From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.2 (2018-09-13) on inbox.vuxu.org X-Spam-Level: X-Spam-Status: No, score=-3.0 required=5.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,RCVD_IN_DNSWL_MED,RCVD_IN_MSPIKE_H3, RCVD_IN_MSPIKE_WL autolearn=ham autolearn_force=no version=3.4.2 Received: from mother.openwall.net (mother.openwall.net [195.42.179.200]) by inbox.vuxu.org (OpenSMTPD) with SMTP id e4f673e8 for ; Wed, 26 Feb 2020 22:02:55 +0000 (UTC) Received: (qmail 23992 invoked by uid 550); 26 Feb 2020 22:02:53 -0000 Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Reply-To: musl@lists.openwall.com Received: (qmail 23974 invoked from network); 26 Feb 2020 22:02:53 -0000 Date: Wed, 26 Feb 2020 17:02:40 -0500 From: Rich Felker To: musl@lists.openwall.com Message-ID: <20200226220240.GC11469@brightrain.aerifal.cx> References: <20200226052448.GA2769@voyager> <20200226173621.GA11469@brightrain.aerifal.cx> <20200226201202.GB2769@voyager> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20200226201202.GB2769@voyager> User-Agent: Mutt/1.5.21 (2010-09-15) Subject: Re: [musl] [PATCH] Add REL_COPY size change detection On Wed, Feb 26, 2020 at 09:12:02PM +0100, Markus Wichmann wrote: > On Wed, Feb 26, 2020 at 12:36:21PM -0500, Rich Felker wrote: > > In theory copy relocations should have been gone for everyone who > > switched to PIE, but then the gcc/binutils folks brought them back as > > an "optimization" (allowing pc-rel access to external symbols). :-( > > > > Several quotes about optimization come to mind. Especially ones with the > word "premature" in them. > > I just checked and I saw that there are no copy relocs in my libraries, > but my binaries are indeed PIEs. Therefore I have to conclude that gcc > compiles PIE and PIC differently. Weren't they meant to be the same, > except maybe for the selection of object files during the linker phase? Libraries inherently can't have copy relocations. Only the main program can. > > At the very least I think we ought to catch and error on the case > > where def.sym->st_size>sym->st_size, since we can't honor it and > > failure to honor it can produce silent memory corruption. I'm less > > sure about what to do if def.sym->st_sizest-size; this case > > seems safe and might be desirable not to break (I vaguely recall an > > intent that it be ok), but if you think there are reasons it's > > dangerous I'm ok with disallowing it too. I'm having a hard time now > > thinking of a reason it would really help to support that, anyway. > > > > If the application did import sym->st_size bytes, it probably wanted to > do something with them. Not really. For example: extern char *strings[]; extern size_t nstrings; This type of thing was common with historical mistakes like sys_errlist, the equivalent for signals, etc., where the application either had an out-of-band way of knowing the runtime-provided size, or it could just assume all indices it got from the library were in-bounds to access the array. It went out of fashion entirely because of copy relocations breaking it. > > Missing , after name, and the indent is weird (2 extra levels). I'd > > either align (spaces) with the opening paren or use just one indent > > level, and fewer lines. > > The missing comma is weird. Must have gone missing as I was cutting that > line down to size (originally, I had this as one line, but then it was > around 200 columns long, and I thought that was a bit excessive). So > then I tried to stay below 80 and you see the result before you. > > The indent was just vim's default setting. Usually this suits me, but > usually I have shiftwidth=4 and expandtab. For musl, it's sw=8 and noet. > > > Semantically, st_size is size_t not ulong, so I'd probably lean > > towards a cast to (size_t) here with %zu. > > Isn't on Linux size_t always a ulong? I will admit I only went for ulong > because it's easier to write the cast. Yes, but the ldso code doesn't use that assumption, or at least it's not intended to. It's used to some extent elsewhere in the syscall glue framework. Rich