[PATCH v4 00/14] RELRO link maps

[Yury Khrustalev]

Hi Florian,

On Sun, Feb 02, 2025 at 10:12:42PM +0100, Florian Weimer wrote:
> This series introduces a new security hardening.  The main goal is to
> prevent direct overwrite attacks on the internal l_info[DT_FINI] and
> l_infi[DT_FINI_ARRAY] members of the link map.  These are attractive
> targets because the pointers are not obfuscated.  The path to DWARF data
> via _dl_find_object is kept read-only as well.
> 
> ...
> 
> startup and dlopen operations a bit faster).  AArch64 protection key
> support is available in the glibc sources, but I have not been able to
> test it on an implementation.

I've run some tests of FVP fast model using kernel 6.13 and building with
GCC 14.2 + binutils 2.44. FVP provides AArch64 platform with support of
memory protection keys.

Out of all misc tests, the following 3 tests fail with SIGSEGV in _dl_fixup
at dl-runtime.c:48:
 - FAIL: misc/tst-gettid-kill
 - FAIL: misc/tst-pkey
 - FAIL: misc/tst-sigcontext-get_pc

See backtraces for these tests below.

On AArch64 system without memory prot keys (Graviton 4, linux 6.8.0), these
tests are:
 - UNSUPPORTED: misc/tst-pkey
 - PASS: misc/tst-gettid-kill
 - PASS: misc/tst-sigcontext-get_pci

Interstingly, the resolv/tst-resolv-ai_idn-nolibidn2 test (that failed in
the CI) passes both on FVP and on my AArch64 host.

I don't see any failures in the elf tests but a lot of nptl tests fail with
SIGSEGV too. I haven't finished running full testsuite yet.

I'm happy to review and test following versions of this patch series.

---

Backtraces:

1) misc/tst-pkey

(gdb) bt
#0  0x0000fffff7fcd0e0 in _dl_fixup (l=0xfffff7f7e700, reloc_arg=1152) at dl-runtime.c:48
#1  0x0000fffff7fcf40c in _dl_runtime_resolve () at ../sysdeps/aarch64/dl-trampoline.S:100
#2  0x0000aaaaaaaa3918 in sigsegv_handler (signum=<opt>, info=<opt>, context=<opt>) at ../sysdeps/unix/sysv/linux/tst-pkey.c:57
#3  0x0000aaaaaaaa3918 in sigsegv_handler (signum=<opt>, info=<opt>, context=<opt>) at ../sysdeps/unix/sysv/linux/tst-pkey.c:57
#4  <signal handler called>
#5  0x0000aaaaaaaa2714 in check_page_access (page=page@entry=0, write=write@entry=false) at ../sysdeps/unix/sysv/linux/tst-pkey.c:92
#6  0x0000aaaaaaaa3988 in delayed_thread_func (closure=<opt>) at ../sysdeps/unix/sysv/linux/tst-pkey.c:161
#7  0x0000fffff7e425c0 in start_thread (arg=0xfffff7dbf1a0) at pthread_create.c:456
#8  0x0000fffff7ea36cc in thread_start () at ../sysdeps/unix/sysv/linux/aarch64/clone3.S:76

Dump of assembler code for function _dl_fixup:
   0x0000fffff7fcd0c0 <+0>: stp x29, x30, [sp, #-128]!
   0x0000fffff7fcd0c4 <+4>: mov x5, #0x0                    // #0
   0x0000fffff7fcd0c8 <+8>: mov x29, sp
   0x0000fffff7fcd0cc <+12>:    stp x19, x20, [sp, #16]
   0x0000fffff7fcd0d0 <+16>:    mov x19, x0
   0x0000fffff7fcd0d4 <+20>:    stp x21, x22, [sp, #32]
   0x0000fffff7fcd0d8 <+24>:    stp x23, x24, [sp, #48]
   0x0000fffff7fcd0dc <+28>:    stp x25, x26, [sp, #64]
=> 0x0000fffff7fcd0e0 <+32>:    ldr x2, [x0, #120]

2) misc/tst-gettid-kill

(gdb) bt
#0  0x0000fffff7fcd0e0 in _dl_fixup (l=0xfffff7f7e700, reloc_arg=1368) at dl-runtime.c:48
#1  0x0000fffff7fcf40c in _dl_runtime_resolve () at ../sysdeps/aarch64/dl-trampoline.S:100
#2  0x0000aaaaaaaa26c4 in sigusr1_handler (signo=<opt>) at ../sysdeps/unix/sysv/linux/tst-gettid-kill.c:51
#3  0x0000000000000000 in ?? ()
Backtrace stopped: previous frame identical to this frame (corrupt stack?)

3) misc/tst-sigcontext-get_pc

(gdb) bt
#0  0x0000fffff7fcd0e0 in _dl_fixup (l=0xfffff7f7e700, reloc_arg=1152) at dl-runtime.c:48
#1  0x0000fffff7fcf40c in _dl_runtime_resolve () at ../sysdeps/aarch64/dl-trampoline.S:100
#2  0x0000aaaaaaaa1ec0 in handler (signal=<opt>, info=<opt>, ctx=0xffffffffe010) at ../sysdeps/unix/sysv/linux/tst-sigcontext-get_pc.c:40
#3  0x0000000000000000 in ?? ()
Backtrace stopped: previous frame identical to this frame (corrupt stack?)

---

Kind regards,
Yury