diff mbox series

[v7,12/16] elf: Fix initial-exec TLS access on audit modules (BZ #28096)

Message ID 20211222132712.523295-13-adhemerval.zanella@linaro.org
State Superseded
Headers
Series Multiple rtld-audit fixes |

Checks

Context Check Description
dj/TryBot-apply_patch success Patch applied to master at the time it was sent

Commit Message

Adhemerval Zanella Dec. 22, 2021, 1:27 p.m. UTC 
  For audit modules or dependencies with initial-exec TLS, we can not
set the initial TLS image on default loader initialization because it
would already be set by the audit setup.  However, subsequent thread
creation would need to follow the default behaviour.

This patch fixes by making_dl_new_object sets a new link_map flag
'l_dont_set_tls_static' for namespaces different than the default
one.  The flag is later reset on _dl_allocate_tls_init.

Checked on x86_64-linux-gnu, i686-linux-gnu, and aarch64-linux-gnu.
---
 elf/Makefile          |  8 +++++
 elf/dl-object.c       |  3 ++
 elf/dl-tls.c          | 16 ++++++---
 elf/rtld.c            |  2 ++
 elf/tst-audit21.c     | 42 +++++++++++++++++++++++
 elf/tst-auditmod21a.c | 80 +++++++++++++++++++++++++++++++++++++++++++
 elf/tst-auditmod21b.c | 22 ++++++++++++
 include/link.h        |  2 ++
 8 files changed, 171 insertions(+), 4 deletions(-)
 create mode 100644 elf/tst-audit21.c
 create mode 100644 elf/tst-auditmod21a.c
 create mode 100644 elf/tst-auditmod21b.c

Comments

Florian Weimer Dec. 24, 2021, 5:17 p.m. UTC | #1 
* Adhemerval Zanella:

> For audit modules or dependencies with initial-exec TLS, we can not
> set the initial TLS image on default loader initialization because it
> would already be set by the audit setup.  However, subsequent thread
> creation would need to follow the default behaviour.
>
> This patch fixes by making_dl_new_object sets a new link_map flag
> 'l_dont_set_tls_static' for namespaces different than the default
> one.  The flag is later reset on _dl_allocate_tls_init.

Typo: making[ ]dl_new-object

> diff --git a/elf/dl-object.c b/elf/dl-object.c
> index 1875599eb2..f3d637ac27 100644
> --- a/elf/dl-object.c
> +++ b/elf/dl-object.c
> @@ -175,6 +175,9 @@ _dl_new_object (char *realname, const char *libname, int type,
>  
>    new->l_local_scope[0] = &new->l_searchlist;
>  
> +  if (nsid != LM_ID_BASE)
> +    new->l_dont_set_tls_static = 1;
> +
>    /* Determine the origin.  If allocating the link map for the main
>       executable, the realname is not known and "".  In this case, the
>       origin needs to be determined by other means.  However, in case
> diff --git a/elf/dl-tls.c b/elf/dl-tls.c
> index 273f60f233..89200ccc48 100644
> --- a/elf/dl-tls.c
> +++ b/elf/dl-tls.c
> @@ -593,10 +593,18 @@ _dl_allocate_tls_init (void *result)
>  	     some platforms use in static programs requires it.  */
>  	  dtv[map->l_tls_modid].pointer.val = dest;
>  
> -	  /* Copy the initialization image and clear the BSS part.  */
> -	  memset (__mempcpy (dest, map->l_tls_initimage,
> -			     map->l_tls_initimage_size), '\0',
> -		  map->l_tls_blocksize - map->l_tls_initimage_size);
> +	  /* Copy the initialization image and clear the BSS part.  For
> +	     audit modules or depedencies with initial-exec TLS, we can not
> +	     set the initial TLS image on default loader initialization
> +	     because it would already be set by the audit setup.  However,
> +	     subsequent thread creation would need to follow the default
> +	     behaviour.   */
> +	  if (__glibc_unlikely (!map->l_dont_set_tls_static))
> +	    memset (__mempcpy (dest, map->l_tls_initimage,
> +			       map->l_tls_initimage_size), '\0',
> +		    map->l_tls_blocksize - map->l_tls_initimage_size);
> +	  else
> +	    map->l_dont_set_tls_static = 0;
>  	}

Wouldn't it be simpler to skip the memcpy/memset for non-base namespaces
if a flag is pased to _dl_allocate_tls_init?  I still don't think it's
the status as an audit module what matters here, it applies to
everything that is loaded through the dlopen implementation (as opposed
to _dl_map_object_deps for the main executable).

Thanks,
Florian
Adhemerval Zanella Dec. 27, 2021, 8:13 p.m. UTC | #2 
On 24/12/2021 14:17, Florian Weimer wrote:
> * Adhemerval Zanella:
> 
>> For audit modules or dependencies with initial-exec TLS, we can not
>> set the initial TLS image on default loader initialization because it
>> would already be set by the audit setup.  However, subsequent thread
>> creation would need to follow the default behaviour.
>>
>> This patch fixes by making_dl_new_object sets a new link_map flag
>> 'l_dont_set_tls_static' for namespaces different than the default
>> one.  The flag is later reset on _dl_allocate_tls_init.
> 
> Typo: making[ ]dl_new-object

Ack.

> 
>> diff --git a/elf/dl-object.c b/elf/dl-object.c
>> index 1875599eb2..f3d637ac27 100644
>> --- a/elf/dl-object.c
>> +++ b/elf/dl-object.c
>> @@ -175,6 +175,9 @@ _dl_new_object (char *realname, const char *libname, int type,
>>  
>>    new->l_local_scope[0] = &new->l_searchlist;
>>  
>> +  if (nsid != LM_ID_BASE)
>> +    new->l_dont_set_tls_static = 1;
>> +
>>    /* Determine the origin.  If allocating the link map for the main
>>       executable, the realname is not known and "".  In this case, the
>>       origin needs to be determined by other means.  However, in case
>> diff --git a/elf/dl-tls.c b/elf/dl-tls.c
>> index 273f60f233..89200ccc48 100644
>> --- a/elf/dl-tls.c
>> +++ b/elf/dl-tls.c
>> @@ -593,10 +593,18 @@ _dl_allocate_tls_init (void *result)
>>  	     some platforms use in static programs requires it.  */
>>  	  dtv[map->l_tls_modid].pointer.val = dest;
>>  
>> -	  /* Copy the initialization image and clear the BSS part.  */
>> -	  memset (__mempcpy (dest, map->l_tls_initimage,
>> -			     map->l_tls_initimage_size), '\0',
>> -		  map->l_tls_blocksize - map->l_tls_initimage_size);
>> +	  /* Copy the initialization image and clear the BSS part.  For
>> +	     audit modules or depedencies with initial-exec TLS, we can not
>> +	     set the initial TLS image on default loader initialization
>> +	     because it would already be set by the audit setup.  However,
>> +	     subsequent thread creation would need to follow the default
>> +	     behaviour.   */
>> +	  if (__glibc_unlikely (!map->l_dont_set_tls_static))
>> +	    memset (__mempcpy (dest, map->l_tls_initimage,
>> +			       map->l_tls_initimage_size), '\0',
>> +		    map->l_tls_blocksize - map->l_tls_initimage_size);
>> +	  else
>> +	    map->l_dont_set_tls_static = 0;
>>  	}
> 
> Wouldn't it be simpler to skip the memcpy/memset for non-base namespaces
> if a flag is pased to _dl_allocate_tls_init?  I still don't think it's
> the status as an audit module what matters here, it applies to
> everything that is loaded through the dlopen implementation (as opposed
> to _dl_map_object_deps for the main executable).

It does make sense, and I think the extra argument flag is not really
required (it requires only to check if the map namespace is no the
base one).  I will change and resend it.
diff mbox series

Patch

diff --git a/elf/Makefile b/elf/Makefile
index 3891576bc8..97fa75ff5e 100644
--- a/elf/Makefile
+++ b/elf/Makefile
@@ -233,6 +233,7 @@  tests += restest1 preloadtest loadfail multiload origtest resolvfail \
 	 tst-audit18 \
 	 tst-audit19b \
 	 tst-audit20 \
+	 tst-audit21 \
 	 tst-rtld-run-static \
 #	 reldep9
 tests-internal += loadtest unload unload2 circleload1 \
@@ -384,6 +385,8 @@  modules-names = testobj1 testobj2 testobj3 testobj4 testobj5 testobj6 \
 		tst-auditmod19b \
 		tst-audit19bmod \
 		tst-auditmod20 \
+		tst-auditmod21a \
+		tst-auditmod21b \
 
 # Most modules build with _ISOMAC defined, but those filtered out
 # depend on internal headers.
@@ -1599,6 +1602,11 @@  tst-audit19b-ARGS = -- $(host-test-program-cmd)
 $(objpfx)tst-audit20.out: $(objpfx)tst-auditmod20.so
 tst-audit20-ENV = LD_AUDIT=$(objpfx)tst-auditmod20.so
 
+$(objpfx)tst-audit21: $(shared-thread-library)
+$(objpfx)tst-audit21.out: $(objpfx)tst-auditmod21a.so
+$(objpfx)tst-auditmod21a.so: $(objpfx)tst-auditmod21b.so
+tst-audit21-ENV = LD_AUDIT=$(objpfx)tst-auditmod21a.so
+
 # tst-sonamemove links against an older implementation of the library.
 LDFLAGS-tst-sonamemove-linkmod1.so = \
   -Wl,--version-script=tst-sonamemove-linkmod1.map \
diff --git a/elf/dl-object.c b/elf/dl-object.c
index 1875599eb2..f3d637ac27 100644
--- a/elf/dl-object.c
+++ b/elf/dl-object.c
@@ -175,6 +175,9 @@  _dl_new_object (char *realname, const char *libname, int type,
 
   new->l_local_scope[0] = &new->l_searchlist;
 
+  if (nsid != LM_ID_BASE)
+    new->l_dont_set_tls_static = 1;
+
   /* Determine the origin.  If allocating the link map for the main
      executable, the realname is not known and "".  In this case, the
      origin needs to be determined by other means.  However, in case
diff --git a/elf/dl-tls.c b/elf/dl-tls.c
index 273f60f233..89200ccc48 100644
--- a/elf/dl-tls.c
+++ b/elf/dl-tls.c
@@ -593,10 +593,18 @@  _dl_allocate_tls_init (void *result)
 	     some platforms use in static programs requires it.  */
 	  dtv[map->l_tls_modid].pointer.val = dest;
 
-	  /* Copy the initialization image and clear the BSS part.  */
-	  memset (__mempcpy (dest, map->l_tls_initimage,
-			     map->l_tls_initimage_size), '\0',
-		  map->l_tls_blocksize - map->l_tls_initimage_size);
+	  /* Copy the initialization image and clear the BSS part.  For
+	     audit modules or depedencies with initial-exec TLS, we can not
+	     set the initial TLS image on default loader initialization
+	     because it would already be set by the audit setup.  However,
+	     subsequent thread creation would need to follow the default
+	     behaviour.   */
+	  if (__glibc_unlikely (!map->l_dont_set_tls_static))
+	    memset (__mempcpy (dest, map->l_tls_initimage,
+			       map->l_tls_initimage_size), '\0',
+		    map->l_tls_blocksize - map->l_tls_initimage_size);
+	  else
+	    map->l_dont_set_tls_static = 0;
 	}
 
       total += cnt;
diff --git a/elf/rtld.c b/elf/rtld.c
index b215ce6909..0a5e5be6e0 100644
--- a/elf/rtld.c
+++ b/elf/rtld.c
@@ -1057,6 +1057,8 @@  ERROR: audit interface '%s' requires version %d (maximum supported version %d);
 
   /* Mark the DSO as being used for auditing.  */
   dlmargs.map->l_auditing = 1;
+  /* Mark the DSO to not clear the TLS bss in tls initialization.  */
+  dlmargs.map->l_dont_set_tls_static = 1;
 }
 
 /* Load all audit modules.  */
diff --git a/elf/tst-audit21.c b/elf/tst-audit21.c
new file mode 100644
index 0000000000..307cb6fc3b
--- /dev/null
+++ b/elf/tst-audit21.c
@@ -0,0 +1,42 @@ 
+/* Check DT_AUDIT with static TLS.
+   Copyright (C) 2021 Free Software Foundation, Inc.
+   This file is part of the GNU C Library.
+
+   The GNU C Library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 2.1 of the License, or (at your option) any later version.
+
+   The GNU C Library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with the GNU C Library; if not, see
+   <https://www.gnu.org/licenses/>.  */
+
+#include <ctype.h>
+#include <support/xthread.h>
+#include <support/check.h>
+
+static volatile __thread int out __attribute__ ((tls_model ("initial-exec")));
+
+static void *
+tf (void *arg)
+{
+  TEST_COMPARE (out, 0);
+  out = isspace (' ');
+  return NULL;
+}
+
+int main (int argc, char *argv[])
+{
+  TEST_COMPARE (out, 0);
+  out = isspace (' ');
+
+  pthread_t t = xpthread_create (NULL, tf, NULL);
+  xpthread_join (t);
+
+  return 0;
+}
diff --git a/elf/tst-auditmod21a.c b/elf/tst-auditmod21a.c
new file mode 100644
index 0000000000..f00470e105
--- /dev/null
+++ b/elf/tst-auditmod21a.c
@@ -0,0 +1,80 @@ 
+/* Check DT_AUDIT with static TLS.
+   Copyright (C) 2021 Free Software Foundation, Inc.
+   This file is part of the GNU C Library.
+
+   The GNU C Library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 2.1 of the License, or (at your option) any later version.
+
+   The GNU C Library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with the GNU C Library; if not, see
+   <https://www.gnu.org/licenses/>.  */
+
+#include <ctype.h>
+#include <stdlib.h>
+#include <link.h>
+
+#define tls_ie __attribute__ ((tls_model ("initial-exec")))
+
+__thread int tls_var0 tls_ie;
+__thread int tls_var1 tls_ie = 0x10;
+
+/* Defined at tst-auditmod21b.so  */
+extern __thread int tls_var2;
+extern __thread int tls_var3;
+
+static volatile int out;
+
+static void
+call_libc (void)
+{
+  /* isspace access the initial-exec glibc TLS variables, which are
+     setup in glibc initialization.  */
+  out = isspace (' ');
+}
+
+unsigned int
+la_version (unsigned int v)
+{
+  tls_var0 = 0x1;
+  if (tls_var1 != 0x10)
+    abort ();
+  tls_var1 = 0x20;
+
+  tls_var2 = 0x2;
+  if (tls_var3 != 0x20)
+    abort ();
+  tls_var3 = 0x40;
+
+  call_libc ();
+
+  return LAV_CURRENT;
+}
+
+unsigned int
+la_objopen (struct link_map* map, Lmid_t lmid, uintptr_t* cookie)
+{
+  call_libc ();
+  *cookie = (uintptr_t) map;
+  return 0;
+}
+
+void
+la_activity (uintptr_t* cookie, unsigned int flag)
+{
+  if (tls_var0 != 0x1 || tls_var1 != 0x20)
+    abort ();
+  call_libc ();
+}
+
+void
+la_preinit (uintptr_t* cookie)
+{
+  call_libc ();
+}
diff --git a/elf/tst-auditmod21b.c b/elf/tst-auditmod21b.c
new file mode 100644
index 0000000000..550f858b1d
--- /dev/null
+++ b/elf/tst-auditmod21b.c
@@ -0,0 +1,22 @@ 
+/* Check DT_AUDIT with static TLS.
+   Copyright (C) 2021 Free Software Foundation, Inc.
+   This file is part of the GNU C Library.
+
+   The GNU C Library is free software; you can redistribute it and/or
+   modify it under the terms of the GNU Lesser General Public
+   License as published by the Free Software Foundation; either
+   version 2.1 of the License, or (at your option) any later version.
+
+   The GNU C Library is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+   Lesser General Public License for more details.
+
+   You should have received a copy of the GNU Lesser General Public
+   License along with the GNU C Library; if not, see
+   <https://www.gnu.org/licenses/>.  */
+
+#define tls_ie __attribute__ ((tls_model ("initial-exec")))
+
+__thread int tls_var2 tls_ie;
+__thread int tls_var3 tls_ie = 0x20;
diff --git a/include/link.h b/include/link.h
index 6a9f788d2b..ba4c588873 100644
--- a/include/link.h
+++ b/include/link.h
@@ -195,6 +195,8 @@  struct link_map
     unsigned int l_need_tls_init:1; /* Nonzero if GL(dl_init_static_tls)
 				       should be called on this link map
 				       when relocation finishes.  */
+    unsigned int l_dont_set_tls_static:1; /* Non zero if static TLS setup should
+					     not be initialized.  */
     unsigned int l_auditing:1;	/* Nonzero if the DSO is used in auditing.  */
     unsigned int l_audit_any_plt:1; /* Nonzero if at least one audit module
 				       is interested in the PLT interception.*/