[PATCH] Check multiple NT_GNU_PROPERTY_TYPE_0 notes [BZ #23509]

[Florian Weimer]

On 08/15/2018 05:29 PM, H.J. Lu wrote:
> On Wed, Aug 15, 2018 at 8:25 AM, Florian Weimer <fweimer@redhat.com> wrote:
>> On 08/15/2018 05:23 PM, H.J. Lu wrote:
>>>
>>> On Wed, Aug 15, 2018 at 8:17 AM, Florian Weimer <fweimer@redhat.com>
>>> wrote:
>>>>
>>>> On 08/14/2018 08:12 PM, H.J. Lu wrote:
>>>>>
>>>>>
>>>>> _dl_process_cet_property_note is called on on each PT_NOTE segment.
>>>>> We must keep searching until we found a PT_NOTE segment with a
>>>>> NT_GNU_PROPERTY_TYPE_0 note:
>>>>>
>>>>>      /* Skip if we have seen a NT_GNU_PROPERTY_TYPE_0 note before.  */
>>>>>      if (l->l_cet != lc_unknown)
>>>>>        return;
>>>>> ...
>>>>
>>>>
>>>>
>>>> What if there are different segments, each one with its own
>>>> NT_GNU_PROPERTY_TYPE_0?  Wouldn't that point to lack of linker support,
>>>> too?
>>>> So that CET needs to be disabled?
>>>
>>>
>>> Older linkers puts all NT_GNU_PROPERTY_TYPE_0 notes in one
>>> .note.gnu.property section.  One can certainly create some random notes
>>> which look like NT_GNU_PROPERTY_TYPE_0.  I don't think we need to
>>> check these notes.
>>
>>
>> I think older BFD ld creates multiple segments.
> 
> Which version of ld dos that?

Examples that got me worried look like this:

$ readelf -l /usr/bin/b5i2iso
…
   NOTE           0x0000000000000334 0x0000000000400334 0x0000000000400334
                  0x0000000000000020 0x0000000000000020  R      0x4
   NOTE           0x0000000000000358 0x0000000000400358 0x0000000000400358
                  0x0000000000000030 0x0000000000000030  R      0x8
   NOTE           0x0000000000000388 0x0000000000400388 0x0000000000400388
                  0x0000000000000024 0x0000000000000024  R      0x4
…
    07     .note.ABI-tag
    08     .note.gnu.property
    09     .note.gnu.build-id
…
$ rpm -qf /usr/bin/b5i2iso
AcetoneISO-6.7-26.fc29.x86_64

Per 
<https://kojipkgs.fedoraproject.org//packages/AcetoneISO/6.7/26.fc29/data/logs/x86_64/root.log>, 
this was built with binutils-2.30.90-4.fc29.

I don't know enough about the binutils linker to be certain that 
allocatable SHT_NOTE sections of the same name always go into the same 
PT_NOTE segment.  In the example above, the sections weren't split.

Thanks,
Florian