[musl] [PATCH] before __dls2b, call mprotect with __syscall

[musl] [PATCH] before __dls2b, call mprotect with __syscall

[Alex Xu (Hello71)]

if LTO is enabled, gcc hoists the call to ___errno_location outside the
loop even though the access to errno is gated behind head != &ldso
because ___errno_location is marked __attribute__((const)). this causes
the program to crash because TLS is not yet initialized when called from
__dls2. this is also possible if LTO is not enabled; even though gcc 11
doesn't do it, it is still wrong to use errno here.

since the start and end are already aligned, we can simply call
__syscall instead of using global errno.

Fixes: e13a2b8953ef ("implement PT_GNU_RELRO support")
---

I think this doesn't necessarily need to go in the next release, just
sending it out for review.

 ldso/dynlink.c | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/ldso/dynlink.c b/ldso/dynlink.c
index 5b9c8be4..b5a8f1f2 100644
--- a/ldso/dynlink.c
+++ b/ldso/dynlink.c
@@ -1356,12 +1356,14 @@ static void reloc_all(struct dso *p)
 		do_relocs(p, laddr(p, dyn[DT_REL]), dyn[DT_RELSZ], 2);
 		do_relocs(p, laddr(p, dyn[DT_RELA]), dyn[DT_RELASZ], 3);
 
-		if (head != &ldso && p->relro_start != p->relro_end &&
-		    mprotect(laddr(p, p->relro_start), p->relro_end-p->relro_start, PROT_READ)
-		    && errno != ENOSYS) {
-			error("Error relocating %s: RELRO protection failed: %m",
-				p->name);
-			if (runtime) longjmp(*rtld_fail, 1);
+		if (head != &ldso && p->relro_start != p->relro_end) {
+			long ret = __syscall(SYS_mprotect, laddr(p, p->relro_start),
+				p->relro_end-p->relro_start, PROT_READ);
+			if (ret != 0 && ret != -ENOSYS) {
+				error("Error relocating %s: RELRO protection failed: %m",
+					p->name);
+				if (runtime) longjmp(*rtld_fail, 1);
+			}
 		}
 
 		p->relocated = 1;
-- 
2.35.1

Re: [musl] [PATCH] before __dls2b, call mprotect with __syscall

[Rich Felker]

On Thu, Jun 30, 2022 at 01:52:43PM -0400, Alex Xu (Hello71) wrote:
> if LTO is enabled, gcc hoists the call to ___errno_location outside the
> loop even though the access to errno is gated behind head != &ldso
> because ___errno_location is marked __attribute__((const)). this causes
> the program to crash because TLS is not yet initialized when called from
> __dls2. this is also possible if LTO is not enabled; even though gcc 11
> doesn't do it, it is still wrong to use errno here.
> 
> since the start and end are already aligned, we can simply call
> __syscall instead of using global errno.
> 
> Fixes: e13a2b8953ef ("implement PT_GNU_RELRO support")
> ---
> 
>  ldso/dynlink.c | 14 ++++++++------
>  1 file changed, 8 insertions(+), 6 deletions(-)
> 
> diff --git a/ldso/dynlink.c b/ldso/dynlink.c
> index 5b9c8be4..b5a8f1f2 100644
> --- a/ldso/dynlink.c
> +++ b/ldso/dynlink.c
> @@ -1356,12 +1356,14 @@ static void reloc_all(struct dso *p)
>  		do_relocs(p, laddr(p, dyn[DT_REL]), dyn[DT_RELSZ], 2);
>  		do_relocs(p, laddr(p, dyn[DT_RELA]), dyn[DT_RELASZ], 3);
>  
> -		if (head != &ldso && p->relro_start != p->relro_end &&
> -		    mprotect(laddr(p, p->relro_start), p->relro_end-p->relro_start, PROT_READ)
> -		    && errno != ENOSYS) {
> -			error("Error relocating %s: RELRO protection failed: %m",
> -				p->name);
> -			if (runtime) longjmp(*rtld_fail, 1);
> +		if (head != &ldso && p->relro_start != p->relro_end) {
> +			long ret = __syscall(SYS_mprotect, laddr(p, p->relro_start),
> +				p->relro_end-p->relro_start, PROT_READ);
> +			if (ret != 0 && ret != -ENOSYS) {
> +				error("Error relocating %s: RELRO protection failed: %m",
> +					p->name);
> +				if (runtime) longjmp(*rtld_fail, 1);
> +			}
>  		}
>  
>  		p->relocated = 1;
> -- 
> 2.35.1

I think it's ok to go ahead and make this change since it's an
improvement, but it looks like it's not actually a complete fix,
because the call to error() is still there, which *itself* has a path
to evaluation of errno via printf.

A complete fix probably needs to make reloc_all take a function
pointer to the error function as an argument, with __dls2 passing in a
dummy function that just crashes.

Rich