1/* 2 * Copyright (C) 2016 The Android Open Source Project 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * * Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * * Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in 12 * the documentation and/or other materials provided with the 13 * distribution. 14 * 15 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS 16 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT 17 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS 18 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE 19 * COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, 20 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, 21 * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS 22 * OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED 23 * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, 24 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT 25 * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26 * SUCH DAMAGE. 27 */ 28 29#include "linker_main.h" 30 31#include "linker_debug.h" 32#include "linker_cfi.h" 33#include "linker_gdb_support.h" 34#include "linker_globals.h" 35#include "linker_phdr.h" 36#include "linker_utils.h" 37 38#include "private/bionic_globals.h" 39#include "private/bionic_tls.h" 40#include "private/KernelArgumentBlock.h" 41 42#include "android-base/strings.h" 43#include "android-base/stringprintf.h" 44#ifdef __ANDROID__ 45#include "debuggerd/handler.h" 46#endif 47 48#include <async_safe/log.h> 49 50#include <vector> 51 52extern void __libc_init_globals(KernelArgumentBlock&); 53extern void __libc_init_AT_SECURE(KernelArgumentBlock&); 54 55extern "C" void _start(); 56 57static ElfW(Addr) get_elf_exec_load_bias(const ElfW(Ehdr)* elf); 58 59// These should be preserved static to avoid emitting 60// RELATIVE relocations for the part of the code running 61// before linker links itself. 62 63// TODO (dimtiry): remove somain, rename solist to solist_head 64static soinfo* solist; 65static soinfo* sonext; 66static soinfo* somain; // main process, always the one after libdl_info 67static soinfo* vdso; // vdso if present 68 69void solist_add_soinfo(soinfo* si) { 70 sonext->next = si; 71 sonext = si; 72} 73 74bool solist_remove_soinfo(soinfo* si) { 75 soinfo *prev = nullptr, *trav; 76 for (trav = solist; trav != nullptr; trav = trav->next) { 77 if (trav == si) { 78 break; 79 } 80 prev = trav; 81 } 82 83 if (trav == nullptr) { 84 // si was not in solist 85 PRINT("name \"%s\"@%p is not in solist!", si->get_realpath(), si); 86 return false; 87 } 88 89 // prev will never be null, because the first entry in solist is 90 // always the static libdl_info. 91 CHECK(prev != nullptr); 92 prev->next = si->next; 93 if (si == sonext) { 94 sonext = prev; 95 } 96 97 return true; 98} 99 100soinfo* solist_get_head() { 101 return solist; 102} 103 104soinfo* solist_get_somain() { 105 return somain; 106} 107 108soinfo* solist_get_vdso() { 109 return vdso; 110} 111 112int g_ld_debug_verbosity; 113abort_msg_t* g_abort_message = nullptr; // For debuggerd. 114 115static std::vector<std::string> g_ld_preload_names; 116 117static std::vector<soinfo*> g_ld_preloads; 118 119static void parse_path(const char* path, const char* delimiters, 120 std::vector<std::string>* resolved_paths) { 121 std::vector<std::string> paths; 122 split_path(path, delimiters, &paths); 123 resolve_paths(paths, resolved_paths); 124} 125 126static void parse_LD_LIBRARY_PATH(const char* path) { 127 std::vector<std::string> ld_libary_paths; 128 parse_path(path, ":", &ld_libary_paths); 129 g_default_namespace.set_ld_library_paths(std::move(ld_libary_paths)); 130} 131 132static void parse_LD_PRELOAD(const char* path) { 133 g_ld_preload_names.clear(); 134 if (path != nullptr) { 135 // We have historically supported ':' as well as ' ' in LD_PRELOAD. 136 g_ld_preload_names = android::base::Split(path, " :"); 137 g_ld_preload_names.erase(std::remove_if(g_ld_preload_names.begin(), g_ld_preload_names.end(), 138 [](const std::string& s) { return s.empty(); }), 139 g_ld_preload_names.end()); 140 } 141} 142 143// An empty list of soinfos 144static soinfo_list_t g_empty_list; 145 146static void add_vdso(KernelArgumentBlock& args) { 147 ElfW(Ehdr)* ehdr_vdso = reinterpret_cast<ElfW(Ehdr)*>(args.getauxval(AT_SYSINFO_EHDR)); 148 if (ehdr_vdso == nullptr) { 149 return; 150 } 151 152 soinfo* si = soinfo_alloc(&g_default_namespace, "[vdso]", nullptr, 0, 0); 153 154 si->phdr = reinterpret_cast<ElfW(Phdr)*>(reinterpret_cast<char*>(ehdr_vdso) + ehdr_vdso->e_phoff); 155 si->phnum = ehdr_vdso->e_phnum; 156 si->base = reinterpret_cast<ElfW(Addr)>(ehdr_vdso); 157 si->size = phdr_table_get_load_size(si->phdr, si->phnum); 158 si->load_bias = get_elf_exec_load_bias(ehdr_vdso); 159 160 si->prelink_image(); 161 si->link_image(g_empty_list, soinfo_list_t::make_list(si), nullptr); 162 // prevents accidental unloads... 163 si->set_dt_flags_1(si->get_dt_flags_1() | DF_1_NODELETE); 164 si->set_linked(); 165 si->call_constructors(); 166 167 vdso = si; 168} 169 170/* gdb expects the linker to be in the debug shared object list. 171 * Without this, gdb has trouble locating the linker's ".text" 172 * and ".plt" sections. Gdb could also potentially use this to 173 * relocate the offset of our exported 'rtld_db_dlactivity' symbol. 174 * Note that the linker shouldn't be on the soinfo list. 175 */ 176static link_map linker_link_map; 177 178static void init_linker_info_for_gdb(ElfW(Addr) linker_base, char* linker_path) { 179 linker_link_map.l_addr = linker_base; 180 linker_link_map.l_name = linker_path; 181 182 /* 183 * Set the dynamic field in the link map otherwise gdb will complain with 184 * the following: 185 * warning: .dynamic section for "/system/bin/linker" is not at the 186 * expected address (wrong library or version mismatch?) 187 */ 188 ElfW(Ehdr)* elf_hdr = reinterpret_cast<ElfW(Ehdr)*>(linker_base); 189 ElfW(Phdr)* phdr = reinterpret_cast<ElfW(Phdr)*>(linker_base + elf_hdr->e_phoff); 190 phdr_table_get_dynamic_section(phdr, elf_hdr->e_phnum, linker_base, 191 &linker_link_map.l_ld, nullptr); 192 193} 194 195extern "C" int __system_properties_init(void); 196 197static const char* get_executable_path() { 198 static std::string executable_path; 199 if (executable_path.empty()) { 200 char path[PATH_MAX]; 201 ssize_t path_len = readlink("/proc/self/exe", path, sizeof(path)); 202 if (path_len == -1 || path_len >= static_cast<ssize_t>(sizeof(path))) { 203 async_safe_fatal("readlink('/proc/self/exe') failed: %s", strerror(errno)); 204 } 205 executable_path = std::string(path, path_len); 206 } 207 208 return executable_path.c_str(); 209} 210 211#if defined(__LP64__) 212static char kLinkerPath[] = "/system/bin/linker64"; 213#else 214static char kLinkerPath[] = "/system/bin/linker"; 215#endif 216 217static void __linker_cannot_link(const char* argv0) { 218 async_safe_format_fd(STDERR_FILENO, 219 "CANNOT LINK EXECUTABLE \"%s\": %s\n", 220 argv0, 221 linker_get_error_buffer()); 222 223 async_safe_format_log(ANDROID_LOG_FATAL, 224 "linker", 225 "CANNOT LINK EXECUTABLE \"%s\": %s", 226 argv0, 227 linker_get_error_buffer()); 228 _exit(EXIT_FAILURE); 229} 230 231/* 232 * This code is called after the linker has linked itself and 233 * fixed it's own GOT. It is safe to make references to externs 234 * and other non-local data at this point. 235 */ 236static ElfW(Addr) __linker_init_post_relocation(KernelArgumentBlock& args) { 237 ProtectedDataGuard guard; 238 239#if TIMING 240 struct timeval t0, t1; 241 gettimeofday(&t0, 0); 242#endif 243 244 // Sanitize the environment. 245 __libc_init_AT_SECURE(args); 246 247 // Initialize system properties 248 __system_properties_init(); // may use 'environ' 249 250 // Register the debuggerd signal handler. 251#ifdef __ANDROID__ 252 debuggerd_callbacks_t callbacks = { 253 .get_abort_message = []() { 254 return g_abort_message; 255 }, 256 .post_dump = ¬ify_gdb_of_libraries, 257 }; 258 debuggerd_init(&callbacks); 259#endif 260 261 g_linker_logger.ResetState(); 262 263 // Get a few environment variables. 264 const char* LD_DEBUG = getenv("LD_DEBUG"); 265 if (LD_DEBUG != nullptr) { 266 g_ld_debug_verbosity = atoi(LD_DEBUG); 267 } 268 269#if defined(__LP64__) 270 INFO("[ Android dynamic linker (64-bit) ]"); 271#else 272 INFO("[ Android dynamic linker (32-bit) ]"); 273#endif 274 275 // These should have been sanitized by __libc_init_AT_SECURE, but the test 276 // doesn't cost us anything. 277 const char* ldpath_env = nullptr; 278 const char* ldpreload_env = nullptr; 279 if (!getauxval(AT_SECURE)) { 280 ldpath_env = getenv("LD_LIBRARY_PATH"); 281 if (ldpath_env != nullptr) { 282 INFO("[ LD_LIBRARY_PATH set to \"%s\" ]", ldpath_env); 283 } 284 ldpreload_env = getenv("LD_PRELOAD"); 285 if (ldpreload_env != nullptr) { 286 INFO("[ LD_PRELOAD set to \"%s\" ]", ldpreload_env); 287 } 288 } 289 290 add_vdso(args); 291 292 struct stat file_stat; 293 // Stat "/proc/self/exe" instead of executable_path because 294 // the executable could be unlinked by this point and it should 295 // not cause a crash (see http://b/31084669) 296 if (TEMP_FAILURE_RETRY(stat("/proc/self/exe", &file_stat)) != 0) { 297 async_safe_fatal("unable to stat \"/proc/self/exe\": %s", strerror(errno)); 298 } 299 300 const char* executable_path = get_executable_path(); 301 soinfo* si = soinfo_alloc(&g_default_namespace, executable_path, &file_stat, 0, RTLD_GLOBAL); 302 303 // Bootstrap the link map, the main exe always needs to be first. 304 si->set_main_executable(); 305 link_map* map = &(si->link_map_head); 306 307 // Register the main executable and the linker upfront to have 308 // gdb aware of them before loading the rest of the dependency 309 // tree. 310 map->l_addr = 0; 311 map->l_name = const_cast<char*>(executable_path); 312 insert_link_map_into_debug_map(map); 313 insert_link_map_into_debug_map(&linker_link_map); 314 315 // Extract information passed from the kernel. 316 si->phdr = reinterpret_cast<ElfW(Phdr)*>(args.getauxval(AT_PHDR)); 317 si->phnum = args.getauxval(AT_PHNUM); 318 319 /* Compute the value of si->base. We can't rely on the fact that 320 * the first entry is the PHDR because this will not be true 321 * for certain executables (e.g. some in the NDK unit test suite) 322 */ 323 si->base = 0; 324 si->size = phdr_table_get_load_size(si->phdr, si->phnum); 325 si->load_bias = 0; 326 for (size_t i = 0; i < si->phnum; ++i) { 327 if (si->phdr[i].p_type == PT_PHDR) { 328 si->load_bias = reinterpret_cast<ElfW(Addr)>(si->phdr) - si->phdr[i].p_vaddr; 329 si->base = reinterpret_cast<ElfW(Addr)>(si->phdr) - si->phdr[i].p_offset; 330 break; 331 } 332 } 333 334 if (si->base == 0) { 335 async_safe_fatal("Could not find a PHDR: broken executable?"); 336 } 337 338 si->dynamic = nullptr; 339 340 ElfW(Ehdr)* elf_hdr = reinterpret_cast<ElfW(Ehdr)*>(si->base); 341 342 // We haven't supported non-PIE since Lollipop for security reasons. 343 if (elf_hdr->e_type != ET_DYN) { 344 // We don't use async_safe_fatal here because we don't want a tombstone: 345 // even after several years we still find ourselves on app compatibility 346 // investigations because some app's trying to launch an executable that 347 // hasn't worked in at least three years, and we've "helpfully" dropped a 348 // tombstone for them. The tombstone never provided any detail relevant to 349 // fixing the problem anyway, and the utility of drawing extra attention 350 // to the problem is non-existent at this late date. 351 async_safe_format_fd(STDERR_FILENO, 352 "\"%s\": error: Android 5.0 and later only support " 353 "position-independent executables (-fPIE).\n", 354 g_argv[0]); 355 exit(EXIT_FAILURE); 356 } 357 358 // Use LD_LIBRARY_PATH and LD_PRELOAD (but only if we aren't setuid/setgid). 359 parse_LD_LIBRARY_PATH(ldpath_env); 360 parse_LD_PRELOAD(ldpreload_env); 361 362 somain = si; 363 364 std::vector<android_namespace_t*> namespaces = init_default_namespaces(executable_path); 365 366 if (!si->prelink_image()) __linker_cannot_link(g_argv[0]); 367 368 // add somain to global group 369 si->set_dt_flags_1(si->get_dt_flags_1() | DF_1_GLOBAL); 370 // ... and add it to all other linked namespaces 371 for (auto linked_ns : namespaces) { 372 if (linked_ns != &g_default_namespace) { 373 linked_ns->add_soinfo(somain); 374 somain->add_secondary_namespace(linked_ns); 375 } 376 } 377 378 // Load ld_preloads and dependencies. 379 std::vector<const char*> needed_library_name_list; 380 size_t ld_preloads_count = 0; 381 382 for (const auto& ld_preload_name : g_ld_preload_names) { 383 needed_library_name_list.push_back(ld_preload_name.c_str()); 384 ++ld_preloads_count; 385 } 386 387 for_each_dt_needed(si, [&](const char* name) { 388 needed_library_name_list.push_back(name); 389 }); 390 391 const char** needed_library_names = &needed_library_name_list[0]; 392 size_t needed_libraries_count = needed_library_name_list.size(); 393 394 if (needed_libraries_count > 0 && 395 !find_libraries(&g_default_namespace, 396 si, 397 needed_library_names, 398 needed_libraries_count, 399 nullptr, 400 &g_ld_preloads, 401 ld_preloads_count, 402 RTLD_GLOBAL, 403 nullptr, 404 true /* add_as_children */, 405 true /* search_linked_namespaces */, 406 &namespaces)) { 407 __linker_cannot_link(g_argv[0]); 408 } else if (needed_libraries_count == 0) { 409 if (!si->link_image(g_empty_list, soinfo_list_t::make_list(si), nullptr)) { 410 __linker_cannot_link(g_argv[0]); 411 } 412 si->increment_ref_count(); 413 } 414 415 if (!get_cfi_shadow()->InitialLinkDone(solist)) __linker_cannot_link(g_argv[0]); 416 417 si->call_pre_init_constructors(); 418 419 /* After the prelink_image, the si->load_bias is initialized. 420 * For so lib, the map->l_addr will be updated in notify_gdb_of_load. 421 * We need to update this value for so exe here. So Unwind_Backtrace 422 * for some arch like x86 could work correctly within so exe. 423 */ 424 map->l_addr = si->load_bias; 425 si->call_constructors(); 426 427#if TIMING 428 gettimeofday(&t1, nullptr); 429 PRINT("LINKER TIME: %s: %d microseconds", g_argv[0], (int) ( 430 (((long long)t1.tv_sec * 1000000LL) + (long long)t1.tv_usec) - 431 (((long long)t0.tv_sec * 1000000LL) + (long long)t0.tv_usec))); 432#endif 433#if STATS 434 PRINT("RELO STATS: %s: %d abs, %d rel, %d copy, %d symbol", g_argv[0], 435 linker_stats.count[kRelocAbsolute], 436 linker_stats.count[kRelocRelative], 437 linker_stats.count[kRelocCopy], 438 linker_stats.count[kRelocSymbol]); 439#endif 440#if COUNT_PAGES 441 { 442 unsigned n; 443 unsigned i; 444 unsigned count = 0; 445 for (n = 0; n < 4096; n++) { 446 if (bitmask[n]) { 447 unsigned x = bitmask[n]; 448#if defined(__LP64__) 449 for (i = 0; i < 32; i++) { 450#else 451 for (i = 0; i < 8; i++) { 452#endif 453 if (x & 1) { 454 count++; 455 } 456 x >>= 1; 457 } 458 } 459 } 460 PRINT("PAGES MODIFIED: %s: %d (%dKB)", g_argv[0], count, count * 4); 461 } 462#endif 463 464#if TIMING || STATS || COUNT_PAGES 465 fflush(stdout); 466#endif 467 468 ElfW(Addr) entry = args.getauxval(AT_ENTRY); 469 TRACE("[ Ready to execute \"%s\" @ %p ]", si->get_realpath(), reinterpret_cast<void*>(entry)); 470 return entry; 471} 472 473/* Compute the load-bias of an existing executable. This shall only 474 * be used to compute the load bias of an executable or shared library 475 * that was loaded by the kernel itself. 476 * 477 * Input: 478 * elf -> address of ELF header, assumed to be at the start of the file. 479 * Return: 480 * load bias, i.e. add the value of any p_vaddr in the file to get 481 * the corresponding address in memory. 482 */ 483static ElfW(Addr) get_elf_exec_load_bias(const ElfW(Ehdr)* elf) { 484 ElfW(Addr) offset = elf->e_phoff; 485 const ElfW(Phdr)* phdr_table = 486 reinterpret_cast<const ElfW(Phdr)*>(reinterpret_cast<uintptr_t>(elf) + offset); 487 const ElfW(Phdr)* phdr_end = phdr_table + elf->e_phnum; 488 489 for (const ElfW(Phdr)* phdr = phdr_table; phdr < phdr_end; phdr++) { 490 if (phdr->p_type == PT_LOAD) { 491 return reinterpret_cast<ElfW(Addr)>(elf) + phdr->p_offset - phdr->p_vaddr; 492 } 493 } 494 return 0; 495} 496 497/* 498 * This is the entry point for the linker, called from begin.S. This 499 * method is responsible for fixing the linker's own relocations, and 500 * then calling __linker_init_post_relocation(). 501 * 502 * Because this method is called before the linker has fixed it's own 503 * relocations, any attempt to reference an extern variable, extern 504 * function, or other GOT reference will generate a segfault. 505 */ 506extern "C" ElfW(Addr) __linker_init(void* raw_args) { 507 KernelArgumentBlock args(raw_args); 508 509 // AT_BASE is set to 0 in the case when linker is run by iself 510 // so in order to link the linker it needs to calcuate AT_BASE 511 // using information at hand. The trick below takes advantage 512 // of the fact that the value of linktime_addr before relocations 513 // are run is an offset and this can be used to calculate AT_BASE. 514 static uintptr_t linktime_addr = reinterpret_cast<uintptr_t>(&linktime_addr); 515 ElfW(Addr) linker_addr = reinterpret_cast<uintptr_t>(&linktime_addr) - linktime_addr; 516 517#if defined(__clang_analyzer__) 518 // The analyzer assumes that linker_addr will always be null. Make it an 519 // unknown value so we don't have to mark N places with NOLINTs. 520 // 521 // (`+=`, rather than `=`, allows us to sidestep a potential "unused store" 522 // complaint) 523 linker_addr += reinterpret_cast<uintptr_t>(raw_args); 524#endif 525 526 ElfW(Addr) entry_point = args.getauxval(AT_ENTRY); 527 ElfW(Ehdr)* elf_hdr = reinterpret_cast<ElfW(Ehdr)*>(linker_addr); 528 ElfW(Phdr)* phdr = reinterpret_cast<ElfW(Phdr)*>(linker_addr + elf_hdr->e_phoff); 529 530 soinfo linker_so(nullptr, nullptr, nullptr, 0, 0); 531 532 linker_so.base = linker_addr; 533 linker_so.size = phdr_table_get_load_size(phdr, elf_hdr->e_phnum); 534 linker_so.load_bias = get_elf_exec_load_bias(elf_hdr); 535 linker_so.dynamic = nullptr; 536 linker_so.phdr = phdr; 537 linker_so.phnum = elf_hdr->e_phnum; 538 linker_so.set_linker_flag(); 539 540 // Prelink the linker so we can access linker globals. 541 if (!linker_so.prelink_image()) __linker_cannot_link(args.argv[0]); 542 543 // This might not be obvious... The reasons why we pass g_empty_list 544 // in place of local_group here are (1) we do not really need it, because 545 // linker is built with DT_SYMBOLIC and therefore relocates its symbols against 546 // itself without having to look into local_group and (2) allocators 547 // are not yet initialized, and therefore we cannot use linked_list.push_* 548 // functions at this point. 549 if (!linker_so.link_image(g_empty_list, g_empty_list, nullptr)) __linker_cannot_link(args.argv[0]); 550 551#if defined(__i386__) 552 // On x86, we can't make system calls before this point. 553 // We can't move this up because this needs to assign to a global. 554 // Note that until we call __libc_init_main_thread below we have 555 // no TLS, so you shouldn't make a system call that can fail, because 556 // it will SEGV when it tries to set errno. 557 __libc_init_sysinfo(args); 558#endif 559 560 // Initialize the main thread (including TLS, so system calls really work). 561 __libc_init_main_thread(args); 562 563 // We didn't protect the linker's RELRO pages in link_image because we 564 // couldn't make system calls on x86 at that point, but we can now... 565 if (!linker_so.protect_relro()) __linker_cannot_link(args.argv[0]); 566 567 // Initialize the linker's static libc's globals 568 __libc_init_globals(args); 569 570 // store argc/argv/envp to use them for calling constructors 571 g_argc = args.argc; 572 g_argv = args.argv; 573 g_envp = args.envp; 574 575 // Initialize the linker's own global variables 576 linker_so.call_constructors(); 577 578 // If the linker is not acting as PT_INTERP entry_point is equal to 579 // _start. Which means that the linker is running as an executable and 580 // already linked by PT_INTERP. 581 // 582 // This happens when user tries to run 'adb shell /system/bin/linker' 583 // see also https://code.google.com/p/android/issues/detail?id=63174 584 if (reinterpret_cast<ElfW(Addr)>(&_start) == entry_point) { 585 async_safe_format_fd(STDOUT_FILENO, 586 "This is %s, the helper program for dynamic executables.\n", 587 args.argv[0]); 588 exit(0); 589 } 590 591 init_linker_info_for_gdb(linker_addr, kLinkerPath); 592 593 // Initialize static variables. Note that in order to 594 // get correct libdl_info we need to call constructors 595 // before get_libdl_info(). 596 sonext = solist = get_libdl_info(kLinkerPath, linker_so, linker_link_map); 597 g_default_namespace.add_soinfo(solist); 598 599 // We have successfully fixed our own relocations. It's safe to run 600 // the main part of the linker now. 601 args.abort_message_ptr = &g_abort_message; 602 ElfW(Addr) start_address = __linker_init_post_relocation(args); 603 604 INFO("[ Jumping to _start (%p)... ]", reinterpret_cast<void*>(start_address)); 605 606 // Return the address that the calling assembly stub should jump to. 607 return start_address; 608} 609