summaryrefslogtreecommitdiff
path: root/libexec/ld.so/loader.c
AgeCommit message (Collapse)Author
2019-12-17Don't look up env variables until we know we'll trust them. Otherwise,Philip Guenther
just delete them without looking. ok millert@
2019-12-11ld.so may fail to remove the LD_LIBRARY_PATH environment variable forTodd C. Miller
set-user-ID and set-group-ID executables in low memory conditions. Reported by Qualys
2019-12-07Disable ltrace for objects linked with -znow, as at least on amd64, linkingPhilip Guenther
that was deletes the lazy relocation trampoline which ltrace currently depends on problem reported by tb@ directional feedback kettenis@ ok mpi@
2019-10-04Convert the child_list member from a linked list to a vector.Philip Guenther
ok mpi@
2019-10-03Use a better algorithm for calculating the grpsym library order.Philip Guenther
The existing code did a full recursive walk for O(horrible). Instead, keep a single list of nodes plus the index of the first node whose children haven't been scanned; lookup until that index catches the end, appending the unscanned children of the node at the index. This also makes the grpsym list order match that calculated by FreeBSD and glibc in dependency trees with inconsistent ordering of dependent libs. To make this easier and more cache friendly, convert grpsym_list to a vector: the size is bounded by the number of objects currently loaded. Other, related fixes: * increment the grpsym generation number _after_ pushing the loading object onto its grpsym list, to avoid double counting it * increment the grpsym generation number when building the grpsym list for an already loaded object that's being dlopen()ed, to avoid incomplete grpsym lists * use a more accurate test of whether an object already has a grpsym list Prompted by a diff from Nathanael Rensen (nathanael (at) list.polymorpheus.com) that pointed to _dl_cache_grpsym_list() as a performance bottleneck. Much proding from robert@, sthen@, aja@, jca@ no problem reports after being in snaps ok mpi@
2019-08-06Factor out TEXTREL mprotecting from the per-arch files into _dl_rtld(),Philip Guenther
hiding the actual grotty bits in inline functions ok mpi@
2019-08-04Simplify _dl_find_symbol(). Currently, it returns three values:Philip Guenther
- the symbol it found, returned via the second argument - the base offset of the the object it was found in, via the return value - optionally: the object it was found in, returned via the last argument Instead, return a struct with the symbol and object pointers and let the caller get the base offset from the object's obj_base member. On at least aarch64, amd64, mips64, powerpc, and sparc64, a two word struct like this is passed in registers. ok mpi@, kettenis@
2019-07-21In 2004, we upgraded to binutils 2.14 with did -zcombreloc by default.Philip Guenther
In 2013, I implemented the single-entry LRU cache that gets the maximal symbol reuse from combreloc. Since then, the ld.so generic relocation symcache has been a waste of CPU and memory with 0% hit-rate, so kill it. ok mpi@
2019-06-07make gc workaround compile on non-clangTheo de Raadt
2019-06-04Disable the unmapping of ld.so's boot data for now, as boehm-gc apparentlyPhilip Guenther
follows some pointer into the middle of it. Best to keep things working while tracking down the wonkiness. problem noted by naddy@
2019-05-12Indentation fixPhilip Guenther
2019-05-11Prune visited leaves when walking dependencies to call init functions inPhilip Guenther
topological sort order, reducing it to O(n) from O(2^n) (ouch!) diff from Nathanael Rensen (nathanael(at)list.polymorpheus.com) Much testing and pleading by robert@ and ajacoutot@ ok drahn@ mpi@
2019-05-10ld.so boot cleanup support:Philip Guenther
- put functions and data which are only used before calling the executable's start function into their own page-aligned segments for unmapping (only done on amd64, arm64, armv7, powerpc, and sparc64 so far) - pass .init_array and .preinit_array functions an addition argument which is a callback to get a structure which includes a function that frees the boot text and data - sometimes delay doing RELRO processing: for a shared-object marked DF_1_INITFIRST do it after the object's .init_array, for the executable do it after the .preinit_array - improve test-ld.so to link against libpthread and trigger its initialization late libc changes to use this will come later ok kettenis@
2018-12-03DT_MIPS_RLD_MAP is an offset, so relocate it when present.Philip Guenther
This fixes handling of lld-linked executables on mips64. problem reported by visa@ and worked out with him
2018-11-20On mips64, DT_DEBUG doesn't need mprotecting if it's in the GNU_RELRO segmentPhilip Guenther
ok visa@
2018-11-16Finish ld.so's transition to GNU_RELRO: eliminate support for usingPhilip Guenther
__got_{start,end} to find a region to mark read-only. It was only used for binaries that didn't have a GNU_RELRO segment, but all archs have been using that for over a year. Since support for insecure-PLT layouts on powerpc and alpha have been removed, all archs handle GNU_RELRO the same way and the support can be moved from the MD code to the MI code. ok mpi@
2018-10-23Delay processing of ld.so's own PT_GNU_RELRO section until after environmentPhilip Guenther
processing and malloc initialization, and then move variables set by those steps, including malloc's mopts structure, into the .data.rel.ro segment. This protects more data and eliminates the extra padding of the mopts. ok kettenis@
2018-10-22Use int, not char*, for booleansPhilip Guenther
ok millert@
2017-12-08Everyone knows this as ld.so, nor by the ancient name rtld.Theo de Raadt
ok guenther
2017-10-26If LD_BIND_NOW is in force then all relocations are performed eagerly,Philip Guenther
when the object is loaded. Since kbind(2) will never be used in that case, disable it early, before invoking any library or application code. ok deraadt@ kettenis@
2017-02-08Provide size-generic ELF_NO_ADDR in <sys/exec_elf.h> and use that insteadPhilip Guenther
of ELFDEFNNAME(NO_ADDR) ok jca@
2017-01-24On fatal errors, kill ourselves with thrkill(0,9,NULL) instead ofPhilip Guenther
simply exiting, via helper functions _dl_die(), _dl_diedie(), and _dl_oom(). prompted by a complaint from jsing@ ok jsing@ deraadt@
2017-01-09Remove dependency on __got_{start,end} symbols and look at PT_GNU_RELROMark Kettenis
instead. Result in a few more pages that aren't writable on some platforms (such as hppa). Based on an initial diff from guenther@. Thanks to deraadt@ for testing. ok guenther@
2016-08-28fix a commentPhilip Guenther
2016-08-23Implement support for DT_INIT_ARRAY, DT_FINI_ARRAY and DT_PREINIT_ARRAY.Mark Kettenis
Don't skip DT_INIT and DT_FINI for the main executable. This matches what Linux and Solaris do. ok guenther@
2016-08-14Mark the relro/got section as read-only before setting up the environmentPhilip Guenther
to minimize the amount of code run without it RO.
2016-08-12the slimmed down random functions inside ld.so are strict clones of theTheo de Raadt
libc arc4random API, so call them _dl_{arc4random,arcrandombuf} ok tedu guenther
2016-08-08Look for a PT_GNU_RELRO section per object and, if present, mprotect thatPhilip Guenther
range instead of the [__got_start, __got_end) range. On many archs this will cover _DYNAMIC too, so move up the DT_DEBUG handling to before relocations and the mprotect are done. ok kettenis@
2016-07-04Remove prebind support: binding to symbol table indices is too fragilePhilip Guenther
for our development process. ok kettenis@ deraadt@
2016-06-08Some ELF ABIs still require a PLT that is both writable and executable. ToMark Kettenis
avoid W^X violations, initially map such segments as writable and non-executable, and change the mapping to non-writable and executable after initial relocation processing. As a side-benefit this means we no longer depend on the __plt_start and __plt_end to make the PLT read-only after relocation processing. This will break binaries linked with ld -Z, most notably emacs, on some of our architectures. ok deraadt@, guenther@
2016-06-05Avoid W^X violation when setting DT_DEBUG on mips64.Mark Kettenis
ok deraadt@
2016-05-07Use a Thread Information Block in both single and multi-threaded programs.Philip Guenther
This stores errno, the cancelation flags, and related bits for each thread and is allocated by ld.so or libc.a. This is an ABI break from 5.9-stable! Make libpthread dlopen'able by moving the cancelation wrappers into libc and doing locking and fork/errno handling via callbacks that libpthread registers when it first initializes. 'errno' *must* be declared via <errno.h> now! Clean up libpthread's symbol exports like libc. On powerpc, offset the TIB/TCB/TLS data from the register per the ELF spec. Testing by various, particularly sthen@ and patrick@ ok kettenis@
2016-03-24Unbreak arm and m88k: COPY relocations for weak symbols that are overloadedPhilip Guenther
with strong symbols in ld.so don't do what we need, so put definitions back in crt0 and make ld.so update __progname like it does environ. report and testing patrick@ jsg@
2016-03-20Export environ and __progname, making the latter a copy of just the filenamePhilip Guenther
portion like crt0 does. This is prep for eliminating _dl_fixup_user_env() Mark almost everything in resolve.h as hidden, to improve code generation. ok kettenis@ mpi@ "good time" deraadt@
2015-11-15ldd(1) sets environment variable LD_TRACE_LOADED_OBJECTS to tell ld.soTheo de Raadt
that it should show information about the program it loads, rather than run it. In that specific case, ld.so can pledge to "stdio rpath" to ensure that code path in ld.so has no bugs. Yes, a pledge in ld.so.... who'd have thought! ok guenther
2015-08-18_dl_malloc() proto exists, do not cast resultTheo de Raadt
2015-05-06Fix a memory leak in _dl_load_dep_libs()Jonathan Gray
ok otto@ guenther@
2015-01-22delete annoying white space that annoyTheo de Raadt
2015-01-16<sys/param.h> to <limits.h> conversion. Verified binariesTheo de Raadt
ok millert, thanks to doug for process advice
2014-11-03Eliminate RTLD_PROTECT_PLT: ld.so is built with -Bsymbolic so thePhilip Guenther
PLT is empty/unused. On at least macppc and sparc64, ld.so's attempt to mprotect its PLT could instead hit its own allocated data and cause a segfault shortly there after. While here, take a shot at preventing the same issue with the GOT by checking for __got_start != __got_end. reproduction *with ktracing* by afresh1@ provided the key data ok miod@ deraadt@
2014-07-10check all memory allocations; ok miod@ guenther@Otto Moerbeek
2014-07-06allocate two things, test two pointers; ok miod@ guenther@Otto Moerbeek
2014-06-21Move to a non-zeroing _dl_malloc, a _dl_calloc and _dl_reallocarry andOtto Moerbeek
fix _dl_strdup to return NULL instead of crash; ok deraadt@
2014-02-16Unbreak ld.so with ssp-strong/all on sparc64 and powerpc. With theMartynas Venckus
new SSP logic it additionally protects functions which have their local addresses taken of, and _dl_boot_bind() gets selected. We have to go through GOT to reach __guard_local, however it hasn't been relocated yet. So add boot.c and don't protect everything up to the point until it has been relocated and no longer needs the loff adjustment. OK matthew@. Full build done & tested by florian@.
2014-01-23Remove LD_NORANDOM feature. It serves no usable purpose. DeterminismTheo de Raadt
in this one specific area is not going to help debugging, because so many other parts are non-deterministic. ok guenthre matthew jsing
2014-01-18Make ld.so pass its cleanup handler in $2 as required by the MIPS System VMark Kettenis
ABI, and completely remove the code that attempts to call atexit(3) directly.
2013-12-25Pass _dl_dtors as the csu cleanup routine on shMiod Vallat
2013-12-25Pass _dl_dtors as the csu cleanup routine on arm.Miod Vallat
2013-12-25Pass _dl_dtors as the csu cleanup routine on m68k and m88k; change theMiod Vallat
conditional in the MI code to only list the architectures left to adapt.
2013-12-25Make ld.so pass its cleanup handler in %g1 as required by the SPARC System VMark Kettenis
ABI, and stop calling atexit(4) directly from ld.so on sparc.
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-22 10:05:51 +0000