libio: Implement vtable verification [BZ #20191]
This commit puts all libio vtables in a dedicated, read-only ELF
section, so that they are consecutive in memory. Before any indirect
jump, the vtable pointer is checked against the section boundaries,
and the process is terminated if the vtable pointer does not fall into
the special ELF section.
To enable backwards compatibility, a special flag variable
(_IO_accept_foreign_vtables), protected by the pointer guard, avoids
process termination if libio stream object constructor functions have
been called earlier. Such constructor functions are called by the GCC
2.95 libstdc++ library, and this mechanism ensures compatibility with
old binaries. Existing callers inside glibc of these functions are
adjusted to call the original functions, not the wrappers which enable
vtable compatiblity.
The compatibility mechanism is used to enable passing FILE * objects
across a static dlopen boundary, too.
2016-06-23 18:01:40 +00:00
|
|
|
/* libio vtable validation.
|
2024-01-01 18:12:26 +00:00
|
|
|
Copyright (C) 2016-2024 Free Software Foundation, Inc.
|
libio: Implement vtable verification [BZ #20191]
This commit puts all libio vtables in a dedicated, read-only ELF
section, so that they are consecutive in memory. Before any indirect
jump, the vtable pointer is checked against the section boundaries,
and the process is terminated if the vtable pointer does not fall into
the special ELF section.
To enable backwards compatibility, a special flag variable
(_IO_accept_foreign_vtables), protected by the pointer guard, avoids
process termination if libio stream object constructor functions have
been called earlier. Such constructor functions are called by the GCC
2.95 libstdc++ library, and this mechanism ensures compatibility with
old binaries. Existing callers inside glibc of these functions are
adjusted to call the original functions, not the wrappers which enable
vtable compatiblity.
The compatibility mechanism is used to enable passing FILE * objects
across a static dlopen boundary, too.
2016-06-23 18:01:40 +00:00
|
|
|
This file is part of the GNU C Library.
|
|
|
|
|
|
|
|
The GNU C Library is free software; you can redistribute it and/or
|
|
|
|
modify it under the terms of the GNU Lesser General Public
|
|
|
|
License as published by the Free Software Foundation; either
|
|
|
|
version 2.1 of the License, or (at your option) any later version.
|
|
|
|
|
|
|
|
The GNU C Library is distributed in the hope that it will be useful,
|
|
|
|
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
|
|
Lesser General Public License for more details.
|
|
|
|
|
|
|
|
You should have received a copy of the GNU Lesser General Public
|
|
|
|
License along with the GNU C Library; if not, see
|
Prefer https to http for gnu.org and fsf.org URLs
Also, change sources.redhat.com to sourceware.org.
This patch was automatically generated by running the following shell
script, which uses GNU sed, and which avoids modifying files imported
from upstream:
sed -ri '
s,(http|ftp)(://(.*\.)?(gnu|fsf|sourceware)\.org($|[^.]|\.[^a-z])),https\2,g
s,(http|ftp)(://(.*\.)?)sources\.redhat\.com($|[^.]|\.[^a-z]),https\2sourceware.org\4,g
' \
$(find $(git ls-files) -prune -type f \
! -name '*.po' \
! -name 'ChangeLog*' \
! -path COPYING ! -path COPYING.LIB \
! -path manual/fdl-1.3.texi ! -path manual/lgpl-2.1.texi \
! -path manual/texinfo.tex ! -path scripts/config.guess \
! -path scripts/config.sub ! -path scripts/install-sh \
! -path scripts/mkinstalldirs ! -path scripts/move-if-change \
! -path INSTALL ! -path locale/programs/charmap-kw.h \
! -path po/libc.pot ! -path sysdeps/gnu/errlist.c \
! '(' -name configure \
-execdir test -f configure.ac -o -f configure.in ';' ')' \
! '(' -name preconfigure \
-execdir test -f preconfigure.ac ';' ')' \
-print)
and then by running 'make dist-prepare' to regenerate files built
from the altered files, and then executing the following to cleanup:
chmod a+x sysdeps/unix/sysv/linux/riscv/configure
# Omit irrelevant whitespace and comment-only changes,
# perhaps from a slightly-different Autoconf version.
git checkout -f \
sysdeps/csky/configure \
sysdeps/hppa/configure \
sysdeps/riscv/configure \
sysdeps/unix/sysv/linux/csky/configure
# Omit changes that caused a pre-commit check to fail like this:
# remote: *** error: sysdeps/powerpc/powerpc64/ppc-mcount.S: trailing lines
git checkout -f \
sysdeps/powerpc/powerpc64/ppc-mcount.S \
sysdeps/unix/sysv/linux/s390/s390-64/syscall.S
# Omit change that caused a pre-commit check to fail like this:
# remote: *** error: sysdeps/sparc/sparc64/multiarch/memcpy-ultra3.S: last line does not end in newline
git checkout -f sysdeps/sparc/sparc64/multiarch/memcpy-ultra3.S
2019-09-07 05:40:42 +00:00
|
|
|
<https://www.gnu.org/licenses/>. */
|
libio: Implement vtable verification [BZ #20191]
This commit puts all libio vtables in a dedicated, read-only ELF
section, so that they are consecutive in memory. Before any indirect
jump, the vtable pointer is checked against the section boundaries,
and the process is terminated if the vtable pointer does not fall into
the special ELF section.
To enable backwards compatibility, a special flag variable
(_IO_accept_foreign_vtables), protected by the pointer guard, avoids
process termination if libio stream object constructor functions have
been called earlier. Such constructor functions are called by the GCC
2.95 libstdc++ library, and this mechanism ensures compatibility with
old binaries. Existing callers inside glibc of these functions are
adjusted to call the original functions, not the wrappers which enable
vtable compatiblity.
The compatibility mechanism is used to enable passing FILE * objects
across a static dlopen boundary, too.
2016-06-23 18:01:40 +00:00
|
|
|
|
|
|
|
#include <dlfcn.h>
|
|
|
|
#include <libioP.h>
|
|
|
|
#include <stdio.h>
|
2017-12-18 19:04:13 +00:00
|
|
|
#include <ldsodefs.h>
|
2023-09-08 19:55:19 +00:00
|
|
|
#include <array_length.h>
|
2022-10-18 15:00:07 +00:00
|
|
|
#include <pointer_guard.h>
|
2022-12-27 21:11:43 +00:00
|
|
|
#include <libio-macros.h>
|
|
|
|
|
|
|
|
/* Both _IO_str_* and _IO_new_file functions are pulled into every link (from
|
|
|
|
stdio initialization). */
|
|
|
|
#ifndef SHARED
|
|
|
|
/* NB: the following directives do add pragma weak for _IO_default _* and
|
|
|
|
_IO_wdefault_* symbols to potentially avoid link failures, since they
|
|
|
|
are always used when the __io_vtables is used. */
|
|
|
|
# pragma weak _IO_wstr_finish
|
|
|
|
# pragma weak _IO_wstr_overflow
|
|
|
|
# pragma weak _IO_wstr_pbackfail
|
|
|
|
# pragma weak _IO_wstr_seekoff
|
|
|
|
# pragma weak _IO_wstr_underflow
|
|
|
|
|
|
|
|
# pragma weak _IO_file_close
|
|
|
|
# pragma weak _IO_file_close_mmap
|
|
|
|
# pragma weak _IO_file_doallocate
|
|
|
|
# pragma weak _IO_file_finish
|
|
|
|
# pragma weak _IO_file_overflow
|
|
|
|
# pragma weak _IO_file_read
|
|
|
|
# pragma weak _IO_file_seek
|
|
|
|
# pragma weak _IO_file_seekoff_maybe_mmap
|
|
|
|
# pragma weak _IO_file_seekoff_mmap
|
|
|
|
# pragma weak _IO_file_setbuf
|
|
|
|
# pragma weak _IO_file_setbuf_mmap
|
|
|
|
# pragma weak _IO_file_setbuf_mmap
|
|
|
|
# pragma weak _IO_file_stat
|
|
|
|
# pragma weak _IO_file_sync
|
|
|
|
# pragma weak _IO_file_sync_mmap
|
|
|
|
# pragma weak _IO_file_underflow
|
|
|
|
# pragma weak _IO_file_underflow_maybe_mmap
|
|
|
|
# pragma weak _IO_file_underflow_mmap
|
|
|
|
# pragma weak _IO_file_xsgetn
|
|
|
|
# pragma weak _IO_file_xsgetn_maybe_mmap
|
|
|
|
# pragma weak _IO_file_xsgetn_mmap
|
|
|
|
# pragma weak _IO_file_xsputn
|
|
|
|
|
|
|
|
# pragma weak _IO_wfile_overflow
|
|
|
|
# pragma weak _IO_wfile_sync
|
|
|
|
# pragma weak _IO_wfile_underflow
|
|
|
|
# pragma weak _IO_wfile_underflow_maybe_mmap
|
|
|
|
# pragma weak _IO_wfile_underflow_mmap
|
|
|
|
# pragma weak _IO_wfile_doallocate
|
|
|
|
# pragma weak _IO_wfile_seekoff
|
|
|
|
# pragma weak _IO_wfile_xsputn
|
|
|
|
|
|
|
|
# pragma weak _IO_new_proc_close
|
|
|
|
|
|
|
|
# pragma weak _IO_cookie_close
|
|
|
|
# pragma weak _IO_cookie_read
|
|
|
|
# pragma weak _IO_cookie_seek
|
|
|
|
# pragma weak _IO_cookie_seekoff
|
|
|
|
# pragma weak _IO_cookie_write
|
|
|
|
|
|
|
|
# pragma weak _IO_mem_finish
|
|
|
|
# pragma weak _IO_mem_sync
|
|
|
|
|
|
|
|
# pragma weak _IO_wmem_finish
|
|
|
|
# pragma weak _IO_wmem_sync
|
|
|
|
|
|
|
|
# pragma weak __printf_buffer_as_file_overflow
|
|
|
|
# pragma weak __printf_buffer_as_file_xsputn
|
|
|
|
|
|
|
|
# pragma weak __wprintf_buffer_as_file_overflow
|
|
|
|
# pragma weak __wprintf_buffer_as_file_xsputn
|
|
|
|
#endif
|
|
|
|
|
2023-09-08 19:55:19 +00:00
|
|
|
const struct _IO_jump_t __io_vtables[] attribute_relro =
|
2022-12-27 21:11:43 +00:00
|
|
|
{
|
|
|
|
/* _IO_str_jumps */
|
|
|
|
[IO_STR_JUMPS] =
|
|
|
|
{
|
|
|
|
JUMP_INIT_DUMMY,
|
|
|
|
JUMP_INIT (finish, _IO_str_finish),
|
|
|
|
JUMP_INIT (overflow, _IO_str_overflow),
|
|
|
|
JUMP_INIT (underflow, _IO_str_underflow),
|
|
|
|
JUMP_INIT (uflow, _IO_default_uflow),
|
|
|
|
JUMP_INIT (pbackfail, _IO_str_pbackfail),
|
|
|
|
JUMP_INIT (xsputn, _IO_default_xsputn),
|
|
|
|
JUMP_INIT (xsgetn, _IO_default_xsgetn),
|
|
|
|
JUMP_INIT (seekoff, _IO_str_seekoff),
|
|
|
|
JUMP_INIT (seekpos, _IO_default_seekpos),
|
|
|
|
JUMP_INIT (setbuf, _IO_default_setbuf),
|
|
|
|
JUMP_INIT (sync, _IO_default_sync),
|
|
|
|
JUMP_INIT (doallocate, _IO_default_doallocate),
|
|
|
|
JUMP_INIT (read, _IO_default_read),
|
|
|
|
JUMP_INIT (write, _IO_default_write),
|
|
|
|
JUMP_INIT (seek, _IO_default_seek),
|
|
|
|
JUMP_INIT (close, _IO_default_close),
|
|
|
|
JUMP_INIT (stat, _IO_default_stat),
|
|
|
|
JUMP_INIT (showmanyc, _IO_default_showmanyc),
|
|
|
|
JUMP_INIT (imbue, _IO_default_imbue)
|
|
|
|
},
|
|
|
|
/* _IO_wstr_jumps */
|
|
|
|
[IO_WSTR_JUMPS] = {
|
|
|
|
JUMP_INIT_DUMMY,
|
|
|
|
JUMP_INIT (finish, _IO_wstr_finish),
|
|
|
|
JUMP_INIT (overflow, (_IO_overflow_t) _IO_wstr_overflow),
|
|
|
|
JUMP_INIT (underflow, (_IO_underflow_t) _IO_wstr_underflow),
|
|
|
|
JUMP_INIT (uflow, (_IO_underflow_t) _IO_wdefault_uflow),
|
|
|
|
JUMP_INIT (pbackfail, (_IO_pbackfail_t) _IO_wstr_pbackfail),
|
|
|
|
JUMP_INIT (xsputn, _IO_wdefault_xsputn),
|
|
|
|
JUMP_INIT (xsgetn, _IO_wdefault_xsgetn),
|
|
|
|
JUMP_INIT (seekoff, _IO_wstr_seekoff),
|
|
|
|
JUMP_INIT (seekpos, _IO_default_seekpos),
|
|
|
|
JUMP_INIT (setbuf, _IO_default_setbuf),
|
|
|
|
JUMP_INIT (sync, _IO_default_sync),
|
|
|
|
JUMP_INIT (doallocate, _IO_wdefault_doallocate),
|
|
|
|
JUMP_INIT (read, _IO_default_read),
|
|
|
|
JUMP_INIT (write, _IO_default_write),
|
|
|
|
JUMP_INIT (seek, _IO_default_seek),
|
|
|
|
JUMP_INIT (close, _IO_default_close),
|
|
|
|
JUMP_INIT (stat, _IO_default_stat),
|
|
|
|
JUMP_INIT (showmanyc, _IO_default_showmanyc),
|
|
|
|
JUMP_INIT (imbue, _IO_default_imbue)
|
|
|
|
},
|
|
|
|
/* _IO_file_jumps */
|
|
|
|
[IO_FILE_JUMPS] = {
|
|
|
|
JUMP_INIT_DUMMY,
|
|
|
|
JUMP_INIT (finish, _IO_file_finish),
|
|
|
|
JUMP_INIT (overflow, _IO_file_overflow),
|
|
|
|
JUMP_INIT (underflow, _IO_file_underflow),
|
|
|
|
JUMP_INIT (uflow, _IO_default_uflow),
|
|
|
|
JUMP_INIT (pbackfail, _IO_default_pbackfail),
|
|
|
|
JUMP_INIT (xsputn, _IO_file_xsputn),
|
|
|
|
JUMP_INIT (xsgetn, _IO_file_xsgetn),
|
|
|
|
JUMP_INIT (seekoff, _IO_new_file_seekoff),
|
|
|
|
JUMP_INIT (seekpos, _IO_default_seekpos),
|
|
|
|
JUMP_INIT (setbuf, _IO_new_file_setbuf),
|
|
|
|
JUMP_INIT (sync, _IO_new_file_sync),
|
|
|
|
JUMP_INIT (doallocate, _IO_file_doallocate),
|
|
|
|
JUMP_INIT (read, _IO_file_read),
|
|
|
|
JUMP_INIT (write, _IO_new_file_write),
|
|
|
|
JUMP_INIT (seek, _IO_file_seek),
|
|
|
|
JUMP_INIT (close, _IO_file_close),
|
|
|
|
JUMP_INIT (stat, _IO_file_stat),
|
|
|
|
JUMP_INIT (showmanyc, _IO_default_showmanyc),
|
|
|
|
JUMP_INIT (imbue, _IO_default_imbue)
|
|
|
|
},
|
|
|
|
/* _IO_file_jumps_mmap */
|
|
|
|
[IO_FILE_JUMPS_MMAP] = {
|
|
|
|
JUMP_INIT_DUMMY,
|
|
|
|
JUMP_INIT (finish, _IO_file_finish),
|
|
|
|
JUMP_INIT (overflow, _IO_file_overflow),
|
|
|
|
JUMP_INIT (underflow, _IO_file_underflow_mmap),
|
|
|
|
JUMP_INIT (uflow, _IO_default_uflow),
|
|
|
|
JUMP_INIT (pbackfail, _IO_default_pbackfail),
|
|
|
|
JUMP_INIT (xsputn, _IO_new_file_xsputn),
|
|
|
|
JUMP_INIT (xsgetn, _IO_file_xsgetn_mmap),
|
|
|
|
JUMP_INIT (seekoff, _IO_file_seekoff_mmap),
|
|
|
|
JUMP_INIT (seekpos, _IO_default_seekpos),
|
|
|
|
JUMP_INIT (setbuf, (_IO_setbuf_t) _IO_file_setbuf_mmap),
|
|
|
|
JUMP_INIT (sync, _IO_file_sync_mmap),
|
|
|
|
JUMP_INIT (doallocate, _IO_file_doallocate),
|
|
|
|
JUMP_INIT (read, _IO_file_read),
|
|
|
|
JUMP_INIT (write, _IO_new_file_write),
|
|
|
|
JUMP_INIT (seek, _IO_file_seek),
|
|
|
|
JUMP_INIT (close, _IO_file_close_mmap),
|
|
|
|
JUMP_INIT (stat, _IO_file_stat),
|
|
|
|
JUMP_INIT (showmanyc, _IO_default_showmanyc),
|
|
|
|
JUMP_INIT (imbue, _IO_default_imbue)
|
|
|
|
},
|
|
|
|
/* _IO_file_jumps_maybe_mmap */
|
|
|
|
[IO_FILE_JUMPS_MAYBE_MMAP] = {
|
|
|
|
JUMP_INIT_DUMMY,
|
|
|
|
JUMP_INIT (finish, _IO_file_finish),
|
|
|
|
JUMP_INIT (overflow, _IO_file_overflow),
|
|
|
|
JUMP_INIT (underflow, _IO_file_underflow_maybe_mmap),
|
|
|
|
JUMP_INIT (uflow, _IO_default_uflow),
|
|
|
|
JUMP_INIT (pbackfail, _IO_default_pbackfail),
|
|
|
|
JUMP_INIT (xsputn, _IO_new_file_xsputn),
|
|
|
|
JUMP_INIT (xsgetn, _IO_file_xsgetn_maybe_mmap),
|
|
|
|
JUMP_INIT (seekoff, _IO_file_seekoff_maybe_mmap),
|
|
|
|
JUMP_INIT (seekpos, _IO_default_seekpos),
|
|
|
|
JUMP_INIT (setbuf, (_IO_setbuf_t) _IO_file_setbuf_mmap),
|
|
|
|
JUMP_INIT (sync, _IO_new_file_sync),
|
|
|
|
JUMP_INIT (doallocate, _IO_file_doallocate),
|
|
|
|
JUMP_INIT (read, _IO_file_read),
|
|
|
|
JUMP_INIT (write, _IO_new_file_write),
|
|
|
|
JUMP_INIT (seek, _IO_file_seek),
|
|
|
|
JUMP_INIT (close, _IO_file_close),
|
|
|
|
JUMP_INIT (stat, _IO_file_stat),
|
|
|
|
JUMP_INIT (showmanyc, _IO_default_showmanyc),
|
|
|
|
JUMP_INIT (imbue, _IO_default_imbue)
|
|
|
|
},
|
|
|
|
/* _IO_wfile_jumps */
|
|
|
|
[IO_WFILE_JUMPS] = {
|
|
|
|
JUMP_INIT_DUMMY,
|
|
|
|
JUMP_INIT (finish, _IO_new_file_finish),
|
|
|
|
JUMP_INIT (overflow, (_IO_overflow_t) _IO_wfile_overflow),
|
|
|
|
JUMP_INIT (underflow, (_IO_underflow_t) _IO_wfile_underflow),
|
|
|
|
JUMP_INIT (uflow, (_IO_underflow_t) _IO_wdefault_uflow),
|
|
|
|
JUMP_INIT (pbackfail, (_IO_pbackfail_t) _IO_wdefault_pbackfail),
|
|
|
|
JUMP_INIT (xsputn, _IO_wfile_xsputn),
|
|
|
|
JUMP_INIT (xsgetn, _IO_file_xsgetn),
|
|
|
|
JUMP_INIT (seekoff, _IO_wfile_seekoff),
|
|
|
|
JUMP_INIT (seekpos, _IO_default_seekpos),
|
|
|
|
JUMP_INIT (setbuf, _IO_new_file_setbuf),
|
|
|
|
JUMP_INIT (sync, (_IO_sync_t) _IO_wfile_sync),
|
|
|
|
JUMP_INIT (doallocate, _IO_wfile_doallocate),
|
|
|
|
JUMP_INIT (read, _IO_file_read),
|
|
|
|
JUMP_INIT (write, _IO_new_file_write),
|
|
|
|
JUMP_INIT (seek, _IO_file_seek),
|
|
|
|
JUMP_INIT (close, _IO_file_close),
|
|
|
|
JUMP_INIT (stat, _IO_file_stat),
|
|
|
|
JUMP_INIT (showmanyc, _IO_default_showmanyc),
|
|
|
|
JUMP_INIT (imbue, _IO_default_imbue)
|
|
|
|
},
|
|
|
|
/* _IO_wfile_jumps_mmap */
|
|
|
|
[IO_WFILE_JUMPS_MMAP] = {
|
|
|
|
JUMP_INIT_DUMMY,
|
|
|
|
JUMP_INIT (finish, _IO_new_file_finish),
|
|
|
|
JUMP_INIT (overflow, (_IO_overflow_t) _IO_wfile_overflow),
|
|
|
|
JUMP_INIT (underflow, (_IO_underflow_t) _IO_wfile_underflow_mmap),
|
|
|
|
JUMP_INIT (uflow, (_IO_underflow_t) _IO_wdefault_uflow),
|
|
|
|
JUMP_INIT (pbackfail, (_IO_pbackfail_t) _IO_wdefault_pbackfail),
|
|
|
|
JUMP_INIT (xsputn, _IO_wfile_xsputn),
|
|
|
|
JUMP_INIT (xsgetn, _IO_file_xsgetn),
|
|
|
|
JUMP_INIT (seekoff, _IO_wfile_seekoff),
|
|
|
|
JUMP_INIT (seekpos, _IO_default_seekpos),
|
|
|
|
JUMP_INIT (setbuf, _IO_file_setbuf_mmap),
|
|
|
|
JUMP_INIT (sync, (_IO_sync_t) _IO_wfile_sync),
|
|
|
|
JUMP_INIT (doallocate, _IO_wfile_doallocate),
|
|
|
|
JUMP_INIT (read, _IO_file_read),
|
|
|
|
JUMP_INIT (write, _IO_new_file_write),
|
|
|
|
JUMP_INIT (seek, _IO_file_seek),
|
|
|
|
JUMP_INIT (close, _IO_file_close_mmap),
|
|
|
|
JUMP_INIT (stat, _IO_file_stat),
|
|
|
|
JUMP_INIT (showmanyc, _IO_default_showmanyc),
|
|
|
|
JUMP_INIT (imbue, _IO_default_imbue)
|
|
|
|
},
|
|
|
|
/* _IO_wfile_jumps_maybe_mmap */
|
|
|
|
[IO_WFILE_JUMPS_MAYBE_MMAP] = {
|
|
|
|
JUMP_INIT_DUMMY,
|
|
|
|
JUMP_INIT (finish, _IO_new_file_finish),
|
|
|
|
JUMP_INIT (overflow, (_IO_overflow_t) _IO_wfile_overflow),
|
|
|
|
JUMP_INIT (underflow, (_IO_underflow_t) _IO_wfile_underflow_maybe_mmap),
|
|
|
|
JUMP_INIT (uflow, (_IO_underflow_t) _IO_wdefault_uflow),
|
|
|
|
JUMP_INIT (pbackfail, (_IO_pbackfail_t) _IO_wdefault_pbackfail),
|
|
|
|
JUMP_INIT (xsputn, _IO_wfile_xsputn),
|
|
|
|
JUMP_INIT (xsgetn, _IO_file_xsgetn),
|
|
|
|
JUMP_INIT (seekoff, _IO_wfile_seekoff),
|
|
|
|
JUMP_INIT (seekpos, _IO_default_seekpos),
|
|
|
|
JUMP_INIT (setbuf, _IO_file_setbuf_mmap),
|
|
|
|
JUMP_INIT (sync, (_IO_sync_t) _IO_wfile_sync),
|
|
|
|
JUMP_INIT (doallocate, _IO_wfile_doallocate),
|
|
|
|
JUMP_INIT (read, _IO_file_read),
|
|
|
|
JUMP_INIT (write, _IO_new_file_write),
|
|
|
|
JUMP_INIT (seek, _IO_file_seek),
|
|
|
|
JUMP_INIT (close, _IO_file_close),
|
|
|
|
JUMP_INIT (stat, _IO_file_stat),
|
|
|
|
JUMP_INIT (showmanyc, _IO_default_showmanyc),
|
|
|
|
JUMP_INIT (imbue, _IO_default_imbue)
|
|
|
|
},
|
|
|
|
/* _IO_cookie_jumps */
|
|
|
|
[IO_COOKIE_JUMPS] = {
|
|
|
|
JUMP_INIT_DUMMY,
|
|
|
|
JUMP_INIT (finish, _IO_file_finish),
|
|
|
|
JUMP_INIT (overflow, _IO_file_overflow),
|
|
|
|
JUMP_INIT (underflow, _IO_file_underflow),
|
|
|
|
JUMP_INIT (uflow, _IO_default_uflow),
|
|
|
|
JUMP_INIT (pbackfail, _IO_default_pbackfail),
|
|
|
|
JUMP_INIT (xsputn, _IO_file_xsputn),
|
|
|
|
JUMP_INIT (xsgetn, _IO_default_xsgetn),
|
|
|
|
JUMP_INIT (seekoff, _IO_cookie_seekoff),
|
|
|
|
JUMP_INIT (seekpos, _IO_default_seekpos),
|
|
|
|
JUMP_INIT (setbuf, _IO_file_setbuf),
|
|
|
|
JUMP_INIT (sync, _IO_file_sync),
|
|
|
|
JUMP_INIT (doallocate, _IO_file_doallocate),
|
|
|
|
JUMP_INIT (read, _IO_cookie_read),
|
|
|
|
JUMP_INIT (write, _IO_cookie_write),
|
|
|
|
JUMP_INIT (seek, _IO_cookie_seek),
|
|
|
|
JUMP_INIT (close, _IO_cookie_close),
|
|
|
|
JUMP_INIT (stat, _IO_default_stat),
|
|
|
|
JUMP_INIT (showmanyc, _IO_default_showmanyc),
|
|
|
|
JUMP_INIT (imbue, _IO_default_imbue),
|
|
|
|
},
|
|
|
|
/* _IO_proc_jumps */
|
|
|
|
[IO_PROC_JUMPS] = {
|
|
|
|
JUMP_INIT_DUMMY,
|
|
|
|
JUMP_INIT (finish, _IO_new_file_finish),
|
|
|
|
JUMP_INIT (overflow, _IO_new_file_overflow),
|
|
|
|
JUMP_INIT (underflow, _IO_new_file_underflow),
|
|
|
|
JUMP_INIT (uflow, _IO_default_uflow),
|
|
|
|
JUMP_INIT (pbackfail, _IO_default_pbackfail),
|
|
|
|
JUMP_INIT (xsputn, _IO_new_file_xsputn),
|
|
|
|
JUMP_INIT (xsgetn, _IO_default_xsgetn),
|
|
|
|
JUMP_INIT (seekoff, _IO_new_file_seekoff),
|
|
|
|
JUMP_INIT (seekpos, _IO_default_seekpos),
|
|
|
|
JUMP_INIT (setbuf, _IO_new_file_setbuf),
|
|
|
|
JUMP_INIT (sync, _IO_new_file_sync),
|
|
|
|
JUMP_INIT (doallocate, _IO_file_doallocate),
|
|
|
|
JUMP_INIT (read, _IO_file_read),
|
|
|
|
JUMP_INIT (write, _IO_new_file_write),
|
|
|
|
JUMP_INIT (seek, _IO_file_seek),
|
|
|
|
JUMP_INIT (close, _IO_new_proc_close),
|
|
|
|
JUMP_INIT (stat, _IO_file_stat),
|
|
|
|
JUMP_INIT (showmanyc, _IO_default_showmanyc),
|
|
|
|
JUMP_INIT (imbue, _IO_default_imbue)
|
|
|
|
},
|
|
|
|
/* _IO_mem_jumps */
|
|
|
|
[IO_MEM_JUMPS] = {
|
|
|
|
JUMP_INIT_DUMMY,
|
|
|
|
JUMP_INIT (finish, _IO_mem_finish),
|
|
|
|
JUMP_INIT (overflow, _IO_str_overflow),
|
|
|
|
JUMP_INIT (underflow, _IO_str_underflow),
|
|
|
|
JUMP_INIT (uflow, _IO_default_uflow),
|
|
|
|
JUMP_INIT (pbackfail, _IO_str_pbackfail),
|
|
|
|
JUMP_INIT (xsputn, _IO_default_xsputn),
|
|
|
|
JUMP_INIT (xsgetn, _IO_default_xsgetn),
|
|
|
|
JUMP_INIT (seekoff, _IO_str_seekoff),
|
|
|
|
JUMP_INIT (seekpos, _IO_default_seekpos),
|
|
|
|
JUMP_INIT (setbuf, _IO_default_setbuf),
|
|
|
|
JUMP_INIT (sync, _IO_mem_sync),
|
|
|
|
JUMP_INIT (doallocate, _IO_default_doallocate),
|
|
|
|
JUMP_INIT (read, _IO_default_read),
|
|
|
|
JUMP_INIT (write, _IO_default_write),
|
|
|
|
JUMP_INIT (seek, _IO_default_seek),
|
|
|
|
JUMP_INIT (close, _IO_default_close),
|
|
|
|
JUMP_INIT (stat, _IO_default_stat),
|
|
|
|
JUMP_INIT (showmanyc, _IO_default_showmanyc),
|
|
|
|
JUMP_INIT (imbue, _IO_default_imbue)
|
|
|
|
},
|
|
|
|
/* _IO_wmem_jumps */
|
|
|
|
[IO_WMEM_JUMPS] = {
|
|
|
|
JUMP_INIT_DUMMY,
|
|
|
|
JUMP_INIT (finish, _IO_wmem_finish),
|
|
|
|
JUMP_INIT (overflow, (_IO_overflow_t) _IO_wstr_overflow),
|
|
|
|
JUMP_INIT (underflow, (_IO_underflow_t) _IO_wstr_underflow),
|
|
|
|
JUMP_INIT (uflow, (_IO_underflow_t) _IO_wdefault_uflow),
|
|
|
|
JUMP_INIT (pbackfail, (_IO_pbackfail_t) _IO_wstr_pbackfail),
|
|
|
|
JUMP_INIT (xsputn, _IO_wdefault_xsputn),
|
|
|
|
JUMP_INIT (xsgetn, _IO_wdefault_xsgetn),
|
|
|
|
JUMP_INIT (seekoff, _IO_wstr_seekoff),
|
|
|
|
JUMP_INIT (seekpos, _IO_default_seekpos),
|
|
|
|
JUMP_INIT (setbuf, _IO_default_setbuf),
|
|
|
|
JUMP_INIT (sync, _IO_wmem_sync),
|
|
|
|
JUMP_INIT (doallocate, _IO_wdefault_doallocate),
|
|
|
|
JUMP_INIT (read, _IO_default_read),
|
|
|
|
JUMP_INIT (write, _IO_default_write),
|
|
|
|
JUMP_INIT (seek, _IO_default_seek),
|
|
|
|
JUMP_INIT (close, _IO_default_close),
|
|
|
|
JUMP_INIT (stat, _IO_default_stat),
|
|
|
|
JUMP_INIT (showmanyc, _IO_default_showmanyc),
|
|
|
|
JUMP_INIT (imbue, _IO_default_imbue)
|
|
|
|
},
|
|
|
|
[IO_PRINTF_BUFFER_AS_FILE_JUMPS] = {
|
|
|
|
JUMP_INIT_DUMMY,
|
|
|
|
JUMP_INIT (finish, NULL),
|
|
|
|
JUMP_INIT (overflow, __printf_buffer_as_file_overflow),
|
|
|
|
JUMP_INIT (underflow, NULL),
|
|
|
|
JUMP_INIT (uflow, NULL),
|
|
|
|
JUMP_INIT (pbackfail, NULL),
|
|
|
|
JUMP_INIT (xsputn, __printf_buffer_as_file_xsputn),
|
|
|
|
JUMP_INIT (xsgetn, NULL),
|
|
|
|
JUMP_INIT (seekoff, NULL),
|
|
|
|
JUMP_INIT (seekpos, NULL),
|
|
|
|
JUMP_INIT (setbuf, NULL),
|
|
|
|
JUMP_INIT (sync, NULL),
|
|
|
|
JUMP_INIT (doallocate, NULL),
|
|
|
|
JUMP_INIT (read, NULL),
|
|
|
|
JUMP_INIT (write, NULL),
|
|
|
|
JUMP_INIT (seek, NULL),
|
|
|
|
JUMP_INIT (close, NULL),
|
|
|
|
JUMP_INIT (stat, NULL),
|
|
|
|
JUMP_INIT (showmanyc, NULL),
|
|
|
|
JUMP_INIT (imbue, NULL)
|
|
|
|
},
|
|
|
|
[IO_WPRINTF_BUFFER_AS_FILE_JUMPS] = {
|
|
|
|
JUMP_INIT_DUMMY,
|
|
|
|
JUMP_INIT (finish, NULL),
|
|
|
|
JUMP_INIT (overflow, (_IO_overflow_t) __wprintf_buffer_as_file_overflow),
|
|
|
|
JUMP_INIT (underflow, NULL),
|
|
|
|
JUMP_INIT (uflow, NULL),
|
|
|
|
JUMP_INIT (pbackfail, NULL),
|
|
|
|
JUMP_INIT (xsputn, __wprintf_buffer_as_file_xsputn),
|
|
|
|
JUMP_INIT (xsgetn, NULL),
|
|
|
|
JUMP_INIT (seekoff, NULL),
|
|
|
|
JUMP_INIT (seekpos, NULL),
|
|
|
|
JUMP_INIT (setbuf, NULL),
|
|
|
|
JUMP_INIT (sync, NULL),
|
|
|
|
JUMP_INIT (doallocate, NULL),
|
|
|
|
JUMP_INIT (read, NULL),
|
|
|
|
JUMP_INIT (write, NULL),
|
|
|
|
JUMP_INIT (seek, NULL),
|
|
|
|
JUMP_INIT (close, NULL),
|
|
|
|
JUMP_INIT (stat, NULL),
|
|
|
|
JUMP_INIT (showmanyc, NULL),
|
|
|
|
JUMP_INIT (imbue, NULL)
|
|
|
|
},
|
|
|
|
|
|
|
|
#if SHLIB_COMPAT (libc, GLIBC_2_0, GLIBC_2_1)
|
|
|
|
/* _IO_old_file_jumps */
|
|
|
|
[IO_OLD_FILE_JUMPS] = {
|
|
|
|
JUMP_INIT_DUMMY,
|
|
|
|
JUMP_INIT (finish, _IO_old_file_finish),
|
|
|
|
JUMP_INIT (overflow, _IO_old_file_overflow),
|
|
|
|
JUMP_INIT (underflow, _IO_old_file_underflow),
|
|
|
|
JUMP_INIT (uflow, _IO_default_uflow),
|
|
|
|
JUMP_INIT (pbackfail, _IO_default_pbackfail),
|
|
|
|
JUMP_INIT (xsputn, _IO_old_file_xsputn),
|
|
|
|
JUMP_INIT (xsgetn, _IO_default_xsgetn),
|
|
|
|
JUMP_INIT (seekoff, _IO_old_file_seekoff),
|
|
|
|
JUMP_INIT (seekpos, _IO_default_seekpos),
|
|
|
|
JUMP_INIT (setbuf, _IO_old_file_setbuf),
|
|
|
|
JUMP_INIT (sync, _IO_old_file_sync),
|
|
|
|
JUMP_INIT (doallocate, _IO_file_doallocate),
|
|
|
|
JUMP_INIT (read, _IO_file_read),
|
|
|
|
JUMP_INIT (write, _IO_old_file_write),
|
|
|
|
JUMP_INIT (seek, _IO_file_seek),
|
|
|
|
JUMP_INIT (close, _IO_file_close),
|
|
|
|
JUMP_INIT (stat, _IO_file_stat)
|
|
|
|
},
|
|
|
|
/* _IO_old_proc_jumps */
|
|
|
|
[IO_OLD_PROC_JUMPS] = {
|
|
|
|
JUMP_INIT_DUMMY,
|
|
|
|
JUMP_INIT (finish, _IO_old_file_finish),
|
|
|
|
JUMP_INIT (overflow, _IO_old_file_overflow),
|
|
|
|
JUMP_INIT (underflow, _IO_old_file_underflow),
|
|
|
|
JUMP_INIT (uflow, _IO_default_uflow),
|
|
|
|
JUMP_INIT (pbackfail, _IO_default_pbackfail),
|
|
|
|
JUMP_INIT (xsputn, _IO_old_file_xsputn),
|
|
|
|
JUMP_INIT (xsgetn, _IO_default_xsgetn),
|
|
|
|
JUMP_INIT (seekoff, _IO_old_file_seekoff),
|
|
|
|
JUMP_INIT (seekpos, _IO_default_seekpos),
|
|
|
|
JUMP_INIT (setbuf, _IO_old_file_setbuf),
|
|
|
|
JUMP_INIT (sync, _IO_old_file_sync),
|
|
|
|
JUMP_INIT (doallocate, _IO_file_doallocate),
|
|
|
|
JUMP_INIT (read, _IO_file_read),
|
|
|
|
JUMP_INIT (write, _IO_old_file_write),
|
|
|
|
JUMP_INIT (seek, _IO_file_seek),
|
|
|
|
JUMP_INIT (close, _IO_old_proc_close),
|
|
|
|
JUMP_INIT (stat, _IO_file_stat),
|
|
|
|
JUMP_INIT (showmanyc, _IO_default_showmanyc),
|
|
|
|
JUMP_INIT (imbue, _IO_default_imbue)
|
|
|
|
},
|
|
|
|
#endif
|
|
|
|
|
|
|
|
#if SHLIB_COMPAT (libc, GLIBC_2_0, GLIBC_2_2)
|
|
|
|
/* _IO_old_cookie_jumps */
|
|
|
|
[IO_OLD_COOKIED_JUMPS] = {
|
|
|
|
JUMP_INIT_DUMMY,
|
|
|
|
JUMP_INIT (finish, _IO_file_finish),
|
|
|
|
JUMP_INIT (overflow, _IO_file_overflow),
|
|
|
|
JUMP_INIT (underflow, _IO_file_underflow),
|
|
|
|
JUMP_INIT (uflow, _IO_default_uflow),
|
|
|
|
JUMP_INIT (pbackfail, _IO_default_pbackfail),
|
|
|
|
JUMP_INIT (xsputn, _IO_file_xsputn),
|
|
|
|
JUMP_INIT (xsgetn, _IO_default_xsgetn),
|
|
|
|
JUMP_INIT (seekoff, _IO_cookie_seekoff),
|
|
|
|
JUMP_INIT (seekpos, _IO_default_seekpos),
|
|
|
|
JUMP_INIT (setbuf, _IO_file_setbuf),
|
|
|
|
JUMP_INIT (sync, _IO_file_sync),
|
|
|
|
JUMP_INIT (doallocate, _IO_file_doallocate),
|
|
|
|
JUMP_INIT (read, _IO_cookie_read),
|
|
|
|
JUMP_INIT (write, _IO_cookie_write),
|
|
|
|
JUMP_INIT (seek, _IO_old_cookie_seek),
|
|
|
|
JUMP_INIT (close, _IO_cookie_close),
|
|
|
|
JUMP_INIT (stat, _IO_default_stat),
|
|
|
|
JUMP_INIT (showmanyc, _IO_default_showmanyc),
|
|
|
|
JUMP_INIT (imbue, _IO_default_imbue),
|
|
|
|
},
|
|
|
|
#endif
|
|
|
|
};
|
2023-09-08 19:55:19 +00:00
|
|
|
_Static_assert (array_length (__io_vtables) == IO_VTABLES_NUM,
|
|
|
|
"initializer count");
|
libio: Implement vtable verification [BZ #20191]
This commit puts all libio vtables in a dedicated, read-only ELF
section, so that they are consecutive in memory. Before any indirect
jump, the vtable pointer is checked against the section boundaries,
and the process is terminated if the vtable pointer does not fall into
the special ELF section.
To enable backwards compatibility, a special flag variable
(_IO_accept_foreign_vtables), protected by the pointer guard, avoids
process termination if libio stream object constructor functions have
been called earlier. Such constructor functions are called by the GCC
2.95 libstdc++ library, and this mechanism ensures compatibility with
old binaries. Existing callers inside glibc of these functions are
adjusted to call the original functions, not the wrappers which enable
vtable compatiblity.
The compatibility mechanism is used to enable passing FILE * objects
across a static dlopen boundary, too.
2016-06-23 18:01:40 +00:00
|
|
|
|
|
|
|
#ifdef SHARED
|
|
|
|
|
|
|
|
void (*IO_accept_foreign_vtables) (void) attribute_hidden;
|
|
|
|
|
|
|
|
#else /* !SHARED */
|
|
|
|
|
|
|
|
/* Used to check whether static dlopen support is needed. */
|
|
|
|
# pragma weak __dlopen
|
|
|
|
|
|
|
|
#endif
|
|
|
|
|
|
|
|
void attribute_hidden
|
|
|
|
_IO_vtable_check (void)
|
|
|
|
{
|
|
|
|
#ifdef SHARED
|
|
|
|
/* Honor the compatibility flag. */
|
|
|
|
void (*flag) (void) = atomic_load_relaxed (&IO_accept_foreign_vtables);
|
|
|
|
PTR_DEMANGLE (flag);
|
|
|
|
if (flag == &_IO_vtable_check)
|
|
|
|
return;
|
|
|
|
|
|
|
|
/* In case this libc copy is in a non-default namespace, we always
|
|
|
|
need to accept foreign vtables because there is always a
|
|
|
|
possibility that FILE * objects are passed across the linking
|
|
|
|
boundary. */
|
|
|
|
{
|
|
|
|
Dl_info di;
|
|
|
|
struct link_map *l;
|
2017-12-18 19:04:13 +00:00
|
|
|
if (!rtld_active ()
|
libio: Implement vtable verification [BZ #20191]
This commit puts all libio vtables in a dedicated, read-only ELF
section, so that they are consecutive in memory. Before any indirect
jump, the vtable pointer is checked against the section boundaries,
and the process is terminated if the vtable pointer does not fall into
the special ELF section.
To enable backwards compatibility, a special flag variable
(_IO_accept_foreign_vtables), protected by the pointer guard, avoids
process termination if libio stream object constructor functions have
been called earlier. Such constructor functions are called by the GCC
2.95 libstdc++ library, and this mechanism ensures compatibility with
old binaries. Existing callers inside glibc of these functions are
adjusted to call the original functions, not the wrappers which enable
vtable compatiblity.
The compatibility mechanism is used to enable passing FILE * objects
across a static dlopen boundary, too.
2016-06-23 18:01:40 +00:00
|
|
|
|| (_dl_addr (_IO_vtable_check, &di, &l, NULL) != 0
|
|
|
|
&& l->l_ns != LM_ID_BASE))
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
|
|
|
#else /* !SHARED */
|
|
|
|
/* We cannot perform vtable validation in the static dlopen case
|
|
|
|
because FILE * handles might be passed back and forth across the
|
|
|
|
boundary. Therefore, we disable checking in this case. */
|
|
|
|
if (__dlopen != NULL)
|
|
|
|
return;
|
|
|
|
#endif
|
|
|
|
|
|
|
|
__libc_fatal ("Fatal error: glibc detected an invalid stdio handle\n");
|
|
|
|
}
|
2018-06-26 08:24:52 +00:00
|
|
|
|
|
|
|
/* Some variants of libstdc++ interpose _IO_2_1_stdin_ etc. and
|
|
|
|
install their own vtables directly, without calling _IO_init or
|
|
|
|
other functions. Detect this by looking at the vtables values
|
|
|
|
during startup, and disable vtable validation in this case. */
|
|
|
|
#ifdef SHARED
|
|
|
|
__attribute__ ((constructor))
|
|
|
|
static void
|
|
|
|
check_stdfiles_vtables (void)
|
|
|
|
{
|
|
|
|
if (_IO_2_1_stdin_.vtable != &_IO_file_jumps
|
|
|
|
|| _IO_2_1_stdout_.vtable != &_IO_file_jumps
|
|
|
|
|| _IO_2_1_stderr_.vtable != &_IO_file_jumps)
|
|
|
|
IO_set_accept_foreign_vtables (&_IO_vtable_check);
|
|
|
|
}
|
|
|
|
#endif
|
2022-12-27 21:11:43 +00:00
|
|
|
|
|
|
|
#define STR(s) XSTR(s)
|
|
|
|
#define XSTR(s) #s
|
|
|
|
|
|
|
|
#undef _IO_file_jumps
|
|
|
|
#define _IO_file_jumps_alias "__io_vtables + " STR(IO_FILE_JUMPS_OFFSET)
|
|
|
|
declare_object_symbol_alias (_IO_file_jumps, _IO_file_jumps_alias,
|
|
|
|
IO_JUMP_T_SIZE)
|
|
|
|
#undef _IO_wfile_jumps
|
|
|
|
#define _IO_wfile_jumps_alias "__io_vtables + " STR(IO_WFILE_JUMPS_OFFSET)
|
|
|
|
declare_object_symbol_alias (_IO_wfile_jumps, _IO_wfile_jumps_alias,
|
|
|
|
IO_JUMP_T_SIZE)
|