[PATCH v4 00/14] RELRO link maps

[Florian Weimer]

* Yury Khrustalev:

> Backtraces:
>
> 1) misc/tst-pkey
>
> (gdb) bt
> #0  0x0000fffff7fcd0e0 in _dl_fixup (l=0xfffff7f7e700, reloc_arg=1152) at dl-runtime.c:48
> #1  0x0000fffff7fcf40c in _dl_runtime_resolve () at ../sysdeps/aarch64/dl-trampoline.S:100
> #2  0x0000aaaaaaaa3918 in sigsegv_handler (signum=<opt>, info=<opt>, context=<opt>) at ../sysdeps/unix/sysv/linux/tst-pkey.c:57
> #3  0x0000aaaaaaaa3918 in sigsegv_handler (signum=<opt>, info=<opt>, context=<opt>) at ../sysdeps/unix/sysv/linux/tst-pkey.c:57
> #4  <signal handler called>
> #5  0x0000aaaaaaaa2714 in check_page_access (page=page@entry=0, write=write@entry=false) at ../sysdeps/unix/sysv/linux/tst-pkey.c:92
> #6  0x0000aaaaaaaa3988 in delayed_thread_func (closure=<opt>) at ../sysdeps/unix/sysv/linux/tst-pkey.c:161
> #7  0x0000fffff7e425c0 in start_thread (arg=0xfffff7dbf1a0) at pthread_create.c:456
> #8  0x0000fffff7ea36cc in thread_start () at ../sysdeps/unix/sysv/linux/aarch64/clone3.S:76

This means that AArch64 implements the x86-64 protection key semantics
for signal handling, and not the POWER semantics: all access rights are
revoked in signal handlers.  (Signal handlers on POWER inherit the
access rights from the interrupted context.)  As a result of this
choice, ld.so protected memory area becomes unreadable in signal
handlers.  Your glibc (test) build uses lazy binding for symbol
resolution, which requires access to link map data structures, hence the
crash.

We could reset the access rights to the expected values at the start of
_dl_fixup, _dl_find_object and other dynamic linker functions used in
signal handlers.  This should allow us crashes in glibc code.  However,
it will not help with applications that keep around an link map pointer
(like the l_name string) and use it from signal handlers, or use
_r_debug from signal handlers.  This is why I have not implemented this
workaround, and instead changed the default for x86-64 by setting

#define DL_PROTMEM_PKEY_ENABLE 0

in sysdeps/unix/sysv/linux/x86/dl-protmem-pkey.h.  Looks like we should
do the same for AArch64 for now.

The good news is that this not an architectural limitation, but a choice
that can be made based on protection key in the Linux implementation
(controlled by a pkey_alloc flag if necessary).  I had a working kernel
patch for x86-64 at one point, but I couldn't get it integrated because
changes were requested that were beyond my kernel knowledge.

Thanks,
Florian