From patchwork Thu Jan 16 08:33:56 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Florian Weimer X-Patchwork-Id: 37403 Received: (qmail 104388 invoked by alias); 16 Jan 2020 08:34:14 -0000 Mailing-List: contact libc-alpha-help@sourceware.org; run by ezmlm Precedence: bulk List-Id: List-Unsubscribe: List-Subscribe: List-Archive: List-Post: List-Help: , Sender: libc-alpha-owner@sourceware.org Delivered-To: mailing list libc-alpha@sourceware.org Received: (qmail 104373 invoked by uid 89); 16 Jan 2020 08:34:14 -0000 Authentication-Results: sourceware.org; auth=none X-Spam-SWARE-Status: No, score=-18.6 required=5.0 tests=AWL, BAYES_00, GIT_PATCH_0, GIT_PATCH_1, GIT_PATCH_2, GIT_PATCH_3, KAM_SHORT, RCVD_IN_DNSWL_NONE autolearn=ham version=3.3.1 spammy= X-HELO: us-smtp-delivery-1.mimecast.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1579163642; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=ETh0mO3q5n1p4G6YkjDUV3w0J1WJeXPo40OzB/3gpyA=; b=ihAvAYQPfW5FhiNXnsFhnTsAnNtIiVo7WOO7aeGmEDnvn0jjOftIMO19inxTHAo3M1kgLF 3eZlqcmXBRk0eZDXdQ3F3Bbe70s/HbvySwFOJVPBkrw7iQWtlkl9MpxrhGdP2g7/yi71X2 ATqLNm9P2KYKiWTPUik6qyZPa4inwQ8= From: Florian Weimer To: libc-alpha@sourceware.org Subject: [PATCH] elf: Add elf/tst-dlopenfail-2 [BZ #25396] Date: Thu, 16 Jan 2020 09:33:56 +0100 Message-ID: <87y2u7x0jv.fsf@oldenburg2.str.redhat.com> User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/26.3 (gnu/linux) MIME-Version: 1.0 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com This is my non-CET test case for bug 25396. H.J.'s patch on the bug report is the correct fix, I think. Most of elf/tst-dlopenfail-2.c is copied from elf/tst-dlopenfail.c, so I'm including year 2019, too. Thanks, Florian 8<------------------------------------------------------------------8< Without CET, a jump into a newly loaded object through an overwritten link map often does not crash, it just executes some random code. CET detects this in some cases because the function pointer does not point to the start of a function in the replacement shared object, so there is no ENDBR instruction. The new test uses a small shared object and the existing dangling link map to trigger the bug. ----- elf/Makefile | 9 ++++++-- elf/tst-dlopenfail-2.c | 59 ++++++++++++++++++++++++++++++++++++++++++++++++ elf/tst-dlopenfailmod3.c | 17 ++++++++++++++ 3 files changed, 83 insertions(+), 2 deletions(-) Reviewed-by: Siddhesh Poyarekar diff --git a/elf/Makefile b/elf/Makefile index 9b09f09e3c..6c62ed611c 100644 --- a/elf/Makefile +++ b/elf/Makefile @@ -200,7 +200,8 @@ tests += restest1 preloadtest loadfail multiload origtest resolvfail \ tst-debug1 tst-main1 tst-absolute-sym tst-absolute-zero tst-big-note \ tst-unwind-ctor tst-unwind-main tst-audit13 \ tst-sonamemove-link tst-sonamemove-dlopen tst-dlopen-tlsmodid \ - tst-dlopen-self tst-auditmany tst-initfinilazyfail tst-dlopenfail + tst-dlopen-self tst-auditmany tst-initfinilazyfail tst-dlopenfail \ + tst-dlopenfail-2 # reldep9 tests-internal += loadtest unload unload2 circleload1 \ neededtest neededtest2 neededtest3 neededtest4 \ @@ -311,7 +312,7 @@ modules-names = testobj1 testobj2 testobj3 testobj4 testobj5 testobj6 \ tst-auditmanymod7 tst-auditmanymod8 tst-auditmanymod9 \ tst-initlazyfailmod tst-finilazyfailmod \ tst-dlopenfailmod1 tst-dlopenfaillinkmod tst-dlopenfailmod2 \ - tst-ldconfig-ld-mod + tst-dlopenfailmod3 tst-ldconfig-ld-mod # Most modules build with _ISOMAC defined, but those filtered out # depend on internal headers. modules-names-tests = $(filter-out ifuncmod% tst-libc_dlvsym-dso tst-tlsmod%,\ @@ -1645,6 +1646,10 @@ $(objpfx)tst-dlopenfailmod1.so: \ $(shared-thread-library) $(objpfx)tst-dlopenfaillinkmod.so LDFLAGS-tst-dlopenfaillinkmod.so = -Wl,-soname,tst-dlopenfail-missingmod.so $(objpfx)tst-dlopenfailmod2.so: $(shared-thread-library) +$(objpfx)tst-dlopenfail-2: $(libdl) +$(objpfx)tst-dlopenfail.out: \ + $(objpfx)tst-dlopenfailmod1.so $(objpfx)tst-dlopenfailmod2.so \ + $(objpfx)tst-dlopenfailmod3.so $(objpfx)tst-dlopen-nodelete-reloc: $(libdl) $(objpfx)tst-dlopen-nodelete-reloc.out: \ diff --git a/elf/tst-dlopenfail-2.c b/elf/tst-dlopenfail-2.c new file mode 100644 index 0000000000..35bbde64ab --- /dev/null +++ b/elf/tst-dlopenfail-2.c @@ -0,0 +1,59 @@ +/* Test unrelated dlopen after dlopen failure involving NODELETE. + Copyright (C) 2019-2020 Free Software Foundation, Inc. + This file is part of the GNU C Library. + + The GNU C Library is free software; you can redistribute it and/or + modify it under the terms of the GNU Lesser General Public + License as published by the Free Software Foundation; either + version 2.1 of the License, or (at your option) any later version. + + The GNU C Library is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public + License along with the GNU C Library; if not, see + . */ + +#include +#include +#include +#include +#include +#include +#include +#include + +static int +do_test (void) +{ + /* This test uses libpthread as the canonical NODELETE module. If + libpthread is no longer NODELETE because it has been merged into + libc, the test needs to be updated. */ + TEST_VERIFY (dlsym (NULL, "pthread_create") == NULL); + + /* This is expected to fail because of the missing dependency. */ + puts ("info: attempting to load tst-dlopenfailmod1.so"); + TEST_VERIFY (dlopen ("tst-dlopenfailmod1.so", RTLD_LAZY) == NULL); + const char *message = dlerror (); + TEST_COMPARE_STRING (message, + "tst-dlopenfail-missingmod.so:" + " cannot open shared object file:" + " No such file or directory"); + + /* Open a small shared object. With a dangling GL (dl_initfirst) + pointer, this is likely to crash because there is no longer any + mapped text segment there (bug 25396). */ + + puts ("info: attempting to load tst-dlopenfailmod3.so"); + xdlclose (xdlopen ("tst-dlopenfailmod3.so", RTLD_NOW)); + + return 0; +} + +/* Do not perturb the dangling link map. With M_PERTURB, the link map + appears to have l_init_called set, so there are no constructor + calls and no crashes. */ +#define TEST_NO_MALLOPT +#include diff --git a/elf/tst-dlopenfailmod3.c b/elf/tst-dlopenfailmod3.c new file mode 100644 index 0000000000..636e971264 --- /dev/null +++ b/elf/tst-dlopenfailmod3.c @@ -0,0 +1,17 @@ +/* Empty module for the tst-dlopenfail-2 test. + Copyright (C) 2020 Free Software Foundation, Inc. + This file is part of the GNU C Library. + + The GNU C Library is free software; you can redistribute it and/or + modify it under the terms of the GNU Lesser General Public + License as published by the Free Software Foundation; either + version 2.1 of the License, or (at your option) any later version. + + The GNU C Library is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public + License along with the GNU C Library; if not, see + . */