9 Sep
2022
9 Sep
'22
6:30 p.m.
Xtensa PERFORM_BOOTSTRAP_GOT macro uses mprotect to make bits of GOT
writable, but noMMU linux kernel returns ENOSYS to mprotect syscalls,
and syscall wrapper tries to update errno with the error code. This
happens well before the relocations are done and results in writes to
unrelated locations, memory corruption or protection violations.
Split GOT protection update from PERFORM_BOOTSTRAP_GOT and only do it
when building configuration with MMU support.
Signed-off-by: Max Filippov <jcmvbkbc(a)gmail.com>
---
ldso/ldso/xtensa/dl-startup.h | 17 ++++++++++++++---
1 file changed, 14 insertions(+), 3 deletions(-)
diff --git a/ldso/ldso/xtensa/dl-startup.h b/ldso/ldso/xtensa/dl-startup.h
index db223feadc90..19955ffc77a5 100644
--- a/ldso/ldso/xtensa/dl-startup.h
+++ b/ldso/ldso/xtensa/dl-startup.h
@@ -88,12 +88,11 @@ __asm__ (
/* Function calls are not safe until the GOT relocations have been done. */
#define NO_FUNCS_BEFORE_BOOTSTRAP
-#define PERFORM_BOOTSTRAP_GOT(tpnt) \
+#if defined(__ARCH_USE_MMU__)
+#define PERFORM_BOOTSTRAP_GOT_ADJUST_PROTECTION(tpnt) \
do { \
xtensa_got_location *got_loc; \
unsigned long l_addr = tpnt->loadaddr; \
- Elf32_Word relative_count; \
- unsigned long rel_addr; \
Elf32_Addr prev_got_start = 0, prev_got_end = 0; \
int x; \
\
@@ -125,7 +124,19 @@ do { \
prev_got_end - prev_got_start, \
PROT_READ | PROT_WRITE | PROT_EXEC); \
} \
+} while (0)
+#else
+#define PERFORM_BOOTSTRAP_GOT_ADJUST_PROTECTION(tpnt) \
+do { \
+} while (0)
+#endif
+
+#define PERFORM_BOOTSTRAP_GOT(tpnt) \
+do { \
+ Elf32_Word relative_count; \
+ unsigned long rel_addr; \
\
+ PERFORM_BOOTSTRAP_GOT_ADJUST_PROTECTION(tpnt); \
/* The following is a stripped down version of the code following \
the invocation of PERFORM_BOOTSTRAP_GOT in dl-startup.c. That \
code is skipped when PERFORM_BOOTSTRAP_GOT is defined, so it has \
--
2.30.2