elf: Handle ld.so with LOAD segment gaps in _dl_find_object (bug 31943)fw/bug31943-with-test

4 files changed, 154 insertions, 28 deletions

diff --git a/elf/Makefile b/elf/Makefile
index a3475f3fb5..a9fd97e96e 100644
--- a/elf/Makefile
+++ b/elf/Makefile
@@ -615,6 +615,14 @@ $(objpfx)tst-relro-libc.out: tst-relro-symbols.py $(..)/scripts/glibcelf.py \
 	    --required=_IO_wfile_jumps \
 	    --required=__io_vtables \
 	  > $@ 2>&1; $(evaluate-test)
+tests-special += $(objpfx)tst-gaps-ldso.out
+$(objpfx)tst-gaps-ldso.out: tst-load-segment-gaps.py \
+  $(..)/scripts/glibcelf.py $(objpfx)ld.so
+	$(PYTHON) tst-load-segment-gaps.py $(objpfx)ld.so \
+	  > $@ 2>&1; $(evaluate-test)
+ifeq ($(have-ld-load-gaps),yes)
+test-xfail-tst-gaps-ldso = yes
+endif
 
 ifeq ($(run-built-tests),yes)
 tests-special += $(objpfx)tst-valgrind-smoke.out
diff --git a/elf/dl-find_object.c b/elf/dl-find_object.c
index 449302eda3..9b63e7bd92 100644
--- a/elf/dl-find_object.c
+++ b/elf/dl-find_object.c
@@ -466,6 +466,38 @@ __dl_find_object (void *pc1, struct dl_find_object *result)
 hidden_def (__dl_find_object)
 weak_alias (__dl_find_object, _dl_find_object)
 
+/* Subroutine of _dlfo_process_initial to split out noncontigous link
+   maps.  NODELETE is the number of used _dlfo_nodelete_mappings
+   elements.  It is incremented as needed, and the new NODELETE value
+   is returned.  */
+static size_t
+_dlfo_process_initial_noncontiguous_map (struct link_map *map,
+                                         size_t nodelete)
+{
+  struct dl_find_object_internal dlfo;
+  _dl_find_object_from_map (map, &dlfo);
+
+  /* PT_LOAD segments for a non-contiguous link map are added to the
+     non-closeable mappings.  */
+  const ElfW(Phdr) *ph = map->l_phdr;
+  const ElfW(Phdr) *ph_end = map->l_phdr + map->l_phnum;
+  for (; ph < ph_end; ++ph)
+    if (ph->p_type == PT_LOAD)
+      {
+        if (_dlfo_nodelete_mappings != NULL)
+          {
+            /* Second pass only.  */
+            _dlfo_nodelete_mappings[nodelete] = dlfo;
+            _dlfo_nodelete_mappings[nodelete].map_start
+              = ph->p_vaddr + map->l_addr;
+            _dlfo_nodelete_mappings[nodelete].map_end
+              = _dlfo_nodelete_mappings[nodelete].map_start + ph->p_memsz;
+          }
+        ++nodelete;
+      }
+  return nodelete;
+}
+
 /* _dlfo_process_initial is called twice.  First to compute the array
    sizes from the initial loaded mappings.  Second to fill in the
    bases and infos arrays with the (still unsorted) data.  Returns the
@@ -477,29 +509,8 @@ _dlfo_process_initial (void)
 
   size_t nodelete = 0;
   if (!main_map->l_contiguous)
-    {
-      struct dl_find_object_internal dlfo;
-      _dl_find_object_from_map (main_map, &dlfo);
-
-      /* PT_LOAD segments for a non-contiguous are added to the
-         non-closeable mappings.  */
-      for (const ElfW(Phdr) *ph = main_map->l_phdr,
-             *ph_end = main_map->l_phdr + main_map->l_phnum;
-           ph < ph_end; ++ph)
-        if (ph->p_type == PT_LOAD)
-          {
-            if (_dlfo_nodelete_mappings != NULL)
-              {
-                /* Second pass only.  */
-                _dlfo_nodelete_mappings[nodelete] = dlfo;
-                _dlfo_nodelete_mappings[nodelete].map_start
-                  = ph->p_vaddr + main_map->l_addr;
-                _dlfo_nodelete_mappings[nodelete].map_end
-                  = _dlfo_nodelete_mappings[nodelete].map_start + ph->p_memsz;
-              }
-            ++nodelete;
-          }
-    }
+    /* Contiguous case already handled in _dl_find_object_init.  */
+    nodelete = _dlfo_process_initial_noncontiguous_map (main_map, nodelete);
 
   size_t loaded = 0;
   for (Lmid_t ns = 0; ns < GL(dl_nns); ++ns)
@@ -511,11 +522,20 @@ _dlfo_process_initial (void)
           /* lt_library link maps are implicitly NODELETE.  */
           if (l->l_type == lt_library || l->l_nodelete_active)
             {
-              if (_dlfo_nodelete_mappings != NULL)
-                /* Second pass only.  */
-                _dl_find_object_from_map
-                  (l, _dlfo_nodelete_mappings + nodelete);
-              ++nodelete;
+#if defined HAVE_LD_LOAD_GAPS && defined SHARED
+              /* The kernel may have loaded ld.so with gaps.   */
+              if (!l->l_contiguous && l == &GL(dl_rtld_map))
+                nodelete
+                  = _dlfo_process_initial_noncontiguous_map (l, nodelete);
+              else
+#endif
+                {
+                  if (_dlfo_nodelete_mappings != NULL)
+                    /* Second pass only.  */
+                    _dl_find_object_from_map
+                      (l, _dlfo_nodelete_mappings + nodelete);
+                  ++nodelete;
+                }
             }
           else if (l->l_type == lt_loaded)
             {
diff --git a/elf/rtld.c b/elf/rtld.c
index bfdf632e77..337901007d 100644
--- a/elf/rtld.c
+++ b/elf/rtld.c
@@ -1766,6 +1766,30 @@ dl_main (const ElfW(Phdr) *phdr,
 
   GL(dl_rtld_map).l_phdr = rtld_phdr;
   GL(dl_rtld_map).l_phnum = rtld_ehdr->e_phnum;
+  GL(dl_rtld_map).l_contiguous = 1;
+#ifdef HAVE_LD_LOAD_GAPS
+  /* The linker may not have produced a contiguous object.  The kernel
+     will load the object with actual gaps (unlike the glibc loader
+     for shared objects, which always produces a contiguous mapping).
+     See similar logic in rtld_setup_main_map.  */
+  {
+    ElfW(Addr) expected_load_address = 0;
+    for (const ElfW(Phdr) *ph = rtld_phdr; ph < &phdr[rtld_ehdr->e_phnum];
+	 ++ph)
+      if (ph->p_type == PT_LOAD)
+	{
+	  ElfW(Addr) mapstart = ph->p_vaddr & ~(GLRO(dl_pagesize) - 1);
+	  if (GL(dl_rtld_map).l_contiguous && expected_load_address != 0
+	      && expected_load_address != mapstart)
+	    GL(dl_rtld_map).l_contiguous = 0;
+	  ElfW(Addr) allocend = ph->p_vaddr + ph->p_memsz;
+	  /* The next expected address is the page following this load
+	     segment.  */
+	  expected_load_address = ((allocend + GLRO(dl_pagesize) - 1)
+				   & ~(GLRO(dl_pagesize) - 1));
+	}
+  }
+#endif
 
 
   /* PT_GNU_RELRO is usually the last phdr.  */
diff --git a/elf/tst-load-segment-gaps.py b/elf/tst-load-segment-gaps.py
new file mode 100644
index 0000000000..85ae7344fd
--- /dev/null
+++ b/elf/tst-load-segment-gaps.py
@@ -0,0 +1,74 @@
+#!/usr/bin/python3
+# Verify that objects do not contain gaps in load segments.
+# Copyright (C) 2024 Free Software Foundation, Inc.
+# This file is part of the GNU C Library.
+#
+# The GNU C Library is free software; you can redistribute it and/or
+# modify it under the terms of the GNU Lesser General Public
+# License as published by the Free Software Foundation; either
+# version 2.1 of the License, or (at your option) any later version.
+#
+# The GNU C Library is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+# Lesser General Public License for more details.
+#
+# You should have received a copy of the GNU Lesser General Public
+# License along with the GNU C Library; if not, see
+# <https://www.gnu.org/licenses/>.
+
+import argparse
+import os.path
+import sys
+
+# Make available glibc Python modules.
+sys.path.append(os.path.join(
+    os.path.dirname(os.path.realpath(__file__)), os.path.pardir, 'scripts'))
+
+import glibcelf
+
+def rounddown(val, align):
+    assert (align & (align - 1)) == 0, align
+    return val & -align
+def roundup(val, align):
+    assert (align & (align - 1)) == 0, align
+    return (val + align - 1) & -align
+
+errors = False
+
+def process(path, img):
+    global errors
+    loads = [phdr for phdr in img.phdrs()
+             if phdr.p_type == glibcelf.Pt.PT_LOAD]
+    if not loads:
+        # Nothing ot check.
+        return
+    alignments = [phdr.p_align for phdr in loads if phdr.p_align > 0]
+    if alignments:
+        align = min(alignments)
+    else:
+        print('error: cannot infer page size')
+        errors = True
+        align = 4096
+    print('info: inferred page size:', align)
+    current_address = None
+    for idx, phdr in enumerate(loads):
+        this_address = rounddown(phdr.p_vaddr, align)
+        next_address = roundup(phdr.p_vaddr + phdr.p_memsz, align)
+        print('info: LOAD segment {}: address 0x{:x}, size {},'
+              ' range [0x{:x},0x{:x})'
+               .format(idx, phdr.p_vaddr, phdr.p_memsz,
+                       this_address, next_address))
+        if current_address is not None:
+            gap = this_address - current_address
+            if gap != 0:
+                errors = True
+                print('error: gap between load segments: {} bytes'.format(gap))
+        current_address = next_address
+
+for path in sys.argv[1:]:
+    img = glibcelf.Image.readfile(path)
+    process(path, img)
+
+if errors:
+    sys.exit(1)