = subst.second; 576 if (s.substr(pos + 1, token.size()) == token) { 577 s.replace(pos, token.size() + 1, replacement); 578 // -1 to compensate for the ++pos below. 579 pos += replacement.size() - 1; 580 break; 581 } else if (s.substr(pos + 1, token.size() + 2) == "{" + token + "}") { 582 s.replace(pos, token.size() + 3, replacement); 583 pos += replacement.size() - 1; 584 break; 585 } 586 } 587 // Skip $ in case it did not match any of the known substitutions. 588 ++pos; 589 } 590 } 591 592 resolve_paths(runpaths, &dt_runpath_); 593} 594 595static void parse_LD_PRELOAD(const char* path) { 596 g_ld_preload_names.clear(); 597 if (path != nullptr) { 598 // We have historically supported ':' as well as ' ' in LD_PRELOAD. 599 g_ld_preload_names = android::base::Split(path, " :"); 600 } 601} 602 603static bool realpath_fd(int fd, std::string* realpath) { 604 std::vector<char> buf(PATH_MAX), proc_self_fd(PATH_MAX); 605 __libc_format_buffer(&proc_self_fd[0], proc_self_fd.size(), "/proc/self/fd/%d", fd); 606 if (readlink(&proc_self_fd[0], &buf[0], buf.size()) == -1) { 607 PRINT("readlink('%s') failed: %s [fd=%d]", &proc_self_fd[0], strerror(errno), fd); 608 return false; 609 } 610 611 *realpath = &buf[0]; 612 return true; 613} 614 615#if defined(__arm__) 616 617// For a given PC, find the .so that it belongs to. 618// Returns the base address of the .ARM.exidx section 619// for that .so, and the number of 8-byte entries 620// in that section (via *pcount). 621// 622// Intended to be called by libc's __gnu_Unwind_Find_exidx(). 623// 624// This function is exposed via dlfcn.cpp and libdl.so. 625_Unwind_Ptr dl_unwind_find_exidx(_Unwind_Ptr pc, int* pcount) { 626 uintptr_t addr = reinterpret_cast<uintptr_t>(pc); 627 628 for (soinfo* si = solist; si != 0; si = si->next) { 629 if ((addr >= si->base) && (addr < (si->base + si->size))) { 630 *pcount = si->ARM_exidx_count; 631 return reinterpret_cast<_Unwind_Ptr>(si->ARM_exidx); 632 } 633 } 634 *pcount = 0; 635 return nullptr; 636} 637 638#endif 639 640// Here, we only have to provide a callback to iterate across all the 641// loaded libraries. gcc_eh does the rest. 642int do_dl_iterate_phdr(int (*cb)(dl_phdr_info* info, size_t size, void* data), void* data) { 643 int rv = 0; 644 for (soinfo* si = solist; si != nullptr; si = si->next) { 645 dl_phdr_info dl_info; 646 dl_info.dlpi_addr = si->link_map_head.l_addr; 647 dl_info.dlpi_name = si->link_map_head.l_name; 648 dl_info.dlpi_phdr = si->phdr; 649 dl_info.dlpi_phnum = si->phnum; 650 rv = cb(&dl_info, sizeof(dl_phdr_info), data); 651 if (rv != 0) { 652 break; 653 } 654 } 655 return rv; 656} 657 658const ElfW(Versym)* soinfo::get_versym(size_t n) const { 659 if (has_min_version(2) && versym_ != nullptr) { 660 return versym_ + n; 661 } 662 663 return nullptr; 664} 665 666ElfW(Addr) soinfo::get_verneed_ptr() const { 667 if (has_min_version(2)) { 668 return verneed_ptr_; 669 } 670 671 return 0; 672} 673 674size_t soinfo::get_verneed_cnt() const { 675 if (has_min_version(2)) { 676 return verneed_cnt_; 677 } 678 679 return 0; 680} 681 682ElfW(Addr) soinfo::get_verdef_ptr() const { 683 if (has_min_version(2)) { 684 return verdef_ptr_; 685 } 686 687 return 0; 688} 689 690size_t soinfo::get_verdef_cnt() const { 691 if (has_min_version(2)) { 692 return verdef_cnt_; 693 } 694 695 return 0; 696} 697 698template<typename F> 699static bool for_each_verdef(const soinfo* si, F functor) { 700 if (!si->has_min_version(2)) { 701 return true; 702 } 703 704 uintptr_t verdef_ptr = si->get_verdef_ptr(); 705 if (verdef_ptr == 0) { 706 return true; 707 } 708 709 size_t offset = 0; 710 711 size_t verdef_cnt = si->get_verdef_cnt(); 712 for (size_t i = 0; i<verdef_cnt; ++i) { 713 const ElfW(Verdef)* verdef = reinterpret_cast<ElfW(Verdef)*>(verdef_ptr + offset); 714 size_t verdaux_offset = offset + verdef->vd_aux; 715 offset += verdef->vd_next; 716 717 if (verdef->vd_version != 1) { 718 DL_ERR("unsupported verdef[%zd] vd_version: %d (expected 1) library: %s", 719 i, verdef->vd_version, si->get_realpath()); 720 return false; 721 } 722 723 if ((verdef->vd_flags & VER_FLG_BASE) != 0) { 724 // "this is the version of the file itself. It must not be used for 725 // matching a symbol. It can be used to match references." 726 // 727 // http://www.akkadia.org/drepper/symbol-versioning 728 continue; 729 } 730 731 if (verdef->vd_cnt == 0) { 732 DL_ERR("invalid verdef[%zd] vd_cnt == 0 (version without a name)", i); 733 return false; 734 } 735 736 const ElfW(Verdaux)* verdaux = reinterpret_cast<ElfW(Verdaux)*>(verdef_ptr + verdaux_offset); 737 738 if (functor(i, verdef, verdaux) == true) { 739 break; 740 } 741 } 742 743 return true; 744} 745 746bool soinfo::find_verdef_version_index(const version_info* vi, ElfW(Versym)* versym) const { 747 if (vi == nullptr) { 748 *versym = kVersymNotNeeded; 749 return true; 750 } 751 752 *versym = kVersymGlobal; 753 754 return for_each_verdef(this, 755 [&](size_t, const ElfW(Verdef)* verdef, const ElfW(Verdaux)* verdaux) { 756 if (verdef->vd_hash == vi->elf_hash && 757 strcmp(vi->name, get_string(verdaux->vda_name)) == 0) { 758 *versym = verdef->vd_ndx; 759 return true; 760 } 761 762 return false; 763 } 764 ); 765} 766 767bool soinfo::find_symbol_by_name(SymbolName& symbol_name, 768 const version_info* vi, 769 const ElfW(Sym)** symbol) const { 770 uint32_t symbol_index; 771 bool success = 772 is_gnu_hash() ? 773 gnu_lookup(symbol_name, vi, &symbol_index) : 774 elf_lookup(symbol_name, vi, &symbol_index); 775 776 if (success) { 777 *symbol = symbol_index == 0 ? nullptr : symtab_ + symbol_index; 778 } 779 780 return success; 781} 782 783static bool is_symbol_global_and_defined(const soinfo* si, const ElfW(Sym)* s) { 784 if (ELF_ST_BIND(s->st_info) == STB_GLOBAL || 785 ELF_ST_BIND(s->st_info) == STB_WEAK) { 786 return s->st_shndx != SHN_UNDEF; 787 } else if (ELF_ST_BIND(s->st_info) != STB_LOCAL) { 788 DL_WARN("unexpected ST_BIND value: %d for '%s' in '%s'", 789 ELF_ST_BIND(s->st_info), si->get_string(s->st_name), si->get_realpath()); 790 } 791 792 return false; 793} 794 795static const ElfW(Versym) kVersymHiddenBit = 0x8000; 796 797static inline bool is_versym_hidden(const ElfW(Versym)* versym) { 798 // the symbol is hidden if bit 15 of versym is set. 799 return versym != nullptr && (*versym & kVersymHiddenBit) != 0; 800} 801 802static inline bool check_symbol_version(const ElfW(Versym) verneed, 803 const ElfW(Versym)* verdef) { 804 return verneed == kVersymNotNeeded || 805 verdef == nullptr || 806 verneed == (*verdef & ~kVersymHiddenBit); 807} 808 809bool soinfo::gnu_lookup(SymbolName& symbol_name, 810 const version_info* vi, 811 uint32_t* symbol_index) const { 812 uint32_t hash = symbol_name.gnu_hash(); 813 uint32_t h2 = hash >> gnu_shift2_; 814 815 uint32_t bloom_mask_bits = sizeof(ElfW(Addr))*8; 816 uint32_t word_num = (hash / bloom_mask_bits) & gnu_maskwords_; 817 ElfW(Addr) bloom_word = gnu_bloom_filter_[word_num]; 818 819 *symbol_index = 0; 820 821 TRACE_TYPE(LOOKUP, "SEARCH %s in %s@%p (gnu)", 822 symbol_name.get_name(), get_realpath(), reinterpret_cast<void*>(base)); 823 824 // test against bloom filter 825 if ((1 & (bloom_word >> (hash % bloom_mask_bits)) & (bloom_word >> (h2 % bloom_mask_bits))) == 0) { 826 TRACE_TYPE(LOOKUP, "NOT FOUND %s in %s@%p", 827 symbol_name.get_name(), get_realpath(), reinterpret_cast<void*>(base)); 828 829 return true; 830 } 831 832 // bloom test says "probably yes"... 833 uint32_t n = gnu_bucket_[hash % gnu_nbucket_]; 834 835 if (n == 0) { 836 TRACE_TYPE(LOOKUP, "NOT FOUND %s in %s@%p", 837 symbol_name.get_name(), get_realpath(), reinterpret_cast<void*>(base)); 838 839 return true; 840 } 841 842 // lookup versym for the version definition in this library 843 // note the difference between "version is not requested" (vi == nullptr) 844 // and "version not found". In the first case verneed is kVersymNotNeeded 845 // which implies that the default version can be accepted; the second case results in 846 // verneed = 1 (kVersymGlobal) and implies that we should ignore versioned symbols 847 // for this library and consider only *global* ones. 848 ElfW(Versym) verneed = 0; 849 if (!find_verdef_version_index(vi, &verneed)) { 850 return false; 851 } 852 853 do { 854 ElfW(Sym)* s = symtab_ + n; 855 const ElfW(Versym)* verdef = get_versym(n); 856 // skip hidden versions when verneed == kVersymNotNeeded (0) 857 if (verneed == kVersymNotNeeded && is_versym_hidden(verdef)) { 858 continue; 859 } 860 if (((gnu_chain_[n] ^ hash) >> 1) == 0 && 861 check_symbol_version(verneed, verdef) && 862 strcmp(get_string(s->st_name), symbol_name.get_name()) == 0 && 863 is_symbol_global_and_defined(this, s)) { 864 TRACE_TYPE(LOOKUP, "FOUND %s in %s (%p) %zd", 865 symbol_name.get_name(), get_realpath(), reinterpret_cast<void*>(s->st_value), 866 static_cast<size_t>(s->st_size)); 867 *symbol_index = n; 868 return true; 869 } 870 } while ((gnu_chain_[n++] & 1) == 0); 871 872 TRACE_TYPE(LOOKUP, "NOT FOUND %s in %s@%p", 873 symbol_name.get_name(), get_realpath(), reinterpret_cast<void*>(base)); 874 875 return true; 876} 877 878bool soinfo::elf_lookup(SymbolName& symbol_name, 879 const version_info* vi, 880 uint32_t* symbol_index) const { 881 uint32_t hash = symbol_name.elf_hash(); 882 883 TRACE_TYPE(LOOKUP, "SEARCH %s in %s@%p h=%x(elf) %zd", 884 symbol_name.get_name(), get_realpath(), 885 reinterpret_cast<void*>(base), hash, hash % nbucket_); 886 887 ElfW(Versym) verneed = 0; 888 if (!find_verdef_version_index(vi, &verneed)) { 889 return false; 890 } 891 892 for (uint32_t n = bucket_[hash % nbucket_]; n != 0; n = chain_[n]) { 893 ElfW(Sym)* s = symtab_ + n; 894 const ElfW(Versym)* verdef = get_versym(n); 895 896 // skip hidden versions when verneed == 0 897 if (verneed == kVersymNotNeeded && is_versym_hidden(verdef)) { 898 continue; 899 } 900 901 if (check_symbol_version(verneed, verdef) && 902 strcmp(get_string(s->st_name), symbol_name.get_name()) == 0 && 903 is_symbol_global_and_defined(this, s)) { 904 TRACE_TYPE(LOOKUP, "FOUND %s in %s (%p) %zd", 905 symbol_name.get_name(), get_realpath(), 906 reinterpret_cast<void*>(s->st_value), 907 static_cast<size_t>(s->st_size)); 908 *symbol_index = n; 909 return true; 910 } 911 } 912 913 TRACE_TYPE(LOOKUP, "NOT FOUND %s in %s@%p %x %zd", 914 symbol_name.get_name(), get_realpath(), 915 reinterpret_cast<void*>(base), hash, hash % nbucket_); 916 917 *symbol_index = 0; 918 return true; 919} 920 921soinfo::soinfo(android_namespace_t* ns, const char* realpath, 922 const struct stat* file_stat, off64_t file_offset, 923 int rtld_flags) { 924 memset(this, 0, sizeof(*this)); 925 926 if (realpath != nullptr) { 927 realpath_ = realpath; 928 } 929 930 flags_ = FLAG_NEW_SOINFO; 931 version_ = SOINFO_VERSION; 932 933 if (file_stat != nullptr) { 934 this->st_dev_ = file_stat->st_dev; 935 this->st_ino_ = file_stat->st_ino; 936 this->file_offset_ = file_offset; 937 } 938 939 this->rtld_flags_ = rtld_flags; 940 this->namespace_ = ns; 941} 942 943static uint32_t calculate_elf_hash(const char* name) { 944 const uint8_t* name_bytes = reinterpret_cast<const uint8_t*>(name); 945 uint32_t h = 0, g; 946 947 while (*name_bytes) { 948 h = (h << 4) + *name_bytes++; 949 g = h & 0xf0000000; 950 h ^= g; 951 h ^= g >> 24; 952 } 953 954 return h; 955} 956 957uint32_t SymbolName::elf_hash() { 958 if (!has_elf_hash_) { 959 elf_hash_ = calculate_elf_hash(name_); 960 has_elf_hash_ = true; 961 } 962 963 return elf_hash_; 964} 965 966uint32_t SymbolName::gnu_hash() { 967 if (!has_gnu_hash_) { 968 uint32_t h = 5381; 969 const uint8_t* name = reinterpret_cast<const uint8_t*>(name_); 970 while (*name != 0) { 971 h += (h << 5) + *name++; // h*33 + c = h + h * 32 + c = h + h << 5 + c 972 } 973 974 gnu_hash_ = h; 975 has_gnu_hash_ = true; 976 } 977 978 return gnu_hash_; 979} 980 981bool soinfo_do_lookup(soinfo* si_from, const char* name, const version_info* vi, 982 soinfo** si_found_in, const soinfo::soinfo_list_t& global_group, 983 const soinfo::soinfo_list_t& local_group, const ElfW(Sym)** symbol) { 984 SymbolName symbol_name(name); 985 const ElfW(Sym)* s = nullptr; 986 987 /* "This element's presence in a shared object library alters the dynamic linker's 988 * symbol resolution algorithm for references within the library. Instead of starting 989 * a symbol search with the executable file, the dynamic linker starts from the shared 990 * object itself. If the shared object fails to supply the referenced symbol, the 991 * dynamic linker then searches the executable file and other shared objects as usual." 992 * 993 * http://www.sco.com/developers/gabi/2012-12-31/ch5.dynamic.html 994 * 995 * Note that this is unlikely since static linker avoids generating 996 * relocations for -Bsymbolic linked dynamic executables. 997 */ 998 if (si_from->has_DT_SYMBOLIC) { 999 DEBUG("%s: looking up %s in local scope (DT_SYMBOLIC)", si_from->get_realpath(), name); 1000 if (!si_from->find_symbol_by_name(symbol_name, vi, &s)) { 1001 return false; 1002 } 1003 1004 if (s != nullptr) { 1005 *si_found_in = si_from; 1006 } 1007 } 1008 1009 // 1. Look for it in global_group 1010 if (s == nullptr) { 1011 bool error = false; 1012 global_group.visit([&](soinfo* global_si) { 1013 DEBUG("%s: looking up %s in %s (from global group)", 1014 si_from->get_realpath(), name, global_si->get_realpath()); 1015 if (!global_si->find_symbol_by_name(symbol_name, vi, &s)) { 1016 error = true; 1017 return false; 1018 } 1019 1020 if (s != nullptr) { 1021 *si_found_in = global_si; 1022 return false; 1023 } 1024 1025 return true; 1026 }); 1027 1028 if (error) { 1029 return false; 1030 } 1031 } 1032 1033 // 2. Look for it in the local group 1034 if (s == nullptr) { 1035 bool error = false; 1036 local_group.visit([&](soinfo* local_si) { 1037 if (local_si == si_from && si_from->has_DT_SYMBOLIC) { 1038 // we already did this - skip 1039 return true; 1040 } 1041 1042 DEBUG("%s: looking up %s in %s (from local group)", 1043 si_from->get_realpath(), name, local_si->get_realpath()); 1044 if (!local_si->find_symbol_by_name(symbol_name, vi, &s)) { 1045 error = true; 1046 return false; 1047 } 1048 1049 if (s != nullptr) { 1050 *si_found_in = local_si; 1051 return false; 1052 } 1053 1054 return true; 1055 }); 1056 1057 if (error) { 1058 return false; 1059 } 1060 } 1061 1062 if (s != nullptr) { 1063 TRACE_TYPE(LOOKUP, "si %s sym %s s->st_value = %p, " 1064 "found in %s, base = %p, load bias = %p", 1065 si_from->get_realpath(), name, reinterpret_cast<void*>(s->st_value), 1066 (*si_found_in)->get_realpath(), reinterpret_cast<void*>((*si_found_in)->base), 1067 reinterpret_cast<void*>((*si_found_in)->load_bias)); 1068 } 1069 1070 *symbol = s; 1071 return true; 1072} 1073 1074class ProtectedDataGuard { 1075 public: 1076 ProtectedDataGuard() { 1077 if (ref_count_++ == 0) { 1078 protect_data(PROT_READ | PROT_WRITE); 1079 } 1080 } 1081 1082 ~ProtectedDataGuard() { 1083 if (ref_count_ == 0) { // overflow 1084 __libc_fatal("Too many nested calls to dlopen()"); 1085 } 1086 1087 if (--ref_count_ == 0) { 1088 protect_data(PROT_READ); 1089 } 1090 } 1091 private: 1092 void protect_data(int protection) { 1093 g_soinfo_allocator.protect_all(protection); 1094 g_soinfo_links_allocator.protect_all(protection); 1095 g_namespace_allocator.protect_all(protection); 1096 } 1097 1098 static size_t ref_count_; 1099}; 1100 1101size_t ProtectedDataGuard::ref_count_ = 0; 1102 1103// Each size has it's own allocator. 1104template<size_t size> 1105class SizeBasedAllocator { 1106 public: 1107 static void* alloc() { 1108 return allocator_.alloc(); 1109 } 1110 1111 static void free(void* ptr) { 1112 allocator_.free(ptr); 1113 } 1114 1115 private: 1116 static LinkerBlockAllocator allocator_; 1117}; 1118 1119template<size_t size> 1120LinkerBlockAllocator SizeBasedAllocator<size>::allocator_(size); 1121 1122template<typename T> 1123class TypeBasedAllocator { 1124 public: 1125 static T* alloc() { 1126 return reinterpret_cast<T*>(SizeBasedAllocator<sizeof(T)>::alloc()); 1127 } 1128 1129 static void free(T* ptr) { 1130 SizeBasedAllocator<sizeof(T)>::free(ptr); 1131 } 1132}; 1133 1134class LoadTask { 1135 public: 1136 struct deleter_t { 1137 void operator()(LoadTask* t) { 1138 t->~LoadTask(); 1139 TypeBasedAllocator<LoadTask>::free(t); 1140 } 1141 }; 1142 1143 static deleter_t deleter; 1144 1145 static LoadTask* create(const char* name, soinfo* needed_by, 1146 std::unordered_map<const soinfo*, ElfReader>* readers_map) { 1147 LoadTask* ptr = TypeBasedAllocator<LoadTask>::alloc(); 1148 return new (ptr) LoadTask(name, needed_by, readers_map); 1149 } 1150 1151 const char* get_name() const { 1152 return name_; 1153 } 1154 1155 soinfo* get_needed_by() const { 1156 return needed_by_; 1157 } 1158 1159 soinfo* get_soinfo() const { 1160 return si_; 1161 } 1162 1163 void set_soinfo(soinfo* si) { 1164 si_ = si; 1165 } 1166 1167 off64_t get_file_offset() const { 1168 return file_offset_; 1169 } 1170 1171 void set_file_offset(off64_t offset) { 1172 file_offset_ = offset; 1173 } 1174 1175 int get_fd() const { 1176 return fd_; 1177 } 1178 1179 void set_fd(int fd, bool assume_ownership) { 1180 fd_ = fd; 1181 close_fd_ = assume_ownership; 1182 } 1183 1184 const android_dlextinfo* get_extinfo() const { 1185 return extinfo_; 1186 } 1187 1188 void set_extinfo(const android_dlextinfo* extinfo) { 1189 extinfo_ = extinfo; 1190 } 1191 1192 const ElfReader& get_elf_reader() const { 1193 CHECK(si_ != nullptr); 1194 return (*elf_readers_map_)[si_]; 1195 } 1196 1197 ElfReader& get_elf_reader() { 1198 CHECK(si_ != nullptr); 1199 return (*elf_readers_map_)[si_]; 1200 } 1201 1202 std::unordered_map<const soinfo*, ElfReader>* get_readers_map() { 1203 return elf_readers_map_; 1204 } 1205 1206 bool read(const char* realpath, off64_t file_size) { 1207 ElfReader& elf_reader = get_elf_reader(); 1208 return elf_reader.Read(realpath, fd_, file_offset_, file_size); 1209 } 1210 1211 bool load() { 1212 ElfReader& elf_reader = get_elf_reader(); 1213 if (!elf_reader.Load(extinfo_)) { 1214 return false; 1215 } 1216 1217 si_->base = elf_reader.load_start(); 1218 si_->size = elf_reader.load_size(); 1219 si_->load_bias = elf_reader.load_bias(); 1220 si_->phnum = elf_reader.phdr_count(); 1221 si_->phdr = elf_reader.loaded_phdr(); 1222 1223 return true; 1224 } 1225 1226 private: 1227 LoadTask(const char* name, soinfo* needed_by, 1228 std::unordered_map<const soinfo*, ElfReader>* readers_map) 1229 : name_(name), needed_by_(needed_by), si_(nullptr), 1230 fd_(-1), close_fd_(false), file_offset_(0), elf_readers_map_(readers_map) {} 1231 1232 ~LoadTask() { 1233 if (fd_ != -1 && close_fd_) { 1234 close(fd_); 1235 } 1236 } 1237 1238 const char* name_; 1239 soinfo* needed_by_; 1240 soinfo* si_; 1241 const android_dlextinfo* extinfo_; 1242 int fd_; 1243 bool close_fd_; 1244 off64_t file_offset_; 1245 std::unordered_map<const soinfo*, ElfReader>* elf_readers_map_; 1246 1247 DISALLOW_IMPLICIT_CONSTRUCTORS(LoadTask); 1248}; 1249 1250LoadTask::deleter_t LoadTask::deleter; 1251 1252template <typename T> 1253using linked_list_t = LinkedList<T, TypeBasedAllocator<LinkedListEntry<T>>>; 1254 1255typedef linked_list_t<soinfo> SoinfoLinkedList; 1256typedef linked_list_t<const char> StringLinkedList; 1257typedef std::vector<LoadTask*> LoadTaskList; 1258 1259 1260// This function walks down the tree of soinfo dependencies 1261// in breadth-first order and 1262// * calls action(soinfo* si) for each node, and 1263// * terminates walk if action returns false. 1264// 1265// walk_dependencies_tree returns false if walk was terminated 1266// by the action and true otherwise. 1267template<typename F> 1268static bool walk_dependencies_tree(soinfo* root_soinfos[], size_t root_soinfos_size, F action) { 1269 SoinfoLinkedList visit_list; 1270 SoinfoLinkedList visited; 1271 1272 for (size_t i = 0; i < root_soinfos_size; ++i) { 1273 visit_list.push_back(root_soinfos[i]); 1274 } 1275 1276 soinfo* si; 1277 while ((si = visit_list.pop_front()) != nullptr) { 1278 if (visited.contains(si)) { 1279 continue; 1280 } 1281 1282 if (!action(si)) { 1283 return false; 1284 } 1285 1286 visited.push_back(si); 1287 1288 si->get_children().for_each([&](soinfo* child) { 1289 visit_list.push_back(child); 1290 }); 1291 } 1292 1293 return true; 1294} 1295 1296 1297static const ElfW(Sym)* dlsym_handle_lookup(soinfo* root, soinfo* skip_until, 1298 soinfo** found, SymbolName& symbol_name, 1299 const version_info* vi) { 1300 const ElfW(Sym)* result = nullptr; 1301 bool skip_lookup = skip_until != nullptr; 1302 1303 walk_dependencies_tree(&root, 1, [&](soinfo* current_soinfo) { 1304 if (skip_lookup) { 1305 skip_lookup = current_soinfo != skip_until; 1306 return true; 1307 } 1308 1309 if (!current_soinfo->find_symbol_by_name(symbol_name, vi, &result)) { 1310 result = nullptr; 1311 return false; 1312 } 1313 1314 if (result != nullptr) { 1315 *found = current_soinfo; 1316 return false; 1317 } 1318 1319 return true; 1320 }); 1321 1322 return result; 1323} 1324 1325static const ElfW(Sym)* dlsym_linear_lookup(android_namespace_t* ns, 1326 const char* name, 1327 const version_info* vi, 1328 soinfo** found, 1329 soinfo* caller, 1330 void* handle); 1331 1332// This is used by dlsym(3). It performs symbol lookup only within the 1333// specified soinfo object and its dependencies in breadth first order. 1334static const ElfW(Sym)* dlsym_handle_lookup(soinfo* si, soinfo** found, 1335 const char* name, const version_info* vi) { 1336 // According to man dlopen(3) and posix docs in the case when si is handle 1337 // of the main executable we need to search not only in the executable and its 1338 // dependencies but also in all libraries loaded with RTLD_GLOBAL. 1339 // 1340 // Since RTLD_GLOBAL is always set for the main executable and all dt_needed shared 1341 // libraries and they are loaded in breath-first (correct) order we can just execute 1342 // dlsym(RTLD_DEFAULT, ...); instead of doing two stage lookup. 1343 if (si == somain) { 1344 return dlsym_linear_lookup(&g_default_namespace, name, vi, found, nullptr, RTLD_DEFAULT); 1345 } 1346 1347 SymbolName symbol_name(name); 1348 return dlsym_handle_lookup(si, nullptr, found, symbol_name, vi); 1349} 1350 1351/* This is used by dlsym(3) to performs a global symbol lookup. If the 1352 start value is null (for RTLD_DEFAULT), the search starts at the 1353 beginning of the global solist. Otherwise the search starts at the 1354 specified soinfo (for RTLD_NEXT). 1355 */ 1356static const ElfW(Sym)* dlsym_linear_lookup(android_namespace_t* ns, 1357 const char* name, 1358 const version_info* vi, 1359 soinfo** found, 1360 soinfo* caller, 1361 void* handle) { 1362 SymbolName symbol_name(name); 1363 1364 soinfo::soinfo_list_t& soinfo_list = ns->soinfo_list(); 1365 soinfo::soinfo_list_t::iterator start = soinfo_list.begin(); 1366 1367 if (handle == RTLD_NEXT) { 1368 if (caller == nullptr) { 1369 return nullptr; 1370 } else { 1371 soinfo::soinfo_list_t::iterator it = soinfo_list.find(caller); 1372 CHECK (it != soinfo_list.end()); 1373 start = ++it; 1374 } 1375 } 1376 1377 const ElfW(Sym)* s = nullptr; 1378 for (soinfo::soinfo_list_t::iterator it = start, end = soinfo_list.end(); it != end; ++it) { 1379 soinfo* si = *it; 1380 // Do not skip RTLD_LOCAL libraries in dlsym(RTLD_DEFAULT, ...) 1381 // if the library is opened by application with target api level <= 22 1382 // See http://b/21565766 1383 if ((si->get_rtld_flags() & RTLD_GLOBAL) == 0 && si->get_target_sdk_version() > 22) { 1384 continue; 1385 } 1386 1387 if (!si->find_symbol_by_name(symbol_name, vi, &s)) { 1388 return nullptr; 1389 } 1390 1391 if (s != nullptr) { 1392 *found = si; 1393 break; 1394 } 1395 } 1396 1397 // If not found - use dlsym_handle_lookup for caller's 1398 // local_group unless it is part of the global group in which 1399 // case we already did it. 1400 if (s == nullptr && caller != nullptr && 1401 (caller->get_rtld_flags() & RTLD_GLOBAL) == 0) { 1402 return dlsym_handle_lookup(caller->get_local_group_root(), 1403 (handle == RTLD_NEXT) ? caller : nullptr, found, symbol_name, vi); 1404 } 1405 1406 if (s != nullptr) { 1407 TRACE_TYPE(LOOKUP, "%s s->st_value = %p, found->base = %p", 1408 name, reinterpret_cast<void*>(s->st_value), reinterpret_cast<void*>((*found)->base)); 1409 } 1410 1411 return s; 1412} 1413 1414soinfo* find_containing_library(const void* p) { 1415 ElfW(Addr) address = reinterpret_cast<ElfW(Addr)>(p); 1416 for (soinfo* si = solist; si != nullptr; si = si->next) { 1417 if (address >= si->base && address - si->base < si->size) { 1418 return si; 1419 } 1420 } 1421 return nullptr; 1422} 1423 1424ElfW(Sym)* soinfo::find_symbol_by_address(const void* addr) { 1425 return is_gnu_hash() ? gnu_addr_lookup(addr) : elf_addr_lookup(addr); 1426} 1427 1428static bool symbol_matches_soaddr(const ElfW(Sym)* sym, ElfW(Addr) soaddr) { 1429 return sym->st_shndx != SHN_UNDEF && 1430 soaddr >= sym->st_value && 1431 soaddr < sym->st_value + sym->st_size; 1432} 1433 1434ElfW(Sym)* soinfo::gnu_addr_lookup(const void* addr) { 1435 ElfW(Addr) soaddr = reinterpret_cast<ElfW(Addr)>(addr) - load_bias; 1436 1437 for (size_t i = 0; i < gnu_nbucket_; ++i) { 1438 uint32_t n = gnu_bucket_[i]; 1439 1440 if (n == 0) { 1441 continue; 1442 } 1443 1444 do { 1445 ElfW(Sym)* sym = symtab_ + n; 1446 if (symbol_matches_soaddr(sym, soaddr)) { 1447 return sym; 1448 } 1449 } while ((gnu_chain_[n++] & 1) == 0); 1450 } 1451 1452 return nullptr; 1453} 1454 1455ElfW(Sym)* soinfo::elf_addr_lookup(const void* addr) { 1456 ElfW(Addr) soaddr = reinterpret_cast<ElfW(Addr)>(addr) - load_bias; 1457 1458 // Search the library's symbol table for any defined symbol which 1459 // contains this address. 1460 for (size_t i = 0; i < nchain_; ++i) { 1461 ElfW(Sym)* sym = symtab_ + i; 1462 if (symbol_matches_soaddr(sym, soaddr)) { 1463 return sym; 1464 } 1465 } 1466 1467 return nullptr; 1468} 1469 1470class ZipArchiveCache { 1471 public: 1472 ZipArchiveCache() {} 1473 ~ZipArchiveCache(); 1474 1475 bool get_or_open(const char* zip_path, ZipArchiveHandle* handle); 1476 private: 1477 DISALLOW_COPY_AND_ASSIGN(ZipArchiveCache); 1478 1479 std::unordered_map<std::string, ZipArchiveHandle> cache_; 1480}; 1481 1482bool ZipArchiveCache::get_or_open(const char* zip_path, ZipArchiveHandle* handle) { 1483 std::string key(zip_path); 1484 1485 auto it = cache_.find(key); 1486 if (it != cache_.end()) { 1487 *handle = it->second; 1488 return true; 1489 } 1490 1491 int fd = TEMP_FAILURE_RETRY(open(zip_path, O_RDONLY | O_CLOEXEC)); 1492 if (fd == -1) { 1493 return false; 1494 } 1495 1496 if (OpenArchiveFd(fd, "", handle) != 0) { 1497 // invalid zip-file (?) 1498 close(fd); 1499 return false; 1500 } 1501 1502 cache_[key] = *handle; 1503 return true; 1504} 1505 1506ZipArchiveCache::~ZipArchiveCache() { 1507 for (const auto& it : cache_) { 1508 CloseArchive(it.second); 1509 } 1510} 1511 1512static int open_library_in_zipfile(ZipArchiveCache* zip_archive_cache, 1513 const char* const input_path, 1514 off64_t* file_offset, std::string* realpath) { 1515 std::string normalized_path; 1516 if (!normalize_path(input_path, &normalized_path)) { 1517 return -1; 1518 } 1519 1520 const char* const path = normalized_path.c_str(); 1521 TRACE("Trying zip file open from path '%s' -> normalized '%s'", input_path, path); 1522 1523 // Treat an '!/' separator inside a path as the separator between the name 1524 // of the zip file on disk and the subdirectory to search within it. 1525 // For example, if path is "foo.zip!/bar/bas/x.so", then we search for 1526 // "bar/bas/x.so" within "foo.zip". 1527 const char* const separator = strstr(path, kZipFileSeparator); 1528 if (separator == nullptr) { 1529 return -1; 1530 } 1531 1532 char buf[512]; 1533 if (strlcpy(buf, path, sizeof(buf)) >= sizeof(buf)) { 1534 PRINT("Warning: ignoring very long library path: %s", path); 1535 return -1; 1536 } 1537 1538 buf[separator - path] = '\0'; 1539 1540 const char* zip_path = buf; 1541 const char* file_path = &buf[separator - path + 2]; 1542 int fd = TEMP_FAILURE_RETRY(open(zip_path, O_RDONLY | O_CLOEXEC)); 1543 if (fd == -1) { 1544 return -1; 1545 } 1546 1547 ZipArchiveHandle handle; 1548 if (!zip_archive_cache->get_or_open(zip_path, &handle)) { 1549 // invalid zip-file (?) 1550 close(fd); 1551 return -1; 1552 } 1553 1554 ZipEntry entry; 1555 1556 if (FindEntry(handle, ZipString(file_path), &entry) != 0) { 1557 // Entry was not found. 1558 close(fd); 1559 return -1; 1560 } 1561 1562 // Check if it is properly stored 1563 if (entry.method != kCompressStored || (entry.offset % PAGE_SIZE) != 0) { 1564 close(fd); 1565 return -1; 1566 } 1567 1568 *file_offset = entry.offset; 1569 1570 if (realpath_fd(fd, realpath)) { 1571 *realpath += separator; 1572 } else { 1573 PRINT("warning: unable to get realpath for the library \"%s\". Will use given path.", 1574 normalized_path.c_str()); 1575 *realpath = normalized_path; 1576 } 1577 1578 return fd; 1579} 1580 1581static bool format_path(char* buf, size_t buf_size, const char* path, const char* name) { 1582 int n = __libc_format_buffer(buf, buf_size, "%s/%s", path, name); 1583 if (n < 0 || n >= static_cast<int>(buf_size)) { 1584 PRINT("Warning: ignoring very long library path: %s/%s", path, name); 1585 return false; 1586 } 1587 1588 return true; 1589} 1590 1591static int open_library_on_paths(ZipArchiveCache* zip_archive_cache, 1592 const char* name, off64_t* file_offset, 1593 const std::vector<std::string>& paths, 1594 std::string* realpath) { 1595 for (const auto& path : paths) { 1596 char buf[512]; 1597 if (!format_path(buf, sizeof(buf), path.c_str(), name)) { 1598 continue; 1599 } 1600 1601 int fd = -1; 1602 if (strstr(buf, kZipFileSeparator) != nullptr) { 1603 fd = open_library_in_zipfile(zip_archive_cache, buf, file_offset, realpath); 1604 } 1605 1606 if (fd == -1) { 1607 fd = TEMP_FAILURE_RETRY(open(buf, O_RDONLY | O_CLOEXEC)); 1608 if (fd != -1) { 1609 *file_offset = 0; 1610 if (!realpath_fd(fd, realpath)) { 1611 PRINT("warning: unable to get realpath for the library \"%s\". Will use given path.", buf); 1612 *realpath = buf; 1613 } 1614 } 1615 } 1616 1617 if (fd != -1) { 1618 return fd; 1619 } 1620 } 1621 1622 return -1; 1623} 1624 1625static int open_library(android_namespace_t* ns, 1626 ZipArchiveCache* zip_archive_cache, 1627 const char* name, soinfo *needed_by, 1628 off64_t* file_offset, std::string* realpath) { 1629 TRACE("[ opening %s ]", name); 1630 1631 // If the name contains a slash, we should attempt to open it directly and not search the paths. 1632 if (strchr(name, '/') != nullptr) { 1633 int fd = -1; 1634 1635 if (strstr(name, kZipFileSeparator) != nullptr) { 1636 fd = open_library_in_zipfile(zip_archive_cache, name, file_offset, realpath); 1637 } 1638 1639 if (fd == -1) { 1640 fd = TEMP_FAILURE_RETRY(open(name, O_RDONLY | O_CLOEXEC)); 1641 if (fd != -1) { 1642 *file_offset = 0; 1643 if (!realpath_fd(fd, realpath)) { 1644 PRINT("warning: unable to get realpath for the library \"%s\". Will use given path.", name); 1645 *realpath = name; 1646 } 1647 } 1648 } 1649 1650 return fd; 1651 } 1652 1653 // Otherwise we try LD_LIBRARY_PATH first, and fall back to the default library path 1654 int fd = open_library_on_paths(zip_archive_cache, name, file_offset, ns->get_ld_library_paths(), realpath); 1655 if (fd == -1 && needed_by != nullptr) { 1656 fd = open_library_on_paths(zip_archive_cache, name, file_offset, needed_by->get_dt_runpath(), realpath); 1657 // Check if the library is accessible 1658 if (fd != -1 && !ns->is_accessible(*realpath)) { 1659 fd = -1; 1660 } 1661 } 1662 1663 if (fd == -1) { 1664 fd = open_library_on_paths(zip_archive_cache, name, file_offset, ns->get_default_library_paths(), realpath); 1665 } 1666 1667 // TODO(dimitry): workaround for http://b/26394120 - will be removed before the release 1668 if (fd == -1 && ns != &g_default_namespace && is_greylisted(name)) { 1669 // try searching for it on default_namespace default_library_path 1670 fd = open_library_on_paths(zip_archive_cache, name, file_offset, 1671 g_default_namespace.get_default_library_paths(), realpath); 1672 } 1673 // END OF WORKAROUND 1674 1675 return fd; 1676} 1677 1678static const char* fix_dt_needed(const char* dt_needed, const char* sopath __unused) { 1679#if !defined(__LP64__) 1680 // Work around incorrect DT_NEEDED entries for old apps: http://b/21364029 1681 if (get_application_target_sdk_version() <= 22) { 1682 const char* bname = basename(dt_needed); 1683 if (bname != dt_needed) { 1684 DL_WARN("'%s' library has invalid DT_NEEDED entry '%s'", sopath, dt_needed); 1685 } 1686 1687 return bname; 1688 } 1689#endif 1690 return dt_needed; 1691} 1692 1693template<typename F> 1694static void for_each_dt_needed(const soinfo* si, F action) { 1695 for (const ElfW(Dyn)* d = si->dynamic; d->d_tag != DT_NULL; ++d) { 1696 if (d->d_tag == DT_NEEDED) { 1697 action(fix_dt_needed(si->get_string(d->d_un.d_val), si->get_realpath())); 1698 } 1699 } 1700} 1701 1702template<typename F> 1703static void for_each_dt_needed(const ElfReader& elf_reader, F action) { 1704 for (const ElfW(Dyn)* d = elf_reader.dynamic(); d->d_tag != DT_NULL; ++d) { 1705 if (d->d_tag == DT_NEEDED) { 1706 action(fix_dt_needed(elf_reader.get_string(d->d_un.d_val), elf_reader.name())); 1707 } 1708 } 1709} 1710 1711static bool load_library(android_namespace_t* ns, 1712 LoadTask* task, 1713 LoadTaskList* load_tasks, 1714 int rtld_flags, 1715 const std::string& realpath) { 1716 off64_t file_offset = task->get_file_offset(); 1717 const char* name = task->get_name(); 1718 const android_dlextinfo* extinfo = task->get_extinfo(); 1719 1720 if ((file_offset % PAGE_SIZE) != 0) { 1721 DL_ERR("file offset for the library \"%s\" is not page-aligned: %" PRId64, name, file_offset); 1722 return false; 1723 } 1724 if (file_offset < 0) { 1725 DL_ERR("file offset for the library \"%s\" is negative: %" PRId64, name, file_offset); 1726 return false; 1727 } 1728 1729 struct stat file_stat; 1730 if (TEMP_FAILURE_RETRY(fstat(task->get_fd(), &file_stat)) != 0) { 1731 DL_ERR("unable to stat file for the library \"%s\": %s", name, strerror(errno)); 1732 return false; 1733 } 1734 if (file_offset >= file_stat.st_size) { 1735 DL_ERR("file offset for the library \"%s\" >= file size: %" PRId64 " >= %" PRId64, 1736 name, file_offset, file_stat.st_size); 1737 return false; 1738 } 1739 1740 // Check for symlink and other situations where 1741 // file can have different names, unless ANDROID_DLEXT_FORCE_LOAD is set 1742 if (extinfo == nullptr || (extinfo->flags & ANDROID_DLEXT_FORCE_LOAD) == 0) { 1743 auto predicate = [&](soinfo* si) { 1744 return si->get_st_dev() != 0 && 1745 si->get_st_ino() != 0 && 1746 si->get_st_dev() == file_stat.st_dev && 1747 si->get_st_ino() == file_stat.st_ino && 1748 si->get_file_offset() == file_offset; 1749 }; 1750 1751 soinfo* si = ns->soinfo_list().find_if(predicate); 1752 1753 // check public namespace 1754 if (si == nullptr) { 1755 si = g_public_namespace.find_if(predicate); 1756 if (si != nullptr) { 1757 ns->soinfo_list().push_back(si); 1758 } 1759 } 1760 1761 if (si != nullptr) { 1762 TRACE("library \"%s\" is already loaded under different name/path \"%s\" - " 1763 "will return existing soinfo", name, si->get_realpath()); 1764 task->set_soinfo(si); 1765 return true; 1766 } 1767 } 1768 1769 if ((rtld_flags & RTLD_NOLOAD) != 0) { 1770 DL_ERR("library \"%s\" wasn't loaded and RTLD_NOLOAD prevented it", name); 1771 return false; 1772 } 1773 1774 if (!ns->is_accessible(realpath)) { 1775 // TODO(dimitry): workaround for http://b/26394120 - will be removed before the release 1776 if (is_greylisted(name)) { 1777 DL_WARN("library \"%s\" (\"%s\") is not accessible for the namespace \"%s\" - the access is temporarily granted as a workaround for http://b/26394120", 1778 name, realpath.c_str(), ns->get_name()); 1779 } else { 1780 // do not load libraries if they are not accessible for the specified namespace. 1781 DL_ERR("library \"%s\" is not accessible for the namespace \"%s\"", 1782 name, ns->get_name()); 1783 return false; 1784 } 1785 } 1786 1787 soinfo* si = soinfo_alloc(ns, realpath.c_str(), &file_stat, file_offset, rtld_flags); 1788 if (si == nullptr) { 1789 return false; 1790 } 1791 1792 task->set_soinfo(si); 1793 1794 // Read the ELF header and some of the segments. 1795 if (!task->read(realpath.c_str(), file_stat.st_size)) { 1796 soinfo_free(si); 1797 task->set_soinfo(nullptr); 1798 return false; 1799 } 1800 1801 // find and set DT_RUNPATH and dt_soname 1802 // Note that these field values are temporary and are 1803 // going to be overwritten on soinfo::prelink_image 1804 // with values from PT_LOAD segments. 1805 const ElfReader& elf_reader = task->get_elf_reader(); 1806 for (const ElfW(Dyn)* d = elf_reader.dynamic(); d->d_tag != DT_NULL; ++d) { 1807 if (d->d_tag == DT_RUNPATH) { 1808 si->set_dt_runpath(elf_reader.get_string(d->d_un.d_val)); 1809 } 1810 if (d->d_tag == DT_SONAME) { 1811 si->set_soname(elf_reader.get_string(d->d_un.d_val)); 1812 } 1813 } 1814 1815 for_each_dt_needed(task->get_elf_reader(), [&](const char* name) { 1816 load_tasks->push_back(LoadTask::create(name, si, task->get_readers_map())); 1817 }); 1818 1819 return true; 1820} 1821 1822static bool load_library(android_namespace_t* ns, 1823 LoadTask* task, 1824 ZipArchiveCache* zip_archive_cache, 1825 LoadTaskList* load_tasks, 1826 int rtld_flags) { 1827 const char* name = task->get_name(); 1828 soinfo* needed_by = task->get_needed_by(); 1829 const android_dlextinfo* extinfo = task->get_extinfo(); 1830 1831 off64_t file_offset; 1832 std::string realpath; 1833 if (extinfo != nullptr && (extinfo->flags & ANDROID_DLEXT_USE_LIBRARY_FD) != 0) { 1834 file_offset = 0; 1835 if ((extinfo->flags & ANDROID_DLEXT_USE_LIBRARY_FD_OFFSET) != 0) { 1836 file_offset = extinfo->library_fd_offset; 1837 } 1838 1839 if (!realpath_fd(extinfo->library_fd, &realpath)) { 1840 PRINT("warning: unable to get realpath for the library \"%s\" by extinfo->library_fd. " 1841 "Will use given name.", name); 1842 realpath = name; 1843 } 1844 1845 task->set_fd(extinfo->library_fd, false); 1846 task->set_file_offset(file_offset); 1847 return load_library(ns, task, load_tasks, rtld_flags, realpath); 1848 } 1849 1850 // Open the file. 1851 int fd = open_library(ns, zip_archive_cache, name, needed_by, &file_offset, &realpath); 1852 if (fd == -1) { 1853 DL_ERR("library \"%s\" not found", name); 1854 return false; 1855 } 1856 1857 task->set_fd(fd, true); 1858 task->set_file_offset(file_offset); 1859 1860 return load_library(ns, task, load_tasks, rtld_flags, realpath); 1861} 1862 1863// Returns true if library was found and false in 2 cases 1864// 1. (for default namespace only) The library was found but loaded under different 1865// target_sdk_version (*candidate != nullptr) 1866// 2. The library was not found by soname (*candidate is nullptr) 1867static bool find_loaded_library_by_soname(android_namespace_t* ns, 1868 const char* name, soinfo** candidate) { 1869 *candidate = nullptr; 1870 1871 // Ignore filename with path. 1872 if (strchr(name, '/') != nullptr) { 1873 return false; 1874 } 1875 1876 uint32_t target_sdk_version = get_application_target_sdk_version(); 1877 1878 return !ns->soinfo_list().visit([&](soinfo* si) { 1879 const char* soname = si->get_soname(); 1880 if (soname != nullptr && (strcmp(name, soname) == 0)) { 1881 // If the library was opened under different target sdk version 1882 // skip this step and try to reopen it. The exceptions are 1883 // "libdl.so" and global group. There is no point in skipping 1884 // them because relocation process is going to use them 1885 // in any case. 1886 bool is_libdl = si == solist; 1887 if (is_libdl || (si->get_dt_flags_1() & DF_1_GLOBAL) != 0 || 1888 !si->is_linked() || si->get_target_sdk_version() == target_sdk_version || 1889 ns != &g_default_namespace) { 1890 *candidate = si; 1891 return false; 1892 } else if (*candidate == nullptr) { 1893 // for the different sdk version in the default namespace 1894 // remember the first library. 1895 *candidate = si; 1896 } 1897 } 1898 1899 return true; 1900 }); 1901} 1902 1903static bool find_library_internal(android_namespace_t* ns, 1904 LoadTask* task, 1905 ZipArchiveCache* zip_archive_cache, 1906 LoadTaskList* load_tasks, 1907 int rtld_flags) { 1908 soinfo* candidate; 1909 1910 if (find_loaded_library_by_soname(ns, task->get_name(), &candidate)) { 1911 task->set_soinfo(candidate); 1912 return true; 1913 } 1914 1915 if (ns != &g_default_namespace) { 1916 // check public namespace 1917 candidate = g_public_namespace.find_if([&](soinfo* si) { 1918 return strcmp(task->get_name(), si->get_soname()) == 0; 1919 }); 1920 1921 if (candidate != nullptr) { 1922 ns->soinfo_list().push_back(candidate); 1923 task->set_soinfo(candidate); 1924 return true; 1925 } 1926 } 1927 1928 // Library might still be loaded, the accurate detection 1929 // of this fact is done by load_library. 1930 TRACE("[ '%s' find_loaded_library_by_soname returned false (*candidate=%s@%p). Trying harder...]", 1931 task->get_name(), candidate == nullptr ? "n/a" : candidate->get_realpath(), candidate); 1932 1933 if (load_library(ns, task, zip_archive_cache, load_tasks, rtld_flags)) { 1934 return true; 1935 } else { 1936 // In case we were unable to load the library but there 1937 // is a candidate loaded under the same soname but different 1938 // sdk level - return it anyways. 1939 if (candidate != nullptr) { 1940 task->set_soinfo(candidate); 1941 return true; 1942 } 1943 } 1944 1945 return false; 1946} 1947 1948static void soinfo_unload(soinfo* si); 1949 1950// TODO: this is slightly unusual way to construct 1951// the global group for relocation. Not every RTLD_GLOBAL 1952// library is included in this group for backwards-compatibility 1953// reasons. 1954// 1955// This group consists of the main executable, LD_PRELOADs 1956// and libraries with the DF_1_GLOBAL flag set. 1957static soinfo::soinfo_list_t make_global_group(android_namespace_t* ns) { 1958 soinfo::soinfo_list_t global_group; 1959 ns->soinfo_list().for_each([&](soinfo* si) { 1960 if ((si->get_dt_flags_1() & DF_1_GLOBAL) != 0) { 1961 global_group.push_back(si); 1962 } 1963 }); 1964 1965 return global_group; 1966} 1967 1968static void shuffle(std::vector<LoadTask*>* v) { 1969 for (size_t i = 0, size = v->size(); i < size; ++i) { 1970 size_t n = size - i; 1971 size_t r = arc4random_uniform(n); 1972 std::swap((*v)[n-1], (*v)[r]); 1973 } 1974} 1975 1976// add_as_children - add first-level loaded libraries (i.e. library_names[], but 1977// not their transitive dependencies) as children of the start_with library. 1978// This is false when find_libraries is called for dlopen(), when newly loaded 1979// libraries must form a disjoint tree. 1980static bool find_libraries(android_namespace_t* ns, 1981 soinfo* start_with, 1982 const char* const library_names[], 1983 size_t library_names_count, soinfo* soinfos[], 1984 std::vector<soinfo*>* ld_preloads, 1985 size_t ld_preloads_count, int rtld_flags, 1986 const android_dlextinfo* extinfo, 1987 bool add_as_children) { 1988 // Step 0: prepare. 1989 LoadTaskList load_tasks; 1990 std::unordered_map<const soinfo*, ElfReader> readers_map; 1991 1992 for (size_t i = 0; i < library_names_count; ++i) { 1993 const char* name = library_names[i]; 1994 load_tasks.push_back(LoadTask::create(name, start_with, &readers_map)); 1995 } 1996 1997 // Construct global_group. 1998 soinfo::soinfo_list_t global_group = make_global_group(ns); 1999 2000 // If soinfos array is null allocate one on stack. 2001 // The array is needed in case of failure; for example 2002 // when library_names[] = {libone.so, libtwo.so} and libone.so 2003 // is loaded correctly but libtwo.so failed for some reason. 2004 // In this case libone.so should be unloaded on return. 2005 // See also implementation of failure_guard below. 2006 2007 if (soinfos == nullptr) { 2008 size_t soinfos_size = sizeof(soinfo*)*library_names_count; 2009 soinfos = reinterpret_cast<soinfo**>(alloca(soinfos_size)); 2010 memset(soinfos, 0, soinfos_size); 2011 } 2012 2013 // list of libraries to link - see step 2. 2014 size_t soinfos_count = 0; 2015 2016 auto scope_guard = make_scope_guard([&]() { 2017 for (LoadTask* t : load_tasks) { 2018 LoadTask::deleter(t); 2019 } 2020 }); 2021 2022 auto failure_guard = make_scope_guard([&]() { 2023 // Housekeeping 2024 for (size_t i = 0; i<soinfos_count; ++i) { 2025 soinfo_unload(soinfos[i]); 2026 } 2027 }); 2028 2029 ZipArchiveCache zip_archive_cache; 2030 2031 // Step 1: expand the list of load_tasks to include 2032 // all DT_NEEDED libraries (do not load them just yet) 2033 for (size_t i = 0; i<load_tasks.size(); ++i) { 2034 LoadTask* task = load_tasks[i]; 2035 soinfo* needed_by = task->get_needed_by(); 2036 2037 bool is_dt_needed = needed_by != nullptr && (needed_by != start_with || add_as_children); 2038 task->set_extinfo(is_dt_needed ? nullptr : extinfo); 2039 2040 if(!find_library_internal(ns, task, &zip_archive_cache, &load_tasks, rtld_flags)) { 2041 return false; 2042 } 2043 2044 soinfo* si = task->get_soinfo(); 2045 2046 if (is_dt_needed) { 2047 needed_by->add_child(si); 2048 } 2049 2050 if (si->is_linked()) { 2051 si->increment_ref_count(); 2052 } 2053 2054 // When ld_preloads is not null, the first 2055 // ld_preloads_count libs are in fact ld_preloads. 2056 if (ld_preloads != nullptr && soinfos_count < ld_preloads_count) { 2057 ld_preloads->push_back(si); 2058 } 2059 2060 if (soinfos_count < library_names_count) { 2061 soinfos[soinfos_count++] = si; 2062 } 2063 } 2064 2065 // Step 2: Load libraries in random order (see b/24047022) 2066 LoadTaskList load_list; 2067 for (auto&& task : load_tasks) { 2068 soinfo* si = task->get_soinfo(); 2069 auto pred = [&](const LoadTask* t) { 2070 return t->get_soinfo() == si; 2071 }; 2072 2073 if (!si->is_linked() && 2074 std::find_if(load_list.begin(), load_list.end(), pred) == load_list.end() ) { 2075 load_list.push_back(task); 2076 } 2077 } 2078 shuffle(&load_list); 2079 2080 for (auto&& task : load_list) { 2081 if (!task->load()) { 2082 return false; 2083 } 2084 } 2085 2086 // Step 3: pre-link all DT_NEEDED libraries in breadth first order. 2087 for (auto&& task : load_tasks) { 2088 soinfo* si = task->get_soinfo(); 2089 if (!si->is_linked() && !si->prelink_image()) { 2090 return false; 2091 } 2092 } 2093 2094 // Step 4: Add LD_PRELOADed libraries to the global group for 2095 // future runs. There is no need to explicitly add them to 2096 // the global group for this run because they are going to 2097 // appear in the local group in the correct order. 2098 if (ld_preloads != nullptr) { 2099 for (auto&& si : *ld_preloads) { 2100 si->set_dt_flags_1(si->get_dt_flags_1() | DF_1_GLOBAL); 2101 } 2102 } 2103 2104 2105 // Step 5: link libraries. 2106 soinfo::soinfo_list_t local_group; 2107 walk_dependencies_tree( 2108 (start_with != nullptr && add_as_children) ? &start_with : soinfos, 2109 (start_with != nullptr && add_as_children) ? 1 : soinfos_count, 2110 [&] (soinfo* si) { 2111 local_group.push_back(si); 2112 return true; 2113 }); 2114 2115 // We need to increment ref_count in case 2116 // the root of the local group was not linked. 2117 bool was_local_group_root_linked = local_group.front()->is_linked(); 2118 2119 bool linked = local_group.visit([&](soinfo* si) { 2120 if (!si->is_linked()) { 2121 if (!si->link_image(global_group, local_group, extinfo)) { 2122 return false; 2123 } 2124 si->set_linked(); 2125 } 2126 2127 return true; 2128 }); 2129 2130 if (linked) { 2131 failure_guard.disable(); 2132 } 2133 2134 if (!was_local_group_root_linked) { 2135 local_group.front()->increment_ref_count(); 2136 } 2137 2138 return linked; 2139} 2140 2141static soinfo* find_library(android_namespace_t* ns, 2142 const char* name, int rtld_flags, 2143 const android_dlextinfo* extinfo, 2144 soinfo* needed_by) { 2145 soinfo* si; 2146 2147 if (name == nullptr) { 2148 si = somain; 2149 } else if (!find_libraries(ns, needed_by, &name, 1, &si, nullptr, 0, rtld_flags, 2150 extinfo, /* add_as_children */ false)) { 2151 return nullptr; 2152 } 2153 2154 return si; 2155} 2156 2157static void soinfo_unload(soinfo* root) { 2158 // Note that the library can be loaded but not linked; 2159 // in which case there is no root but we still need 2160 // to walk the tree and unload soinfos involved. 2161 // 2162 // This happens on unsuccessful dlopen, when one of 2163 // the DT_NEEDED libraries could not be linked/found. 2164 if (root->is_linked()) { 2165 root = root->get_local_group_root(); 2166 } 2167 2168 if (!root->can_unload()) { 2169 TRACE("not unloading '%s' - the binary is flagged with NODELETE", root->get_realpath()); 2170 return; 2171 } 2172 2173 size_t ref_count = root->is_linked() ? root->decrement_ref_count() : 0; 2174 2175 if (ref_count == 0) { 2176 soinfo::soinfo_list_t local_unload_list; 2177 soinfo::soinfo_list_t external_unload_list; 2178 soinfo::soinfo_list_t depth_first_list; 2179 depth_first_list.push_back(root); 2180 soinfo* si = nullptr; 2181 2182 while ((si = depth_first_list.pop_front()) != nullptr) { 2183 if (local_unload_list.contains(si)) { 2184 continue; 2185 } 2186 2187 local_unload_list.push_back(si); 2188 2189 if (si->has_min_version(0)) { 2190 soinfo* child = nullptr; 2191 while ((child = si->get_children().pop_front()) != nullptr) { 2192 TRACE("%s@%p needs to unload %s@%p", si->get_realpath(), si, 2193 child->get_realpath(), child); 2194 2195 if (local_unload_list.contains(child)) { 2196 continue; 2197 } else if (child->is_linked() && child->get_local_group_root() != root) { 2198 external_unload_list.push_back(child); 2199 } else { 2200 depth_first_list.push_front(child); 2201 } 2202 } 2203 } else { 2204#if !defined(__work_around_b_24465209__) 2205 __libc_fatal("soinfo for \"%s\"@%p has no version", si->get_realpath(), si); 2206#else 2207 PRINT("warning: soinfo for \"%s\"@%p has no version", si->get_realpath(), si); 2208 for_each_dt_needed(si, [&] (const char* library_name) { 2209 TRACE("deprecated (old format of soinfo): %s needs to unload %s", 2210 si->get_realpath(), library_name); 2211 2212 soinfo* needed = find_library(si->get_namespace(), 2213 library_name, RTLD_NOLOAD, nullptr, nullptr); 2214 2215 if (needed != nullptr) { 2216 // Not found: for example if symlink was deleted between dlopen and dlclose 2217 // Since we cannot really handle errors at this point - print and continue. 2218 PRINT("warning: couldn't find %s needed by %s on unload.", 2219 library_name, si->get_realpath()); 2220 return; 2221 } else if (local_unload_list.contains(needed)) { 2222 // already visited 2223 return; 2224 } else if (needed->is_linked() && needed->get_local_group_root() != root) { 2225 // external group 2226 external_unload_list.push_back(needed); 2227 } else { 2228 // local group 2229 depth_first_list.push_front(needed); 2230 } 2231 }); 2232#endif 2233 } 2234 } 2235 2236 local_unload_list.for_each([](soinfo* si) { 2237 si->call_destructors(); 2238 }); 2239 2240 while ((si = local_unload_list.pop_front()) != nullptr) { 2241 notify_gdb_of_unload(si); 2242 soinfo_free(si); 2243 } 2244 2245 while ((si = external_unload_list.pop_front()) != nullptr) { 2246 soinfo_unload(si); 2247 } 2248 } else { 2249 TRACE("not unloading '%s' group, decrementing ref_count to %zd", 2250 root->get_realpath(), ref_count); 2251 } 2252} 2253 2254static std::string symbol_display_name(const char* sym_name, const char* sym_ver) { 2255 if (sym_ver == nullptr) { 2256 return sym_name; 2257 } 2258 2259 return std::string(sym_name) + ", version " + sym_ver; 2260} 2261 2262void do_android_get_LD_LIBRARY_PATH(char* buffer, size_t buffer_size) { 2263 // Use basic string manipulation calls to avoid snprintf. 2264 // snprintf indirectly calls pthread_getspecific to get the size of a buffer. 2265 // When debug malloc is enabled, this call returns 0. This in turn causes 2266 // snprintf to do nothing, which causes libraries to fail to load. 2267 // See b/17302493 for further details. 2268 // Once the above bug is fixed, this code can be modified to use 2269 // snprintf again. 2270 size_t required_len = 0; 2271 for (size_t i = 0; g_default_ld_paths[i] != nullptr; ++i) { 2272 required_len += strlen(g_default_ld_paths[i]) + 1; 2273 } 2274 if (buffer_size < required_len) { 2275 __libc_fatal("android_get_LD_LIBRARY_PATH failed, buffer too small: " 2276 "buffer len %zu, required len %zu", buffer_size, required_len); 2277 } 2278 char* end = buffer; 2279 for (size_t i = 0; g_default_ld_paths[i] != nullptr; ++i) { 2280 if (i > 0) *end++ = ':'; 2281 end = stpcpy(end, g_default_ld_paths[i]); 2282 } 2283} 2284 2285void do_android_update_LD_LIBRARY_PATH(const char* ld_library_path) { 2286 parse_LD_LIBRARY_PATH(ld_library_path); 2287} 2288 2289soinfo* do_dlopen(const char* name, int flags, const android_dlextinfo* extinfo, 2290 void* caller_addr) { 2291 soinfo* const caller = find_containing_library(caller_addr); 2292 2293 if ((flags & ~(RTLD_NOW|RTLD_LAZY|RTLD_LOCAL|RTLD_GLOBAL|RTLD_NODELETE|RTLD_NOLOAD)) != 0) { 2294 DL_ERR("invalid flags to dlopen: %x", flags); 2295 return nullptr; 2296 } 2297 2298 android_namespace_t* ns = caller != nullptr ? caller->get_namespace() : g_anonymous_namespace; 2299 2300 if (extinfo != nullptr) { 2301 if ((extinfo->flags & ~(ANDROID_DLEXT_VALID_FLAG_BITS)) != 0) { 2302 DL_ERR("invalid extended flags to android_dlopen_ext: 0x%" PRIx64, extinfo->flags); 2303 return nullptr; 2304 } 2305 2306 if ((extinfo->flags & ANDROID_DLEXT_USE_LIBRARY_FD) == 0 && 2307 (extinfo->flags & ANDROID_DLEXT_USE_LIBRARY_FD_OFFSET) != 0) { 2308 DL_ERR("invalid extended flag combination (ANDROID_DLEXT_USE_LIBRARY_FD_OFFSET without " 2309 "ANDROID_DLEXT_USE_LIBRARY_FD): 0x%" PRIx64, extinfo->flags); 2310 return nullptr; 2311 } 2312 2313 if ((extinfo->flags & ANDROID_DLEXT_LOAD_AT_FIXED_ADDRESS) != 0 && 2314 (extinfo->flags & (ANDROID_DLEXT_RESERVED_ADDRESS | ANDROID_DLEXT_RESERVED_ADDRESS_HINT)) != 0) { 2315 DL_ERR("invalid extended flag combination: ANDROID_DLEXT_LOAD_AT_FIXED_ADDRESS is not " 2316 "compatible with ANDROID_DLEXT_RESERVED_ADDRESS/ANDROID_DLEXT_RESERVED_ADDRESS_HINT"); 2317 return nullptr; 2318 } 2319 2320 if ((extinfo->flags & ANDROID_DLEXT_USE_NAMESPACE) != 0) { 2321 if (extinfo->library_namespace == nullptr) { 2322 DL_ERR("ANDROID_DLEXT_USE_NAMESPACE is set but extinfo->library_namespace is null"); 2323 return nullptr; 2324 } 2325 ns = extinfo->library_namespace; 2326 } 2327 } 2328 2329 ProtectedDataGuard guard; 2330 soinfo* si = find_library(ns, name, flags, extinfo, caller); 2331 if (si != nullptr) { 2332 si->call_constructors(); 2333 } 2334 2335 return si; 2336} 2337 2338int do_dladdr(const void* addr, Dl_info* info) { 2339 // Determine if this address can be found in any library currently mapped. 2340 soinfo* si = find_containing_library(addr); 2341 if (si == nullptr) { 2342 return 0; 2343 } 2344 2345 memset(info, 0, sizeof(Dl_info)); 2346 2347 info->dli_fname = si->get_realpath(); 2348 // Address at which the shared object is loaded. 2349 info->dli_fbase = reinterpret_cast<void*>(si->base); 2350 2351 // Determine if any symbol in the library contains the specified address. 2352 ElfW(Sym)* sym = si->find_symbol_by_address(addr); 2353 if (sym != nullptr) { 2354 info->dli_sname = si->get_string(sym->st_name); 2355 info->dli_saddr = reinterpret_cast<void*>(si->resolve_symbol_address(sym)); 2356 } 2357 2358 return 1; 2359} 2360 2361bool do_dlsym(void* handle, const char* sym_name, const char* sym_ver, 2362 void* caller_addr, void** symbol) { 2363#if !defined(__LP64__) 2364 if (handle == nullptr) { 2365 DL_ERR("dlsym failed: library handle is null"); 2366 return false; 2367 } 2368#endif 2369 2370 if (sym_name == nullptr) { 2371 DL_ERR("dlsym failed: symbol name is null"); 2372 return false; 2373 } 2374 2375 soinfo* found = nullptr; 2376 const ElfW(Sym)* sym = nullptr; 2377 soinfo* caller = find_containing_library(caller_addr); 2378 android_namespace_t* ns = caller != nullptr ? caller->get_namespace() : g_anonymous_namespace; 2379 2380 version_info vi_instance; 2381 version_info* vi = nullptr; 2382 2383 if (sym_ver != nullptr) { 2384 vi_instance.name = sym_ver; 2385 vi_instance.elf_hash = calculate_elf_hash(sym_ver); 2386 vi = &vi_instance; 2387 } 2388 2389 if (handle == RTLD_DEFAULT || handle == RTLD_NEXT) { 2390 sym = dlsym_linear_lookup(ns, sym_name, vi, &found, caller, handle); 2391 } else { 2392 sym = dlsym_handle_lookup(reinterpret_cast<soinfo*>(handle), &found, sym_name, vi); 2393 } 2394 2395 if (sym != nullptr) { 2396 uint32_t bind = ELF_ST_BIND(sym->st_info); 2397 2398 if ((bind == STB_GLOBAL || bind == STB_WEAK) && sym->st_shndx != 0) { 2399 *symbol = reinterpret_cast<void*>(found->resolve_symbol_address(sym)); 2400 return true; 2401 } 2402 2403 DL_ERR("symbol \"%s\" found but not global", symbol_display_name(sym_name, sym_ver).c_str()); 2404 return false; 2405 } 2406 2407 DL_ERR("undefined symbol: %s", symbol_display_name(sym_name, sym_ver).c_str()); 2408 return false; 2409} 2410 2411void do_dlclose(soinfo* si) { 2412 ProtectedDataGuard guard; 2413 soinfo_unload(si); 2414} 2415 2416bool init_namespaces(const char* public_ns_sonames, const char* anon_ns_library_path) { 2417 CHECK(public_ns_sonames != nullptr); 2418 if (g_public_namespace_initialized) { 2419 DL_ERR("public namespace has already been initialized."); 2420 return false; 2421 } 2422 2423 std::vector<std::string> sonames = android::base::Split(public_ns_sonames, ":"); 2424 2425 ProtectedDataGuard guard; 2426 2427 auto failure_guard = make_scope_guard([&]() { 2428 g_public_namespace.clear(); 2429 }); 2430 2431 for (const auto& soname : sonames) { 2432 soinfo* candidate = nullptr; 2433 2434 find_loaded_library_by_soname(&g_default_namespace, soname.c_str(), &candidate); 2435 2436 if (candidate == nullptr) { 2437 DL_ERR("error initializing public namespace: \"%s\" was not found" 2438 " in the default namespace", soname.c_str()); 2439 return false; 2440 } 2441 2442 candidate->set_nodelete(); 2443 g_public_namespace.push_back(candidate); 2444 } 2445 2446 g_public_namespace_initialized = true; 2447 2448 // create anonymous namespace 2449 // When the caller is nullptr - create_namespace will take global group 2450 // from the anonymous namespace, which is fine because anonymous namespace 2451 // is still pointing to the default one. 2452 android_namespace_t* anon_ns = 2453 create_namespace(nullptr, "(anonymous)", nullptr, anon_ns_library_path, 2454 ANDROID_NAMESPACE_TYPE_REGULAR, nullptr); 2455 2456 if (anon_ns == nullptr) { 2457 g_public_namespace_initialized = false; 2458 return false; 2459 } 2460 g_anonymous_namespace = anon_ns; 2461 failure_guard.disable(); 2462 return true; 2463} 2464 2465android_namespace_t* create_namespace(const void* caller_addr, 2466 const char* name, 2467 const char* ld_library_path, 2468 const char* default_library_path, 2469 uint64_t type, 2470 const char* permitted_when_isolated_path) { 2471 if (!g_public_namespace_initialized) { 2472 DL_ERR("cannot create namespace: public namespace is not initialized."); 2473 return nullptr; 2474 } 2475 2476 soinfo* caller_soinfo = find_containing_library(caller_addr); 2477 2478 android_namespace_t* caller_ns = caller_soinfo != nullptr ? 2479 caller_soinfo->get_namespace() : 2480 g_anonymous_namespace; 2481 2482 ProtectedDataGuard guard; 2483 std::vector<std::string> ld_library_paths; 2484 std::vector<std::string> default_library_paths; 2485 std::vector<std::string> permitted_paths; 2486 2487 parse_path(ld_library_path, ":", &ld_library_paths); 2488 parse_path(default_library_path, ":", &default_library_paths); 2489 parse_path(permitted_when_isolated_path, ":", &permitted_paths); 2490 2491 android_namespace_t* ns = new (g_namespace_allocator.alloc()) android_namespace_t(); 2492 ns->set_name(name); 2493 ns->set_isolated((type & ANDROID_NAMESPACE_TYPE_ISOLATED) != 0); 2494 ns->set_ld_library_paths(std::move(ld_library_paths)); 2495 ns->set_default_library_paths(std::move(default_library_paths)); 2496 ns->set_permitted_paths(std::move(permitted_paths)); 2497 2498 if ((type & ANDROID_NAMESPACE_TYPE_SHARED) != 0) { 2499 // If shared - clone the caller namespace 2500 auto& soinfo_list = caller_ns->soinfo_list(); 2501 std::copy(soinfo_list.begin(), soinfo_list.end(), std::back_inserter(ns->soinfo_list())); 2502 } else { 2503 // If not shared - copy only the global group 2504 auto global_group = make_global_group(caller_ns); 2505 std::copy(global_group.begin(), global_group.end(), std::back_inserter(ns->soinfo_list())); 2506 } 2507 2508 return ns; 2509} 2510 2511static ElfW(Addr) call_ifunc_resolver(ElfW(Addr) resolver_addr) { 2512 typedef ElfW(Addr) (*ifunc_resolver_t)(void); 2513 ifunc_resolver_t ifunc_resolver = reinterpret_cast<ifunc_resolver_t>(resolver_addr); 2514 ElfW(Addr) ifunc_addr = ifunc_resolver(); 2515 TRACE_TYPE(RELO, "Called ifunc_resolver@%p. The result is %p", 2516 ifunc_resolver, reinterpret_cast<void*>(ifunc_addr)); 2517 2518 return ifunc_addr; 2519} 2520 2521const version_info* VersionTracker::get_version_info(ElfW(Versym) source_symver) const { 2522 if (source_symver < 2 || 2523 source_symver >= version_infos.size() || 2524 version_infos[source_symver].name == nullptr) { 2525 return nullptr; 2526 } 2527 2528 return &version_infos[source_symver]; 2529} 2530 2531void VersionTracker::add_version_info(size_t source_index, 2532 ElfW(Word) elf_hash, 2533 const char* ver_name, 2534 const soinfo* target_si) { 2535 if (source_index >= version_infos.size()) { 2536 version_infos.resize(source_index+1); 2537 } 2538 2539 version_infos[source_index].elf_hash = elf_hash; 2540 version_infos[source_index].name = ver_name; 2541 version_infos[source_index].target_si = target_si; 2542} 2543 2544bool VersionTracker::init_verneed(const soinfo* si_from) { 2545 uintptr_t verneed_ptr = si_from->get_verneed_ptr(); 2546 2547 if (verneed_ptr == 0) { 2548 return true; 2549 } 2550 2551 size_t verneed_cnt = si_from->get_verneed_cnt(); 2552 2553 for (size_t i = 0, offset = 0; i<verneed_cnt; ++i) { 2554 const ElfW(Verneed)* verneed = reinterpret_cast<ElfW(Verneed)*>(verneed_ptr + offset); 2555 size_t vernaux_offset = offset + verneed->vn_aux; 2556 offset += verneed->vn_next; 2557 2558 if (verneed->vn_version != 1) { 2559 DL_ERR("unsupported verneed[%zd] vn_version: %d (expected 1)", i, verneed->vn_version); 2560 return false; 2561 } 2562 2563 const char* target_soname = si_from->get_string(verneed->vn_file); 2564 // find it in dependencies 2565 soinfo* target_si = si_from->get_children().find_if([&](const soinfo* si) { 2566 return si->get_soname() != nullptr && strcmp(si->get_soname(), target_soname) == 0; 2567 }); 2568 2569 if (target_si == nullptr) { 2570 DL_ERR("cannot find \"%s\" from verneed[%zd] in DT_NEEDED list for \"%s\"", 2571 target_soname, i, si_from->get_realpath()); 2572 return false; 2573 } 2574 2575 for (size_t j = 0; j<verneed->vn_cnt; ++j) { 2576 const ElfW(Vernaux)* vernaux = reinterpret_cast<ElfW(Vernaux)*>(verneed_ptr + vernaux_offset); 2577 vernaux_offset += vernaux->vna_next; 2578 2579 const ElfW(Word) elf_hash = vernaux->vna_hash; 2580 const char* ver_name = si_from->get_string(vernaux->vna_name); 2581 ElfW(Half) source_index = vernaux->vna_other; 2582 2583 add_version_info(source_index, elf_hash, ver_name, target_si); 2584 } 2585 } 2586 2587 return true; 2588} 2589 2590bool VersionTracker::init_verdef(const soinfo* si_from) { 2591 return for_each_verdef(si_from, 2592 [&](size_t, const ElfW(Verdef)* verdef, const ElfW(Verdaux)* verdaux) { 2593 add_version_info(verdef->vd_ndx, verdef->vd_hash, 2594 si_from->get_string(verdaux->vda_name), si_from); 2595 return false; 2596 } 2597 ); 2598} 2599 2600bool VersionTracker::init(const soinfo* si_from) { 2601 if (!si_from->has_min_version(2)) { 2602 return true; 2603 } 2604 2605 return init_verneed(si_from) && init_verdef(si_from); 2606} 2607 2608bool soinfo::lookup_version_info(const VersionTracker& version_tracker, ElfW(Word) sym, 2609 const char* sym_name, const version_info** vi) { 2610 const ElfW(Versym)* sym_ver_ptr = get_versym(sym); 2611 ElfW(Versym) sym_ver = sym_ver_ptr == nullptr ? 0 : *sym_ver_ptr; 2612 2613 if (sym_ver != VER_NDX_LOCAL && sym_ver != VER_NDX_GLOBAL) { 2614 *vi = version_tracker.get_version_info(sym_ver); 2615 2616 if (*vi == nullptr) { 2617 DL_ERR("cannot find verneed/verdef for version index=%d " 2618 "referenced by symbol \"%s\" at \"%s\"", sym_ver, sym_name, get_realpath()); 2619 return false; 2620 } 2621 } else { 2622 // there is no version info 2623 *vi = nullptr; 2624 } 2625 2626 return true; 2627} 2628 2629#if !defined(__mips__) 2630#if defined(USE_RELA) 2631static ElfW(Addr) get_addend(ElfW(Rela)* rela, ElfW(Addr) reloc_addr __unused) { 2632 return rela->r_addend; 2633} 2634#else 2635static ElfW(Addr) get_addend(ElfW(Rel)* rel, ElfW(Addr) reloc_addr) { 2636 if (ELFW(R_TYPE)(rel->r_info) == R_GENERIC_RELATIVE || 2637 ELFW(R_TYPE)(rel->r_info) == R_GENERIC_IRELATIVE) { 2638 return *reinterpret_cast<ElfW(Addr)*>(reloc_addr); 2639 } 2640 return 0; 2641} 2642#endif 2643 2644template<typename ElfRelIteratorT> 2645bool soinfo::relocate(const VersionTracker& version_tracker, ElfRelIteratorT&& rel_iterator, 2646 const soinfo_list_t& global_group, const soinfo_list_t& local_group) { 2647 for (size_t idx = 0; rel_iterator.has_next(); ++idx) { 2648 const auto rel = rel_iterator.next(); 2649 if (rel == nullptr) { 2650 return false; 2651 } 2652 2653 ElfW(Word) type = ELFW(R_TYPE)(rel->r_info); 2654 ElfW(Word) sym = ELFW(R_SYM)(rel->r_info); 2655 2656 ElfW(Addr) reloc = static_cast<ElfW(Addr)>(rel->r_offset + load_bias); 2657 ElfW(Addr) sym_addr = 0; 2658 const char* sym_name = nullptr; 2659 ElfW(Addr) addend = get_addend(rel, reloc); 2660 2661 DEBUG("Processing '%s' relocation at index %zd", get_realpath(), idx); 2662 if (type == R_GENERIC_NONE) { 2663 continue; 2664 } 2665 2666 const ElfW(Sym)* s = nullptr; 2667 soinfo* lsi = nullptr; 2668 2669 if (sym != 0) { 2670 sym_name = get_string(symtab_[sym].st_name); 2671 const version_info* vi = nullptr; 2672 2673 if (!lookup_version_info(version_tracker, sym, sym_name, &vi)) { 2674 return false; 2675 } 2676 2677 if (!soinfo_do_lookup(this, sym_name, vi, &lsi, global_group, local_group, &s)) { 2678 return false; 2679 } 2680 2681 if (s == nullptr) { 2682 // We only allow an undefined symbol if this is a weak reference... 2683 s = &symtab_[sym]; 2684 if (ELF_ST_BIND(s->st_info) != STB_WEAK) { 2685 DL_ERR("cannot locate symbol \"%s\" referenced by \"%s\"...", sym_name, get_realpath()); 2686 return false; 2687 } 2688 2689 /* IHI0044C AAELF 4.5.1.1: 2690 2691 Libraries are not searched to resolve weak references. 2692 It is not an error for a weak reference to remain unsatisfied. 2693 2694 During linking, the value of an undefined weak reference is: 2695 - Zero if the relocation type is absolute 2696 - The address of the place if the relocation is pc-relative 2697 - The address of nominal base address if the relocation 2698 type is base-relative. 2699 */ 2700 2701 switch (type) { 2702 case R_GENERIC_JUMP_SLOT: 2703 case R_GENERIC_GLOB_DAT: 2704 case R_GENERIC_RELATIVE: 2705 case R_GENERIC_IRELATIVE: 2706#if defined(__aarch64__) 2707 case R_AARCH64_ABS64: 2708 case R_AARCH64_ABS32: 2709 case R_AARCH64_ABS16: 2710#elif defined(__x86_64__) 2711 case R_X86_64_32: 2712 case R_X86_64_64: 2713#elif defined(__arm__) 2714 case R_ARM_ABS32: 2715#elif defined(__i386__) 2716 case R_386_32: 2717#endif 2718 /* 2719 * The sym_addr was initialized to be zero above, or the relocation 2720 * code below does not care about value of sym_addr. 2721 * No need to do anything. 2722 */ 2723 break; 2724#if defined(__x86_64__) 2725 case R_X86_64_PC32: 2726 sym_addr = reloc; 2727 break; 2728#elif defined(__i386__) 2729 case R_386_PC32: 2730 sym_addr = reloc; 2731 break; 2732#endif 2733 default: 2734 DL_ERR("unknown weak reloc type %d @ %p (%zu)", type, rel, idx); 2735 return false; 2736 } 2737 } else { // We got a definition. 2738#if !defined(__LP64__) 2739 // When relocating dso with text_relocation .text segment is 2740 // not executable. We need to restore elf flags before resolving 2741 // STT_GNU_IFUNC symbol. 2742 bool protect_segments = has_text_relocations && 2743 lsi == this && 2744 ELF_ST_TYPE(s->st_info) == STT_GNU_IFUNC; 2745 if (protect_segments) { 2746 if (phdr_table_protect_segments(phdr, phnum, load_bias) < 0) { 2747 DL_ERR("can't protect segments for \"%s\": %s", 2748 get_realpath(), strerror(errno)); 2749 return false; 2750 } 2751 } 2752#endif 2753 sym_addr = lsi->resolve_symbol_address(s); 2754#if !defined(__LP64__) 2755 if (protect_segments) { 2756 if (phdr_table_unprotect_segments(phdr, phnum, load_bias) < 0) { 2757 DL_ERR("can't unprotect loadable segments for \"%s\": %s", 2758 get_realpath(), strerror(errno)); 2759 return false; 2760 } 2761 } 2762#endif 2763 } 2764 count_relocation(kRelocSymbol); 2765 } 2766 2767 switch (type) { 2768 case R_GENERIC_JUMP_SLOT: 2769 count_relocation(kRelocAbsolute); 2770 MARK(rel->r_offset); 2771 TRACE_TYPE(RELO, "RELO JMP_SLOT %16p <- %16p %s\n", 2772 reinterpret_cast<void*>(reloc), 2773 reinterpret_cast<void*>(sym_addr + addend), sym_name); 2774 2775 *reinterpret_cast<ElfW(Addr)*>(reloc) = (sym_addr + addend); 2776 break; 2777 case R_GENERIC_GLOB_DAT: 2778 count_relocation(kRelocAbsolute); 2779 MARK(rel->r_offset); 2780 TRACE_TYPE(RELO, "RELO GLOB_DAT %16p <- %16p %s\n", 2781 reinterpret_cast<void*>(reloc), 2782 reinterpret_cast<void*>(sym_addr + addend), sym_name); 2783 *reinterpret_cast<ElfW(Addr)*>(reloc) = (sym_addr + addend); 2784 break; 2785 case R_GENERIC_RELATIVE: 2786 count_relocation(kRelocRelative); 2787 MARK(rel->r_offset); 2788 TRACE_TYPE(RELO, "RELO RELATIVE %16p <- %16p\n", 2789 reinterpret_cast<void*>(reloc), 2790 reinterpret_cast<void*>(load_bias + addend)); 2791 *reinterpret_cast<ElfW(Addr)*>(reloc) = (load_bias + addend); 2792 break; 2793 case R_GENERIC_IRELATIVE: 2794 count_relocation(kRelocRelative); 2795 MARK(rel->r_offset); 2796 TRACE_TYPE(RELO, "RELO IRELATIVE %16p <- %16p\n", 2797 reinterpret_cast<void*>(reloc), 2798 reinterpret_cast<void*>(load_bias + addend)); 2799 { 2800#if !defined(__LP64__) 2801 // When relocating dso with text_relocation .text segment is 2802 // not executable. We need to restore elf flags for this 2803 // particular call. 2804 if (has_text_relocations) { 2805 if (phdr_table_protect_segments(phdr, phnum, load_bias) < 0) { 2806 DL_ERR("can't protect segments for \"%s\": %s", 2807 get_realpath(), strerror(errno)); 2808 return false; 2809 } 2810 } 2811#endif 2812 ElfW(Addr) ifunc_addr = call_ifunc_resolver(load_bias + addend); 2813#if !defined(__LP64__) 2814 // Unprotect it afterwards... 2815 if (has_text_relocations) { 2816 if (phdr_table_unprotect_segments(phdr, phnum, load_bias) < 0) { 2817 DL_ERR("can't unprotect loadable segments for \"%s\": %s", 2818 get_realpath(), strerror(errno)); 2819 return false; 2820 } 2821 } 2822#endif 2823 *reinterpret_cast<ElfW(Addr)*>(reloc) = ifunc_addr; 2824 } 2825 break; 2826 2827#if defined(__aarch64__) 2828 case R_AARCH64_ABS64: 2829 count_relocation(kRelocAbsolute); 2830 MARK(rel->r_offset); 2831 TRACE_TYPE(RELO, "RELO ABS64 %16llx <- %16llx %s\n", 2832 reloc, sym_addr + addend, sym_name); 2833 *reinterpret_cast<ElfW(Addr)*>(reloc) = sym_addr + addend; 2834 break; 2835 case R_AARCH64_ABS32: 2836 count_relocation(kRelocAbsolute); 2837 MARK(rel->r_offset); 2838 TRACE_TYPE(RELO, "RELO ABS32 %16llx <- %16llx %s\n", 2839 reloc, sym_addr + addend, sym_name); 2840 { 2841 const ElfW(Addr) min_value = static_cast<ElfW(Addr)>(INT32_MIN); 2842 const ElfW(Addr) max_value = static_cast<ElfW(Addr)>(UINT32_MAX); 2843 if ((min_value <= (sym_addr + addend)) && 2844 ((sym_addr + addend) <= max_value)) { 2845 *reinterpret_cast<ElfW(Addr)*>(reloc) = sym_addr + addend; 2846 } else { 2847 DL_ERR("0x%016llx out of range 0x%016llx to 0x%016llx", 2848 sym_addr + addend, min_value, max_value); 2849 return false; 2850 } 2851 } 2852 break; 2853 case R_AARCH64_ABS16: 2854 count_relocation(kRelocAbsolute); 2855 MARK(rel->r_offset); 2856 TRACE_TYPE(RELO, "RELO ABS16 %16llx <- %16llx %s\n", 2857 reloc, sym_addr + addend, sym_name); 2858 { 2859 const ElfW(Addr) min_value = static_cast<ElfW(Addr)>(INT16_MIN); 2860 const ElfW(Addr) max_value = static_cast<ElfW(Addr)>(UINT16_MAX); 2861 if ((min_value <= (sym_addr + addend)) && 2862 ((sym_addr + addend) <= max_value)) { 2863 *reinterpret_cast<ElfW(Addr)*>(reloc) = (sym_addr + addend); 2864 } else { 2865 DL_ERR("0x%016llx out of range 0x%016llx to 0x%016llx", 2866 sym_addr + addend, min_value, max_value); 2867 return false; 2868 } 2869 } 2870 break; 2871 case R_AARCH64_PREL64: 2872 count_relocation(kRelocRelative); 2873 MARK(rel->r_offset); 2874 TRACE_TYPE(RELO, "RELO REL64 %16llx <- %16llx - %16llx %s\n", 2875 reloc, sym_addr + addend, rel->r_offset, sym_name); 2876 *reinterpret_cast<ElfW(Addr)*>(reloc) = sym_addr + addend - rel->r_offset; 2877 break; 2878 case R_AARCH64_PREL32: 2879 count_relocation(kRelocRelative); 2880 MARK(rel->r_offset); 2881 TRACE_TYPE(RELO, "RELO REL32 %16llx <- %16llx - %16llx %s\n", 2882 reloc, sym_addr + addend, rel->r_offset, sym_name); 2883 { 2884 const ElfW(Addr) min_value = static_cast<ElfW(Addr)>(INT32_MIN); 2885 const ElfW(Addr) max_value = static_cast<ElfW(Addr)>(UINT32_MAX); 2886 if ((min_value <= (sym_addr + addend - rel->r_offset)) && 2887 ((sym_addr + addend - rel->r_offset) <= max_value)) { 2888 *reinterpret_cast<ElfW(Addr)*>(reloc) = sym_addr + addend - rel->r_offset; 2889 } else { 2890 DL_ERR("0x%016llx out of range 0x%016llx to 0x%016llx", 2891 sym_addr + addend - rel->r_offset, min_value, max_value); 2892 return false; 2893 } 2894 } 2895 break; 2896 case R_AARCH64_PREL16: 2897 count_relocation(kRelocRelative); 2898 MARK(rel->r_offset); 2899 TRACE_TYPE(RELO, "RELO REL16 %16llx <- %16llx - %16llx %s\n", 2900 reloc, sym_addr + addend, rel->r_offset, sym_name); 2901 { 2902 const ElfW(Addr) min_value = static_cast<ElfW(Addr)>(INT16_MIN); 2903 const ElfW(Addr) max_value = static_cast<ElfW(Addr)>(UINT16_MAX); 2904 if ((min_value <= (sym_addr + addend - rel->r_offset)) && 2905 ((sym_addr + addend - rel->r_offset) <= max_value)) { 2906 *reinterpret_cast<ElfW(Addr)*>(reloc) = sym_addr + addend - rel->r_offset; 2907 } else { 2908 DL_ERR("0x%016llx out of range 0x%016llx to 0x%016llx", 2909 sym_addr + addend - rel->r_offset, min_value, max_value); 2910 return false; 2911 } 2912 } 2913 break; 2914 2915 case R_AARCH64_COPY: 2916 /* 2917 * ET_EXEC is not supported so this should not happen. 2918 * 2919 * http://infocenter.arm.com/help/topic/com.arm.doc.ihi0056b/IHI0056B_aaelf64.pdf 2920 * 2921 * Section 4.6.11 "Dynamic relocations" 2922 * R_AARCH64_COPY may only appear in executable objects where e_type is 2923 * set to ET_EXEC. 2924 */ 2925 DL_ERR("%s R_AARCH64_COPY relocations are not supported", get_realpath()); 2926 return false; 2927 case R_AARCH64_TLS_TPREL64: 2928 TRACE_TYPE(RELO, "RELO TLS_TPREL64 *** %16llx <- %16llx - %16llx\n", 2929 reloc, (sym_addr + addend), rel->r_offset); 2930 break; 2931 case R_AARCH64_TLS_DTPREL32: 2932 TRACE_TYPE(RELO, "RELO TLS_DTPREL32 *** %16llx <- %16llx - %16llx\n", 2933 reloc, (sym_addr + addend), rel->r_offset); 2934 break; 2935#elif defined(__x86_64__) 2936 case R_X86_64_32: 2937 count_relocation(kRelocRelative); 2938 MARK(rel->r_offset); 2939 TRACE_TYPE(RELO, "RELO R_X86_64_32 %08zx <- +%08zx %s", static_cast<size_t>(reloc), 2940 static_cast<size_t>(sym_addr), sym_name); 2941 *reinterpret_cast<Elf32_Addr*>(reloc) = sym_addr + addend; 2942 break; 2943 case R_X86_64_64: 2944 count_relocation(kRelocRelative); 2945 MARK(rel->r_offset); 2946 TRACE_TYPE(RELO, "RELO R_X86_64_64 %08zx <- +%08zx %s", static_cast<size_t>(reloc), 2947 static_cast<size_t>(sym_addr), sym_name); 2948 *reinterpret_cast<Elf64_Addr*>(reloc) = sym_addr + addend; 2949 break; 2950 case R_X86_64_PC32: 2951 count_relocation(kRelocRelative); 2952 MARK(rel->r_offset); 2953 TRACE_TYPE(RELO, "RELO R_X86_64_PC32 %08zx <- +%08zx (%08zx - %08zx) %s", 2954 static_cast<size_t>(reloc), static_cast<size_t>(sym_addr - reloc), 2955 static_cast<size_t>(sym_addr), static_cast<size_t>(reloc), sym_name); 2956 *reinterpret_cast<Elf32_Addr*>(reloc) = sym_addr + addend - reloc; 2957 break; 2958#elif defined(__arm__) 2959 case R_ARM_ABS32: 2960 count_relocation(kRelocAbsolute); 2961 MARK(rel->r_offset); 2962 TRACE_TYPE(RELO, "RELO ABS %08x <- %08x %s", reloc, sym_addr, sym_name); 2963 *reinterpret_cast<ElfW(Addr)*>(reloc) += sym_addr; 2964 break; 2965 case R_ARM_REL32: 2966 count_relocation(kRelocRelative); 2967 MARK(rel->r_offset); 2968 TRACE_TYPE(RELO, "RELO REL32 %08x <- %08x - %08x %s", 2969 reloc, sym_addr, rel->r_offset, sym_name); 2970 *reinterpret_cast<ElfW(Addr)*>(reloc) += sym_addr - rel->r_offset; 2971 break; 2972 case R_ARM_COPY: 2973 /* 2974 * ET_EXEC is not supported so this should not happen. 2975 * 2976 * http://infocenter.arm.com/help/topic/com.arm.doc.ihi0044d/IHI0044D_aaelf.pdf 2977 * 2978 * Section 4.6.1.10 "Dynamic relocations" 2979 * R_ARM_COPY may only appear in executable objects where e_type is 2980 * set to ET_EXEC. 2981 */ 2982 DL_ERR("%s R_ARM_COPY relocations are not supported", get_realpath()); 2983 return false; 2984#elif defined(__i386__) 2985 case R_386_32: 2986 count_relocation(kRelocRelative); 2987 MARK(rel->r_offset); 2988 TRACE_TYPE(RELO, "RELO R_386_32 %08x <- +%08x %s", reloc, sym_addr, sym_name); 2989 *reinterpret_cast<ElfW(Addr)*>(reloc) += sym_addr; 2990 break; 2991 case R_386_PC32: 2992 count_relocation(kRelocRelative); 2993 MARK(rel->r_offset); 2994 TRACE_TYPE(RELO, "RELO R_386_PC32 %08x <- +%08x (%08x - %08x) %s", 2995 reloc, (sym_addr - reloc), sym_addr, reloc, sym_name); 2996 *reinterpret_cast<ElfW(Addr)*>(reloc) += (sym_addr - reloc); 2997 break; 2998#endif 2999 default: 3000 DL_ERR("unknown reloc type %d @ %p (%zu)", type, rel, idx); 3001 return false; 3002 } 3003 } 3004 return true; 3005} 3006#endif // !defined(__mips__) 3007 3008void soinfo::call_array(const char* array_name __unused, linker_function_t* functions, 3009 size_t count, bool reverse) { 3010 if (functions == nullptr) { 3011 return; 3012 } 3013 3014 TRACE("[ Calling %s (size %zd) @ %p for '%s' ]", array_name, count, functions, get_realpath()); 3015 3016 int begin = reverse ? (count - 1) : 0; 3017 int end = reverse ? -1 : count; 3018 int step = reverse ? -1 : 1; 3019 3020 for (int i = begin; i != end; i += step) { 3021 TRACE("[ %s[%d] == %p ]", array_name, i, functions[i]); 3022 call_function("function", functions[i]); 3023 } 3024 3025 TRACE("[ Done calling %s for '%s' ]", array_name, get_realpath()); 3026} 3027 3028void soinfo::call_function(const char* function_name __unused, linker_function_t function) { 3029 if (function == nullptr || reinterpret_cast<uintptr_t>(function) == static_cast<uintptr_t>(-1)) { 3030 return; 3031 } 3032 3033 TRACE("[ Calling %s @ %p for '%s' ]", function_name, function, get_realpath()); 3034 function(); 3035 TRACE("[ Done calling %s @ %p for '%s' ]", function_name, function, get_realpath()); 3036} 3037 3038void soinfo::call_pre_init_constructors() { 3039 // DT_PREINIT_ARRAY functions are called before any other constructors for executables, 3040 // but ignored in a shared library. 3041 call_array("DT_PREINIT_ARRAY", preinit_array_, preinit_array_count_, false); 3042} 3043 3044void soinfo::call_constructors() { 3045 if (constructors_called) { 3046 return; 3047 } 3048 3049 // We set constructors_called before actually calling the constructors, otherwise it doesn't 3050 // protect against recursive constructor calls. One simple example of constructor recursion 3051 // is the libc debug malloc, which is implemented in libc_malloc_debug_leak.so: 3052 // 1. The program depends on libc, so libc's constructor is called here. 3053 // 2. The libc constructor calls dlopen() to load libc_malloc_debug_leak.so. 3054 // 3. dlopen() calls the constructors on the newly created 3055 // soinfo for libc_malloc_debug_leak.so. 3056 // 4. The debug .so depends on libc, so CallConstructors is 3057 // called again with the libc soinfo. If it doesn't trigger the early- 3058 // out above, the libc constructor will be called again (recursively!). 3059 constructors_called = true; 3060 3061 if (!is_main_executable() && preinit_array_ != nullptr) { 3062 // The GNU dynamic linker silently ignores these, but we warn the developer. 3063 PRINT("\"%s\": ignoring %zd-entry DT_PREINIT_ARRAY in shared library!", 3064 get_realpath(), preinit_array_count_); 3065 } 3066 3067 get_children().for_each([] (soinfo* si) { 3068 si->call_constructors(); 3069 }); 3070 3071 TRACE("\"%s\": calling constructors", get_realpath()); 3072 3073 // DT_INIT should be called before DT_INIT_ARRAY if both are present. 3074 call_function("DT_INIT", init_func_); 3075 call_array("DT_INIT_ARRAY", init_array_, init_array_count_, false); 3076} 3077 3078void soinfo::call_destructors() { 3079 if (!constructors_called) { 3080 return; 3081 } 3082 TRACE("\"%s\": calling destructors", get_realpath()); 3083 3084 // DT_FINI_ARRAY must be parsed in reverse order. 3085 call_array("DT_FINI_ARRAY", fini_array_, fini_array_count_, true); 3086 3087 // DT_FINI should be called after DT_FINI_ARRAY if both are present. 3088 call_function("DT_FINI", fini_func_); 3089 3090 // This is needed on second call to dlopen 3091 // after library has been unloaded with RTLD_NODELETE 3092 constructors_called = false; 3093} 3094 3095void soinfo::add_child(soinfo* child) { 3096 if (has_min_version(0)) { 3097 child->parents_.push_back(this); 3098 this->children_.push_back(child); 3099 } 3100} 3101 3102void soinfo::remove_all_links() { 3103 if (!has_min_version(0)) { 3104 return; 3105 } 3106 3107 // 1. Untie connected soinfos from 'this'. 3108 children_.for_each([&] (soinfo* child) { 3109 child->parents_.remove_if([&] (const soinfo* parent) { 3110 return parent == this; 3111 }); 3112 }); 3113 3114 parents_.for_each([&] (soinfo* parent) { 3115 parent->children_.remove_if([&] (const soinfo* child) { 3116 return child == this; 3117 }); 3118 }); 3119 3120 // 2. Once everything untied - clear local lists. 3121 parents_.clear(); 3122 children_.clear(); 3123} 3124 3125dev_t soinfo::get_st_dev() const { 3126 if (has_min_version(0)) { 3127 return st_dev_; 3128 } 3129 3130 return 0; 3131}; 3132 3133ino_t soinfo::get_st_ino() const { 3134 if (has_min_version(0)) { 3135 return st_ino_; 3136 } 3137 3138 return 0; 3139} 3140 3141off64_t soinfo::get_file_offset() const { 3142 if (has_min_version(1)) { 3143 return file_offset_; 3144 } 3145 3146 return 0; 3147} 3148 3149uint32_t soinfo::get_rtld_flags() const { 3150 if (has_min_version(1)) { 3151 return rtld_flags_; 3152 } 3153 3154 return 0; 3155} 3156 3157uint32_t soinfo::get_dt_flags_1() const { 3158 if (has_min_version(1)) { 3159 return dt_flags_1_; 3160 } 3161 3162 return 0; 3163} 3164 3165void soinfo::set_dt_flags_1(uint32_t dt_flags_1) { 3166 if (has_min_version(1)) { 3167 if ((dt_flags_1 & DF_1_GLOBAL) != 0) { 3168 rtld_flags_ |= RTLD_GLOBAL; 3169 } 3170 3171 if ((dt_flags_1 & DF_1_NODELETE) != 0) { 3172 rtld_flags_ |= RTLD_NODELETE; 3173 } 3174 3175 dt_flags_1_ = dt_flags_1; 3176 } 3177} 3178 3179void soinfo::set_nodelete() { 3180 rtld_flags_ |= RTLD_NODELETE; 3181} 3182 3183const char* soinfo::get_realpath() const { 3184#if defined(__work_around_b_24465209__) 3185 if (has_min_version(2)) { 3186 return realpath_.c_str(); 3187 } else { 3188 return old_name_; 3189 } 3190#else 3191 return realpath_.c_str(); 3192#endif 3193} 3194 3195void soinfo::set_soname(const char* soname) { 3196#if defined(__work_around_b_24465209__) 3197 if (has_min_version(2)) { 3198 soname_ = soname; 3199 } 3200 strlcpy(old_name_, soname_, sizeof(old_name_)); 3201#else 3202 soname_ = soname; 3203#endif 3204} 3205 3206const char* soinfo::get_soname() const { 3207#if defined(__work_around_b_24465209__) 3208 if (has_min_version(2)) { 3209 return soname_; 3210 } else { 3211 return old_name_; 3212 } 3213#else 3214 return soname_; 3215#endif 3216} 3217 3218// This is a return on get_children()/get_parents() if 3219// 'this->flags' does not have FLAG_NEW_SOINFO set. 3220static soinfo::soinfo_list_t g_empty_list; 3221 3222soinfo::soinfo_list_t& soinfo::get_children() { 3223 if (has_min_version(0)) { 3224 return children_; 3225 } 3226 3227 return g_empty_list; 3228} 3229 3230const soinfo::soinfo_list_t& soinfo::get_children() const { 3231 if (has_min_version(0)) { 3232 return children_; 3233 } 3234 3235 return g_empty_list; 3236} 3237 3238soinfo::soinfo_list_t& soinfo::get_parents() { 3239 if (has_min_version(0)) { 3240 return parents_; 3241 } 3242 3243 return g_empty_list; 3244} 3245 3246static std::vector<std::string> g_empty_runpath; 3247 3248const std::vector<std::string>& soinfo::get_dt_runpath() const { 3249 if (has_min_version(3)) { 3250 return dt_runpath_; 3251 } 3252 3253 return g_empty_runpath; 3254} 3255 3256android_namespace_t* soinfo::get_namespace() { 3257 if (has_min_version(3)) { 3258 return namespace_; 3259 } 3260 3261 return &g_default_namespace; 3262} 3263 3264ElfW(Addr) soinfo::resolve_symbol_address(const ElfW(Sym)* s) const { 3265 if (ELF_ST_TYPE(s->st_info) == STT_GNU_IFUNC) { 3266 return call_ifunc_resolver(s->st_value + load_bias); 3267 } 3268 3269 return static_cast<ElfW(Addr)>(s->st_value + load_bias); 3270} 3271 3272const char* soinfo::get_string(ElfW(Word) index) const { 3273 if (has_min_version(1) && (index >= strtab_size_)) { 3274 __libc_fatal("%s: strtab out of bounds error; STRSZ=%zd, name=%d", 3275 get_realpath(), strtab_size_, index); 3276 } 3277 3278 return strtab_ + index; 3279} 3280 3281bool soinfo::is_gnu_hash() const { 3282 return (flags_ & FLAG_GNU_HASH) != 0; 3283} 3284 3285bool soinfo::can_unload() const { 3286 return (get_rtld_flags() & (RTLD_NODELETE | RTLD_GLOBAL)) == 0; 3287} 3288 3289bool soinfo::is_linked() const { 3290 return (flags_ & FLAG_LINKED) != 0; 3291} 3292 3293bool soinfo::is_main_executable() const { 3294 return (flags_ & FLAG_EXE) != 0; 3295} 3296 3297void soinfo::set_linked() { 3298 flags_ |= FLAG_LINKED; 3299} 3300 3301void soinfo::set_linker_flag() { 3302 flags_ |= FLAG_LINKER; 3303} 3304 3305void soinfo::set_main_executable() { 3306 flags_ |= FLAG_EXE; 3307} 3308 3309void soinfo::increment_ref_count() { 3310 local_group_root_->ref_count_++; 3311} 3312 3313size_t soinfo::decrement_ref_count() { 3314 return --local_group_root_->ref_count_; 3315} 3316 3317soinfo* soinfo::get_local_group_root() const { 3318 return local_group_root_; 3319} 3320 3321// This function returns api-level at the time of 3322// dlopen/load. Note that libraries opened by system 3323// will always have 'current' api level. 3324uint32_t soinfo::get_target_sdk_version() const { 3325 if (!has_min_version(2)) { 3326 return __ANDROID_API__; 3327 } 3328 3329 return local_group_root_->target_sdk_version_; 3330} 3331 3332bool soinfo::prelink_image() { 3333 /* Extract dynamic section */ 3334 ElfW(Word) dynamic_flags = 0; 3335 phdr_table_get_dynamic_section(phdr, phnum, load_bias, &dynamic, &dynamic_flags); 3336 3337 /* We can't log anything until the linker is relocated */ 3338 bool relocating_linker = (flags_ & FLAG_LINKER) != 0; 3339 if (!relocating_linker) { 3340 INFO("[ Linking '%s' ]", get_realpath()); 3341 DEBUG("si->base = %p si->flags = 0x%08x", reinterpret_cast<void*>(base), flags_); 3342 } 3343 3344 if (dynamic == nullptr) { 3345 if (!relocating_linker) { 3346 DL_ERR("missing PT_DYNAMIC in \"%s\"", get_realpath()); 3347 } 3348 return false; 3349 } else { 3350 if (!relocating_linker) { 3351 DEBUG("dynamic = %p", dynamic); 3352 } 3353 } 3354 3355#if defined(__arm__) 3356 (void) phdr_table_get_arm_exidx(phdr, phnum, load_bias, 3357 &ARM_exidx, &ARM_exidx_count); 3358#endif 3359 3360 // Extract useful information from dynamic section. 3361 // Note that: "Except for the DT_NULL element at the end of the array, 3362 // and the relative order of DT_NEEDED elements, entries may appear in any order." 3363 // 3364 // source: http://www.sco.com/developers/gabi/1998-04-29/ch5.dynamic.html 3365 uint32_t needed_count = 0; 3366 for (ElfW(Dyn)* d = dynamic; d->d_tag != DT_NULL; ++d) { 3367 DEBUG("d = %p, d[0](tag) = %p d[1](val) = %p", 3368 d, reinterpret_cast<void*>(d->d_tag), reinterpret_cast<void*>(d->d_un.d_val)); 3369 switch (d->d_tag) { 3370 case DT_SONAME: 3371 // this is parsed after we have strtab initialized (see below). 3372 break; 3373 3374 case DT_HASH: 3375 nbucket_ = reinterpret_cast<uint32_t*>(load_bias + d->d_un.d_ptr)[0]; 3376 nchain_ = reinterpret_cast<uint32_t*>(load_bias + d->d_un.d_ptr)[1]; 3377 bucket_ = reinterpret_cast<uint32_t*>(load_bias + d->d_un.d_ptr + 8); 3378 chain_ = reinterpret_cast<uint32_t*>(load_bias + d->d_un.d_ptr + 8 + nbucket_ * 4); 3379 break; 3380 3381 case DT_GNU_HASH: 3382 gnu_nbucket_ = reinterpret_cast<uint32_t*>(load_bias + d->d_un.d_ptr)[0]; 3383 // skip symndx 3384 gnu_maskwords_ = reinterpret_cast<uint32_t*>(load_bias + d->d_un.d_ptr)[2]; 3385 gnu_shift2_ = reinterpret_cast<uint32_t*>(load_bias + d->d_un.d_ptr)[3]; 3386 3387 gnu_bloom_filter_ = reinterpret_cast<ElfW(Addr)*>(load_bias + d->d_un.d_ptr + 16); 3388 gnu_bucket_ = reinterpret_cast<uint32_t*>(gnu_bloom_filter_ + gnu_maskwords_); 3389 // amend chain for symndx = header[1] 3390 gnu_chain_ = gnu_bucket_ + gnu_nbucket_ - 3391 reinterpret_cast<uint32_t*>(load_bias + d->d_un.d_ptr)[1]; 3392 3393 if (!powerof2(gnu_maskwords_)) { 3394 DL_ERR("invalid maskwords for gnu_hash = 0x%x, in \"%s\" expecting power to two", 3395 gnu_maskwords_, get_realpath()); 3396 return false; 3397 } 3398 --gnu_maskwords_; 3399 3400 flags_ |= FLAG_GNU_HASH; 3401 break; 3402 3403 case DT_STRTAB: 3404 strtab_ = reinterpret_cast<const char*>(load_bias + d->d_un.d_ptr); 3405 break; 3406 3407 case DT_STRSZ: 3408 strtab_size_ = d->d_un.d_val; 3409 break; 3410 3411 case DT_SYMTAB: 3412 symtab_ = reinterpret_cast<ElfW(Sym)*>(load_bias + d->d_un.d_ptr); 3413 break; 3414 3415 case DT_SYMENT: 3416 if (d->d_un.d_val != sizeof(ElfW(Sym))) { 3417 DL_ERR("invalid DT_SYMENT: %zd in \"%s\"", 3418 static_cast<size_t>(d->d_un.d_val), get_realpath()); 3419 return false; 3420 } 3421 break; 3422 3423 case DT_PLTREL: 3424#if defined(USE_RELA) 3425 if (d->d_un.d_val != DT_RELA) { 3426 DL_ERR("unsupported DT_PLTREL in \"%s\"; expected DT_RELA", get_realpath()); 3427 return false; 3428 } 3429#else 3430 if (d->d_un.d_val != DT_REL) { 3431 DL_ERR("unsupported DT_PLTREL in \"%s\"; expected DT_REL", get_realpath()); 3432 return false; 3433 } 3434#endif 3435 break; 3436 3437 case DT_JMPREL: 3438#if defined(USE_RELA) 3439 plt_rela_ = reinterpret_cast<ElfW(Rela)*>(load_bias + d->d_un.d_ptr); 3440#else 3441 plt_rel_ = reinterpret_cast<ElfW(Rel)*>(load_bias + d->d_un.d_ptr); 3442#endif 3443 break; 3444 3445 case DT_PLTRELSZ: 3446#if defined(USE_RELA) 3447 plt_rela_count_ = d->d_un.d_val / sizeof(ElfW(Rela)); 3448#else 3449 plt_rel_count_ = d->d_un.d_val / sizeof(ElfW(Rel)); 3450#endif 3451 break; 3452 3453 case DT_PLTGOT: 3454#if defined(__mips__) 3455 // Used by mips and mips64. 3456 plt_got_ = reinterpret_cast<ElfW(Addr)**>(load_bias + d->d_un.d_ptr); 3457#endif 3458 // Ignore for other platforms... (because RTLD_LAZY is not supported) 3459 break; 3460 3461 case DT_DEBUG: 3462 // Set the DT_DEBUG entry to the address of _r_debug for GDB 3463 // if the dynamic table is writable 3464// FIXME: not working currently for N64 3465// The flags for the LOAD and DYNAMIC program headers do not agree. 3466// The LOAD section containing the dynamic table has been mapped as 3467// read-only, but the DYNAMIC header claims it is writable. 3468#if !(defined(__mips__) && defined(__LP64__)) 3469 if ((dynamic_flags & PF_W) != 0) { 3470 d->d_un.d_val = reinterpret_cast<uintptr_t>(&_r_debug); 3471 } 3472#endif 3473 break; 3474#if defined(USE_RELA) 3475 case DT_RELA: 3476 rela_ = reinterpret_cast<ElfW(Rela)*>(load_bias + d->d_un.d_ptr); 3477 break; 3478 3479 case DT_RELASZ: 3480 rela_count_ = d->d_un.d_val / sizeof(ElfW(Rela)); 3481 break; 3482 3483 case DT_ANDROID_RELA: 3484 android_relocs_ = reinterpret_cast<uint8_t*>(load_bias + d->d_un.d_ptr); 3485 break; 3486 3487 case DT_ANDROID_RELASZ: 3488 android_relocs_size_ = d->d_un.d_val; 3489 break; 3490 3491 case DT_ANDROID_REL: 3492 DL_ERR("unsupported DT_ANDROID_REL in \"%s\"", get_realpath()); 3493 return false; 3494 3495 case DT_ANDROID_RELSZ: 3496 DL_ERR("unsupported DT_ANDROID_RELSZ in \"%s\"", get_realpath()); 3497 return false; 3498 3499 case DT_RELAENT: 3500 if (d->d_un.d_val != sizeof(ElfW(Rela))) { 3501 DL_ERR("invalid DT_RELAENT: %zd", static_cast<size_t>(d->d_un.d_val)); 3502 return false; 3503 } 3504 break; 3505 3506 // ignored (see DT_RELCOUNT comments for details) 3507 case DT_RELACOUNT: 3508 break; 3509 3510 case DT_REL: 3511 DL_ERR("unsupported DT_REL in \"%s\"", get_realpath()); 3512 return false; 3513 3514 case DT_RELSZ: 3515 DL_ERR("unsupported DT_RELSZ in \"%s\"", get_realpath()); 3516 return false; 3517 3518#else 3519 case DT_REL: 3520 rel_ = reinterpret_cast<ElfW(Rel)*>(load_bias + d->d_un.d_ptr); 3521 break; 3522 3523 case DT_RELSZ: 3524 rel_count_ = d->d_un.d_val / sizeof(ElfW(Rel)); 3525 break; 3526 3527 case DT_RELENT: 3528 if (d->d_un.d_val != sizeof(ElfW(Rel))) { 3529 DL_ERR("invalid DT_RELENT: %zd", static_cast<size_t>(d->d_un.d_val)); 3530 return false; 3531 } 3532 break; 3533 3534 case DT_ANDROID_REL: 3535 android_relocs_ = reinterpret_cast<uint8_t*>(load_bias + d->d_un.d_ptr); 3536 break; 3537 3538 case DT_ANDROID_RELSZ: 3539 android_relocs_size_ = d->d_un.d_val; 3540 break; 3541 3542 case DT_ANDROID_RELA: 3543 DL_ERR("unsupported DT_ANDROID_RELA in \"%s\"", get_realpath()); 3544 return false; 3545 3546 case DT_ANDROID_RELASZ: 3547 DL_ERR("unsupported DT_ANDROID_RELASZ in \"%s\"", get_realpath()); 3548 return false; 3549 3550 // "Indicates that all RELATIVE relocations have been concatenated together, 3551 // and specifies the RELATIVE relocation count." 3552 // 3553 // TODO: Spec also mentions that this can be used to optimize relocation process; 3554 // Not currently used by bionic linker - ignored. 3555 case DT_RELCOUNT: 3556 break; 3557 3558 case DT_RELA: 3559 DL_ERR("unsupported DT_RELA in \"%s\"", get_realpath()); 3560 return false; 3561 3562 case DT_RELASZ: 3563 DL_ERR("unsupported DT_RELASZ in \"%s\"", get_realpath()); 3564 return false; 3565 3566#endif 3567 case DT_INIT: 3568 init_func_ = reinterpret_cast<linker_function_t>(load_bias + d->d_un.d_ptr); 3569 DEBUG("%s constructors (DT_INIT) found at %p", get_realpath(), init_func_); 3570 break; 3571 3572 case DT_FINI: 3573 fini_func_ = reinterpret_cast<linker_function_t>(load_bias + d->d_un.d_ptr); 3574 DEBUG("%s destructors (DT_FINI) found at %p", get_realpath(), fini_func_); 3575 break; 3576 3577 case DT_INIT_ARRAY: 3578 init_array_ = reinterpret_cast<linker_function_t*>(load_bias + d->d_un.d_ptr); 3579 DEBUG("%s constructors (DT_INIT_ARRAY) found at %p", get_realpath(), init_array_); 3580 break; 3581 3582 case DT_INIT_ARRAYSZ: 3583 init_array_count_ = static_cast<uint32_t>(d->d_un.d_val) / sizeof(ElfW(Addr)); 3584 break; 3585 3586 case DT_FINI_ARRAY: 3587 fini_array_ = reinterpret_cast<linker_function_t*>(load_bias + d->d_un.d_ptr); 3588 DEBUG("%s destructors (DT_FINI_ARRAY) found at %p", get_realpath(), fini_array_); 3589 break; 3590 3591 case DT_FINI_ARRAYSZ: 3592 fini_array_count_ = static_cast<uint32_t>(d->d_un.d_val) / sizeof(ElfW(Addr)); 3593 break; 3594 3595 case DT_PREINIT_ARRAY: 3596 preinit_array_ = reinterpret_cast<linker_function_t*>(load_bias + d->d_un.d_ptr); 3597 DEBUG("%s constructors (DT_PREINIT_ARRAY) found at %p", get_realpath(), preinit_array_); 3598 break; 3599 3600 case DT_PREINIT_ARRAYSZ: 3601 preinit_array_count_ = static_cast<uint32_t>(d->d_un.d_val) / sizeof(ElfW(Addr)); 3602 break; 3603 3604 case DT_TEXTREL: 3605#if defined(__LP64__) 3606 DL_ERR("text relocations (DT_TEXTREL) found in 64-bit ELF file \"%s\"", get_realpath()); 3607 return false; 3608#else 3609 has_text_relocations = true; 3610 break; 3611#endif 3612 3613 case DT_SYMBOLIC: 3614 has_DT_SYMBOLIC = true; 3615 break; 3616 3617 case DT_NEEDED: 3618 ++needed_count; 3619 break; 3620 3621 case DT_FLAGS: 3622 if (d->d_un.d_val & DF_TEXTREL) { 3623#if defined(__LP64__) 3624 DL_ERR("text relocations (DF_TEXTREL) found in 64-bit ELF file \"%s\"", get_realpath()); 3625 return false; 3626#else 3627 has_text_relocations = true; 3628#endif 3629 } 3630 if (d->d_un.d_val & DF_SYMBOLIC) { 3631 has_DT_SYMBOLIC = true; 3632 } 3633 break; 3634 3635 case DT_FLAGS_1: 3636 set_dt_flags_1(d->d_un.d_val); 3637 3638 if ((d->d_un.d_val & ~SUPPORTED_DT_FLAGS_1) != 0) { 3639 DL_WARN("%s: unsupported flags DT_FLAGS_1=%p", get_realpath(), reinterpret_cast<void*>(d->d_un.d_val)); 3640 } 3641 break; 3642#if defined(__mips__) 3643 case DT_MIPS_RLD_MAP: 3644 // Set the DT_MIPS_RLD_MAP entry to the address of _r_debug for GDB. 3645 { 3646 r_debug** dp = reinterpret_cast<r_debug**>(load_bias + d->d_un.d_ptr); 3647 *dp = &_r_debug; 3648 } 3649 break; 3650 case DT_MIPS_RLD_MAP2: 3651 // Set the DT_MIPS_RLD_MAP2 entry to the address of _r_debug for GDB. 3652 { 3653 r_debug** dp = reinterpret_cast<r_debug**>( 3654 reinterpret_cast<ElfW(Addr)>(d) + d->d_un.d_val); 3655 *dp = &_r_debug; 3656 } 3657 break; 3658 3659 case DT_MIPS_RLD_VERSION: 3660 case DT_MIPS_FLAGS: 3661 case DT_MIPS_BASE_ADDRESS: 3662 case DT_MIPS_UNREFEXTNO: 3663 break; 3664 3665 case DT_MIPS_SYMTABNO: 3666 mips_symtabno_ = d->d_un.d_val; 3667 break; 3668 3669 case DT_MIPS_LOCAL_GOTNO: 3670 mips_local_gotno_ = d->d_un.d_val; 3671 break; 3672 3673 case DT_MIPS_GOTSYM: 3674 mips_gotsym_ = d->d_un.d_val; 3675 break; 3676#endif 3677 // Ignored: "Its use has been superseded by the DF_BIND_NOW flag" 3678 case DT_BIND_NOW: 3679 break; 3680 3681 case DT_VERSYM: 3682 versym_ = reinterpret_cast<ElfW(Versym)*>(load_bias + d->d_un.d_ptr); 3683 break; 3684 3685 case DT_VERDEF: 3686 verdef_ptr_ = load_bias + d->d_un.d_ptr; 3687 break; 3688 case DT_VERDEFNUM: 3689 verdef_cnt_ = d->d_un.d_val; 3690 break; 3691 3692 case DT_VERNEED: 3693 verneed_ptr_ = load_bias + d->d_un.d_ptr; 3694 break; 3695 3696 case DT_VERNEEDNUM: 3697 verneed_cnt_ = d->d_un.d_val; 3698 break; 3699 3700 case DT_RUNPATH: 3701 // this is parsed after we have strtab initialized (see below). 3702 break; 3703 3704 default: 3705 if (!relocating_linker) { 3706 DL_WARN("%s: unused DT entry: type %p arg %p", get_realpath(), 3707 reinterpret_cast<void*>(d->d_tag), reinterpret_cast<void*>(d->d_un.d_val)); 3708 } 3709 break; 3710 } 3711 } 3712 3713#if defined(__mips__) && !defined(__LP64__) 3714 if (!mips_check_and_adjust_fp_modes()) { 3715 return false; 3716 } 3717#endif 3718 3719 DEBUG("si->base = %p, si->strtab = %p, si->symtab = %p", 3720 reinterpret_cast<void*>(base), strtab_, symtab_); 3721 3722 // Sanity checks. 3723 if (relocating_linker && needed_count != 0) { 3724 DL_ERR("linker cannot have DT_NEEDED dependencies on other libraries"); 3725 return false; 3726 } 3727 if (nbucket_ == 0 && gnu_nbucket_ == 0) { 3728 DL_ERR("empty/missing DT_HASH/DT_GNU_HASH in \"%s\" " 3729 "(new hash type from the future?)", get_realpath()); 3730 return false; 3731 } 3732 if (strtab_ == 0) { 3733 DL_ERR("empty/missing DT_STRTAB in \"%s\"", get_realpath()); 3734 return false; 3735 } 3736 if (symtab_ == 0) { 3737 DL_ERR("empty/missing DT_SYMTAB in \"%s\"", get_realpath()); 3738 return false; 3739 } 3740 3741 // second pass - parse entries relying on strtab 3742 for (ElfW(Dyn)* d = dynamic; d->d_tag != DT_NULL; ++d) { 3743 switch (d->d_tag) { 3744 case DT_SONAME: 3745 set_soname(get_string(d->d_un.d_val)); 3746 break; 3747 case DT_RUNPATH: 3748 set_dt_runpath(get_string(d->d_un.d_val)); 3749 break; 3750 } 3751 } 3752 3753 // Before M release linker was using basename in place of soname. 3754 // In the case when dt_soname is absent some apps stop working 3755 // because they can't find dt_needed library by soname. 3756 // This workaround should keep them working. (applies only 3757 // for apps targeting sdk version <=22). Make an exception for 3758 // the main executable and linker; they do not need to have dt_soname 3759 if (soname_ == nullptr && this != somain && (flags_ & FLAG_LINKER) == 0 && 3760 get_application_target_sdk_version() <= 22) { 3761 soname_ = basename(realpath_.c_str()); 3762 DL_WARN("%s: is missing DT_SONAME will use basename as a replacement: \"%s\"", 3763 get_realpath(), soname_); 3764 } 3765 return true; 3766} 3767 3768bool soinfo::link_image(const soinfo_list_t& global_group, const soinfo_list_t& local_group, 3769 const android_dlextinfo* extinfo) { 3770 3771 local_group_root_ = local_group.front(); 3772 if (local_group_root_ == nullptr) { 3773 local_group_root_ = this; 3774 } 3775 3776 if ((flags_ & FLAG_LINKER) == 0 && local_group_root_ == this) { 3777 target_sdk_version_ = get_application_target_sdk_version(); 3778 } 3779 3780 VersionTracker version_tracker; 3781 3782 if (!version_tracker.init(this)) { 3783 return false; 3784 } 3785 3786#if !defined(__LP64__) 3787 if (has_text_relocations) { 3788 // Fail if app is targeting sdk version > 22 3789 if (get_application_target_sdk_version() > 22) { 3790 PRINT("%s: has text relocations", get_realpath()); 3791 DL_ERR("%s: has text relocations", get_realpath()); 3792 return false; 3793 } 3794 // Make segments writable to allow text relocations to work properly. We will later call 3795 // phdr_table_protect_segments() after all of them are applied. 3796 DL_WARN("%s has text relocations. This is wasting memory and prevents " 3797 "security hardening. Please fix.", get_realpath()); 3798 if (phdr_table_unprotect_segments(phdr, phnum, load_bias) < 0) { 3799 DL_ERR("can't unprotect loadable segments for \"%s\": %s", 3800 get_realpath(), strerror(errno)); 3801 return false; 3802 } 3803 } 3804#endif 3805 3806 if (android_relocs_ != nullptr) { 3807 // check signature 3808 if (android_relocs_size_ > 3 && 3809 android_relocs_[0] == 'A' && 3810 android_relocs_[1] == 'P' && 3811 android_relocs_[2] == 'S' && 3812 android_relocs_[3] == '2') { 3813 DEBUG("[ android relocating %s ]", get_realpath()); 3814 3815 bool relocated = false; 3816 const uint8_t* packed_relocs = android_relocs_ + 4; 3817 const size_t packed_relocs_size = android_relocs_size_ - 4; 3818 3819 relocated = relocate( 3820 version_tracker, 3821 packed_reloc_iterator<sleb128_decoder>( 3822 sleb128_decoder(packed_relocs, packed_relocs_size)), 3823 global_group, local_group); 3824 3825 if (!relocated) { 3826 return false; 3827 } 3828 } else { 3829 DL_ERR("bad android relocation header."); 3830 return false; 3831 } 3832 } 3833 3834#if defined(USE_RELA) 3835 if (rela_ != nullptr) { 3836 DEBUG("[ relocating %s ]", get_realpath()); 3837 if (!relocate(version_tracker, 3838 plain_reloc_iterator(rela_, rela_count_), global_group, local_group)) { 3839 return false; 3840 } 3841 } 3842 if (plt_rela_ != nullptr) { 3843 DEBUG("[ relocating %s plt ]", get_realpath()); 3844 if (!relocate(version_tracker, 3845 plain_reloc_iterator(plt_rela_, plt_rela_count_), global_group, local_group)) { 3846 return false; 3847 } 3848 } 3849#else 3850 if (rel_ != nullptr) { 3851 DEBUG("[ relocating %s ]", get_realpath()); 3852 if (!relocate(version_tracker, 3853 plain_reloc_iterator(rel_, rel_count_), global_group, local_group)) { 3854 return false; 3855 } 3856 } 3857 if (plt_rel_ != nullptr) { 3858 DEBUG("[ relocating %s plt ]", get_realpath()); 3859 if (!relocate(version_tracker, 3860 plain_reloc_iterator(plt_rel_, plt_rel_count_), global_group, local_group)) { 3861 return false; 3862 } 3863 } 3864#endif 3865 3866#if defined(__mips__) 3867 if (!mips_relocate_got(version_tracker, global_group, local_group)) { 3868 return false; 3869 } 3870#endif 3871 3872 DEBUG("[ finished linking %s ]", get_realpath()); 3873 3874#if !defined(__LP64__) 3875 if (has_text_relocations) { 3876 // All relocations are done, we can protect our segments back to read-only. 3877 if (phdr_table_protect_segments(phdr, phnum, load_bias) < 0) { 3878 DL_ERR("can't protect segments for \"%s\": %s", 3879 get_realpath(), strerror(errno)); 3880 return false; 3881 } 3882 } 3883#endif 3884 3885 /* We can also turn on GNU RELRO protection */ 3886 if (phdr_table_protect_gnu_relro(phdr, phnum, load_bias) < 0) { 3887 DL_ERR("can't enable GNU RELRO protection for \"%s\": %s", 3888 get_realpath(), strerror(errno)); 3889 return false; 3890 } 3891 3892 /* Handle serializing/sharing the RELRO segment */ 3893 if (extinfo && (extinfo->flags & ANDROID_DLEXT_WRITE_RELRO)) { 3894 if (phdr_table_serialize_gnu_relro(phdr, phnum, load_bias, 3895 extinfo->relro_fd) < 0) { 3896 DL_ERR("failed serializing GNU RELRO section for \"%s\": %s", 3897 get_realpath(), strerror(errno)); 3898 return false; 3899 } 3900 } else if (extinfo && (extinfo->flags & ANDROID_DLEXT_USE_RELRO)) { 3901 if (phdr_table_map_gnu_relro(phdr, phnum, load_bias, 3902 extinfo->relro_fd) < 0) { 3903 DL_ERR("failed mapping GNU RELRO section for \"%s\": %s", 3904 get_realpath(), strerror(errno)); 3905 return false; 3906 } 3907 } 3908 3909 notify_gdb_of_load(this); 3910 return true; 3911} 3912 3913/* 3914 * This function add vdso to internal dso list. 3915 * It helps to stack unwinding through signal handlers. 3916 * Also, it makes bionic more like glibc. 3917 */ 3918static void add_vdso(KernelArgumentBlock& args __unused) { 3919#if defined(AT_SYSINFO_EHDR) 3920 ElfW(Ehdr)* ehdr_vdso = reinterpret_cast<ElfW(Ehdr)*>(args.getauxval(AT_SYSINFO_EHDR)); 3921 if (ehdr_vdso == nullptr) { 3922 return; 3923 } 3924 3925 soinfo* si = soinfo_alloc(&g_default_namespace, "[vdso]", nullptr, 0, 0); 3926 3927 si->phdr = reinterpret_cast<ElfW(Phdr)*>(reinterpret_cast<char*>(ehdr_vdso) + ehdr_vdso->e_phoff); 3928 si->phnum = ehdr_vdso->e_phnum; 3929 si->base = reinterpret_cast<ElfW(Addr)>(ehdr_vdso); 3930 si->size = phdr_table_get_load_size(si->phdr, si->phnum); 3931 si->load_bias = get_elf_exec_load_bias(ehdr_vdso); 3932 3933 si->prelink_image(); 3934 si->link_image(g_empty_list, soinfo::soinfo_list_t::make_list(si), nullptr); 3935#endif 3936} 3937 3938/* 3939 * This is linker soinfo for GDB. See details below. 3940 */ 3941#if defined(__LP64__) 3942#define LINKER_PATH "/system/bin/linker64" 3943#else 3944#define LINKER_PATH "/system/bin/linker" 3945#endif 3946 3947// This is done to avoid calling c-tor prematurely 3948// because soinfo c-tor needs memory allocator 3949// which might be initialized after global variables. 3950static uint8_t linker_soinfo_for_gdb_buf[sizeof(soinfo)] __attribute__((aligned(8))); 3951static soinfo* linker_soinfo_for_gdb = nullptr; 3952 3953/* gdb expects the linker to be in the debug shared object list. 3954 * Without this, gdb has trouble locating the linker's ".text" 3955 * and ".plt" sections. Gdb could also potentially use this to 3956 * relocate the offset of our exported 'rtld_db_dlactivity' symbol. 3957 * Don't use soinfo_alloc(), because the linker shouldn't 3958 * be on the soinfo list. 3959 */ 3960static void init_linker_info_for_gdb(ElfW(Addr) linker_base) { 3961 linker_soinfo_for_gdb = new (linker_soinfo_for_gdb_buf) soinfo(nullptr, LINKER_PATH, 3962 nullptr, 0, 0); 3963 3964 linker_soinfo_for_gdb->load_bias = linker_base; 3965 3966 /* 3967 * Set the dynamic field in the link map otherwise gdb will complain with 3968 * the following: 3969 * warning: .dynamic section for "/system/bin/linker" is not at the 3970 * expected address (wrong library or version mismatch?) 3971 */ 3972 ElfW(Ehdr)* elf_hdr = reinterpret_cast<ElfW(Ehdr)*>(linker_base); 3973 ElfW(Phdr)* phdr = reinterpret_cast<ElfW(Phdr)*>(linker_base + elf_hdr->e_phoff); 3974 phdr_table_get_dynamic_section(phdr, elf_hdr->e_phnum, linker_base, 3975 &linker_soinfo_for_gdb->dynamic, nullptr); 3976 insert_soinfo_into_debug_map(linker_soinfo_for_gdb); 3977} 3978 3979static void init_default_namespace() { 3980 g_default_namespace.set_name("(default)"); 3981 g_default_namespace.set_isolated(false); 3982 3983 const char *interp = phdr_table_get_interpreter_name(somain->phdr, somain->phnum, 3984 somain->load_bias); 3985 const char* bname = basename(interp); 3986 if (bname && (strcmp(bname, "linker_asan") == 0 || strcmp(bname, "linker_asan64") == 0)) { 3987 g_default_ld_paths = kAsanDefaultLdPaths; 3988 } else { 3989 g_default_ld_paths = kDefaultLdPaths; 3990 } 3991 3992 std::vector<std::string> ld_default_paths; 3993 for (size_t i = 0; g_default_ld_paths[i] != nullptr; ++i) { 3994 ld_default_paths.push_back(g_default_ld_paths[i]); 3995 } 3996 3997 g_default_namespace.set_default_library_paths(std::move(ld_default_paths)); 3998}; 3999 4000extern "C" int __system_properties_init(void); 4001 4002/* 4003 * This code is called after the linker has linked itself and 4004 * fixed it's own GOT. It is safe to make references to externs 4005 * and other non-local data at this point. 4006 */ 4007static ElfW(Addr) __linker_init_post_relocation(KernelArgumentBlock& args, ElfW(Addr) linker_base) { 4008#if TIMING 4009 struct timeval t0, t1; 4010 gettimeofday(&t0, 0); 4011#endif 4012 4013 // Sanitize the environment. 4014 __libc_init_AT_SECURE(args); 4015 4016 // Initialize system properties 4017 __system_properties_init(); // may use 'environ' 4018 4019 debuggerd_init(); 4020 4021 // Get a few environment variables. 4022 const char* LD_DEBUG = getenv("LD_DEBUG"); 4023 if (LD_DEBUG != nullptr) { 4024 g_ld_debug_verbosity = atoi(LD_DEBUG); 4025 } 4026 4027#if defined(__LP64__) 4028 INFO("[ Android dynamic linker (64-bit) ]"); 4029#else 4030 INFO("[ Android dynamic linker (32-bit) ]"); 4031#endif 4032 4033 // These should have been sanitized by __libc_init_AT_SECURE, but the test 4034 // doesn't cost us anything. 4035 const char* ldpath_env = nullptr; 4036 const char* ldpreload_env = nullptr; 4037 if (!getauxval(AT_SECURE)) { 4038 ldpath_env = getenv("LD_LIBRARY_PATH"); 4039 if (ldpath_env != nullptr) { 4040 INFO("[ LD_LIBRARY_PATH set to '%s' ]", ldpath_env); 4041 } 4042 ldpreload_env = getenv("LD_PRELOAD"); 4043 if (ldpreload_env != nullptr) { 4044 INFO("[ LD_PRELOAD set to '%s' ]", ldpreload_env); 4045 } 4046 } 4047 4048 soinfo* si = soinfo_alloc(&g_default_namespace, args.argv[0], nullptr, 0, RTLD_GLOBAL); 4049 if (si == nullptr) { 4050 exit(EXIT_FAILURE); 4051 } 4052 4053 /* bootstrap the link map, the main exe always needs to be first */ 4054 si->set_main_executable(); 4055 link_map* map = &(si->link_map_head); 4056 4057 map->l_addr = 0; 4058 map->l_name = args.argv[0]; 4059 map->l_prev = nullptr; 4060 map->l_next = nullptr; 4061 4062 _r_debug.r_map = map; 4063 r_debug_tail = map; 4064 4065 init_linker_info_for_gdb(linker_base); 4066 4067 // Extract information passed from the kernel. 4068 si->phdr = reinterpret_cast<ElfW(Phdr)*>(args.getauxval(AT_PHDR)); 4069 si->phnum = args.getauxval(AT_PHNUM); 4070 si->entry = args.getauxval(AT_ENTRY); 4071 4072 /* Compute the value of si->base. We can't rely on the fact that 4073 * the first entry is the PHDR because this will not be true 4074 * for certain executables (e.g. some in the NDK unit test suite) 4075 */ 4076 si->base = 0; 4077 si->size = phdr_table_get_load_size(si->phdr, si->phnum); 4078 si->load_bias = 0; 4079 for (size_t i = 0; i < si->phnum; ++i) { 4080 if (si->phdr[i].p_type == PT_PHDR) { 4081 si->load_bias = reinterpret_cast<ElfW(Addr)>(si->phdr) - si->phdr[i].p_vaddr; 4082 si->base = reinterpret_cast<ElfW(Addr)>(si->phdr) - si->phdr[i].p_offset; 4083 break; 4084 } 4085 } 4086 si->dynamic = nullptr; 4087 4088 ElfW(Ehdr)* elf_hdr = reinterpret_cast<ElfW(Ehdr)*>(si->base); 4089 if (elf_hdr->e_type != ET_DYN) { 4090 __libc_format_fd(2, "error: only position independent executables (PIE) are supported.\n"); 4091 exit(EXIT_FAILURE); 4092 } 4093 4094 // Use LD_LIBRARY_PATH and LD_PRELOAD (but only if we aren't setuid/setgid). 4095 parse_LD_LIBRARY_PATH(ldpath_env); 4096 parse_LD_PRELOAD(ldpreload_env); 4097 4098 somain = si; 4099 4100 init_default_namespace(); 4101 4102 if (!si->prelink_image()) { 4103 __libc_fatal("CANNOT LINK EXECUTABLE: %s", linker_get_error_buffer()); 4104 } 4105 4106 // add somain to global group 4107 si->set_dt_flags_1(si->get_dt_flags_1() | DF_1_GLOBAL); 4108 4109 // Load ld_preloads and dependencies. 4110 StringLinkedList needed_library_name_list; 4111 size_t needed_libraries_count = 0; 4112 size_t ld_preloads_count = 0; 4113 4114 for (const auto& ld_preload_name : g_ld_preload_names) { 4115 needed_library_name_list.push_back(ld_preload_name.c_str()); 4116 ++needed_libraries_count; 4117 ++ld_preloads_count; 4118 } 4119 4120 for_each_dt_needed(si, [&](const char* name) { 4121 needed_library_name_list.push_back(name); 4122 ++needed_libraries_count; 4123 }); 4124 4125 const char* needed_library_names[needed_libraries_count]; 4126 4127 memset(needed_library_names, 0, sizeof(needed_library_names)); 4128 needed_library_name_list.copy_to_array(needed_library_names, needed_libraries_count); 4129 4130 if (needed_libraries_count > 0 && 4131 !find_libraries(&g_default_namespace, si, needed_library_names, needed_libraries_count, 4132 nullptr, &g_ld_preloads, ld_preloads_count, RTLD_GLOBAL, nullptr, 4133 /* add_as_children */ true)) { 4134 __libc_fatal("CANNOT LINK EXECUTABLE: %s", linker_get_error_buffer()); 4135 } else if (needed_libraries_count == 0) { 4136 if (!si->link_image(g_empty_list, soinfo::soinfo_list_t::make_list(si), nullptr)) { 4137 __libc_fatal("CANNOT LINK EXECUTABLE: %s", linker_get_error_buffer()); 4138 } 4139 si->increment_ref_count(); 4140 } 4141 4142 add_vdso(args); 4143 4144 { 4145 ProtectedDataGuard guard; 4146 4147 si->call_pre_init_constructors(); 4148 4149 /* After the prelink_image, the si->load_bias is initialized. 4150 * For so lib, the map->l_addr will be updated in notify_gdb_of_load. 4151 * We need to update this value for so exe here. So Unwind_Backtrace 4152 * for some arch like x86 could work correctly within so exe. 4153 */ 4154 map->l_addr = si->load_bias; 4155 si->call_constructors(); 4156 } 4157 4158#if TIMING 4159 gettimeofday(&t1, nullptr); 4160 PRINT("LINKER TIME: %s: %d microseconds", args.argv[0], (int) ( 4161 (((long long)t1.tv_sec * 1000000LL) + (long long)t1.tv_usec) - 4162 (((long long)t0.tv_sec * 1000000LL) + (long long)t0.tv_usec))); 4163#endif 4164#if STATS 4165 PRINT("RELO STATS: %s: %d abs, %d rel, %d copy, %d symbol", args.argv[0], 4166 linker_stats.count[kRelocAbsolute], 4167 linker_stats.count[kRelocRelative], 4168 linker_stats.count[kRelocCopy], 4169 linker_stats.count[kRelocSymbol]); 4170#endif 4171#if COUNT_PAGES 4172 { 4173 unsigned n; 4174 unsigned i; 4175 unsigned count = 0; 4176 for (n = 0; n < 4096; n++) { 4177 if (bitmask[n]) { 4178 unsigned x = bitmask[n]; 4179#if defined(__LP64__) 4180 for (i = 0; i < 32; i++) { 4181#else 4182 for (i = 0; i < 8; i++) { 4183#endif 4184 if (x & 1) { 4185 count++; 4186 } 4187 x >>= 1; 4188 } 4189 } 4190 } 4191 PRINT("PAGES MODIFIED: %s: %d (%dKB)", args.argv[0], count, count * 4); 4192 } 4193#endif 4194 4195#if TIMING || STATS || COUNT_PAGES 4196 fflush(stdout); 4197#endif 4198 4199 TRACE("[ Ready to execute '%s' @ %p ]", si->get_realpath(), reinterpret_cast<void*>(si->entry)); 4200 return si->entry; 4201} 4202 4203/* Compute the load-bias of an existing executable. This shall only 4204 * be used to compute the load bias of an executable or shared library 4205 * that was loaded by the kernel itself. 4206 * 4207 * Input: 4208 * elf -> address of ELF header, assumed to be at the start of the file. 4209 * Return: 4210 * load bias, i.e. add the value of any p_vaddr in the file to get 4211 * the corresponding address in memory. 4212 */ 4213static ElfW(Addr) get_elf_exec_load_bias(const ElfW(Ehdr)* elf) { 4214 ElfW(Addr) offset = elf->e_phoff; 4215 const ElfW(Phdr)* phdr_table = 4216 reinterpret_cast<const ElfW(Phdr)*>(reinterpret_cast<uintptr_t>(elf) + offset); 4217 const ElfW(Phdr)* phdr_end = phdr_table + elf->e_phnum; 4218 4219 for (const ElfW(Phdr)* phdr = phdr_table; phdr < phdr_end; phdr++) { 4220 if (phdr->p_type == PT_LOAD) { 4221 return reinterpret_cast<ElfW(Addr)>(elf) + phdr->p_offset - phdr->p_vaddr; 4222 } 4223 } 4224 return 0; 4225} 4226 4227extern "C" void _start(); 4228 4229/* 4230 * This is the entry point for the linker, called from begin.S. This 4231 * method is responsible for fixing the linker's own relocations, and 4232 * then calling __linker_init_post_relocation(). 4233 * 4234 * Because this method is called before the linker has fixed it's own 4235 * relocations, any attempt to reference an extern variable, extern 4236 * function, or other GOT reference will generate a segfault. 4237 */ 4238extern "C" ElfW(Addr) __linker_init(void* raw_args) { 4239 KernelArgumentBlock args(raw_args); 4240 4241 ElfW(Addr) linker_addr = args.getauxval(AT_BASE); 4242 ElfW(Addr) entry_point = args.getauxval(AT_ENTRY); 4243 ElfW(Ehdr)* elf_hdr = reinterpret_cast<ElfW(Ehdr)*>(linker_addr); 4244 ElfW(Phdr)* phdr = reinterpret_cast<ElfW(Phdr)*>(linker_addr + elf_hdr->e_phoff); 4245 4246 soinfo linker_so(nullptr, nullptr, nullptr, 0, 0); 4247 4248 // If the linker is not acting as PT_INTERP entry_point is equal to 4249 // _start. Which means that the linker is running as an executable and 4250 // already linked by PT_INTERP. 4251 // 4252 // This happens when user tries to run 'adb shell /system/bin/linker' 4253 // see also https://code.google.com/p/android/issues/detail?id=63174 4254 if (reinterpret_cast<ElfW(Addr)>(&_start) == entry_point) { 4255 __libc_fatal("This is %s, the helper program for shared library executables.", args.argv[0]); 4256 } 4257 4258 linker_so.base = linker_addr; 4259 linker_so.size = phdr_table_get_load_size(phdr, elf_hdr->e_phnum); 4260 linker_so.load_bias = get_elf_exec_load_bias(elf_hdr); 4261 linker_so.dynamic = nullptr; 4262 linker_so.phdr = phdr; 4263 linker_so.phnum = elf_hdr->e_phnum; 4264 linker_so.set_linker_flag(); 4265 4266 // This might not be obvious... The reasons why we pass g_empty_list 4267 // in place of local_group here are (1) we do not really need it, because 4268 // linker is built with DT_SYMBOLIC and therefore relocates its symbols against 4269 // itself without having to look into local_group and (2) allocators 4270 // are not yet initialized, and therefore we cannot use linked_list.push_* 4271 // functions at this point. 4272 if (!(linker_so.prelink_image() && linker_so.link_image(g_empty_list, g_empty_list, nullptr))) { 4273 __libc_fatal("CANNOT LINK EXECUTABLE: %s", linker_get_error_buffer()); 4274 } 4275 4276 __libc_init_main_thread(args); 4277 4278 // Initialize the linker's static libc's globals 4279 __libc_init_globals(args); 4280 4281 // Initialize the linker's own global variables 4282 linker_so.call_constructors(); 4283 4284 // Initialize static variables. Note that in order to 4285 // get correct libdl_info we need to call constructors 4286 // before get_libdl_info(). 4287 solist = get_libdl_info(); 4288 sonext = get_libdl_info(); 4289 g_default_namespace.soinfo_list().push_back(get_libdl_info()); 4290 4291 // We have successfully fixed our own relocations. It's safe to run 4292 // the main part of the linker now. 4293 args.abort_message_ptr = &g_abort_message; 4294 ElfW(Addr) start_address = __linker_init_post_relocation(args, linker_addr); 4295 4296 INFO("[ Jumping to _start (%p)... ]", reinterpret_cast<void*>(start_address)); 4297 4298 // Return the address that the calling assembly stub should jump to. 4299 return start_address; 4300} 4301