1 /* $NetBSD: symbol.c,v 1.69 2017/08/09 18:44:32 joerg Exp $ */ 2 3 /* 4 * Copyright 1996 John D. Polstra. 5 * Copyright 1996 Matt Thomas <matt@3am-software.com> 6 * Copyright 2002 Charles M. Hannum <root@ihack.net> 7 * All rights reserved. 8 * 9 * Redistribution and use in source and binary forms, with or without 10 * modification, are permitted provided that the following conditions 11 * are met: 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 2. Redistributions in binary form must reproduce the above copyright 15 * notice, this list of conditions and the following disclaimer in the 16 * documentation and/or other materials provided with the distribution. 17 * 3. All advertising materials mentioning features or use of this software 18 * must display the following acknowledgement: 19 * This product includes software developed by John Polstra. 20 * 4. The name of the author may not be used to endorse or promote products 21 * derived from this software without specific prior written permission. 22 * 23 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR 24 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES 25 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. 26 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, 27 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 28 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, 29 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY 30 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT 31 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF 32 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 33 */ 34 35 /* 36 * Dynamic linker for ELF. 37 * 38 * John Polstra <jdp@polstra.com>. 39 */ 40 41 #include <sys/cdefs.h> 42 #ifndef lint 43 __RCSID("$NetBSD: symbol.c,v 1.69 2017/08/09 18:44:32 joerg Exp $"); 44 #endif /* not lint */ 45 46 #include <err.h> 47 #include <errno.h> 48 #include <fcntl.h> 49 #include <stdarg.h> 50 #include <stdio.h> 51 #include <stdlib.h> 52 #include <string.h> 53 #include <unistd.h> 54 #include <sys/types.h> 55 #include <sys/mman.h> 56 #include <sys/bitops.h> 57 #include <dirent.h> 58 59 #include "debug.h" 60 #include "rtld.h" 61 62 /* 63 * If the given object is already in the donelist, return true. Otherwise 64 * add the object to the list and return false. 65 */ 66 static bool 67 _rtld_donelist_check(DoneList *dlp, const Obj_Entry *obj) 68 { 69 unsigned int i; 70 71 for (i = 0; i < dlp->num_used; i++) 72 if (dlp->objs[i] == obj) 73 return true; 74 /* 75 * Our donelist allocation may not always be sufficient as we're not 76 * thread safe. We'll handle it properly anyway. 77 */ 78 if (dlp->num_used < dlp->num_alloc) 79 dlp->objs[dlp->num_used++] = obj; 80 return false; 81 } 82 83 /* 84 * Hash function for symbol table lookup. Don't even think about changing 85 * this. It is specified by the System V ABI. 86 */ 87 unsigned long 88 _rtld_elf_hash(const char *name) 89 { 90 const unsigned char *p = (const unsigned char *) name; 91 unsigned long h = 0; 92 unsigned long g; 93 unsigned long c; 94 95 for (; __predict_true((c = *p) != '\0'); p++) { 96 h <<= 4; 97 h += c; 98 if ((g = h & 0xf0000000) != 0) { 99 h ^= g; 100 h ^= g >> 24; 101 } 102 } 103 return (h); 104 } 105 106 const Elf_Sym * 107 _rtld_symlook_list(const char *name, unsigned long hash, const Objlist *objlist, 108 const Obj_Entry **defobj_out, u_int flags, const Ver_Entry *ventry, 109 DoneList *dlp) 110 { 111 const Elf_Sym *symp; 112 const Elf_Sym *def; 113 const Obj_Entry *defobj; 114 const Objlist_Entry *elm; 115 116 def = NULL; 117 defobj = NULL; 118 SIMPLEQ_FOREACH(elm, objlist, link) { 119 if (_rtld_donelist_check(dlp, elm->obj)) 120 continue; 121 rdbg(("search object %p (%s) for %s", elm->obj, elm->obj->path, 122 name)); 123 symp = _rtld_symlook_obj(name, hash, elm->obj, flags, ventry); 124 if (symp != NULL) { 125 if ((def == NULL) || 126 (ELF_ST_BIND(symp->st_info) != STB_WEAK)) { 127 def = symp; 128 defobj = elm->obj; 129 if (ELF_ST_BIND(def->st_info) != STB_WEAK) 130 break; 131 } 132 } 133 } 134 if (def != NULL) 135 *defobj_out = defobj; 136 return def; 137 } 138 139 /* 140 * Search the symbol table of a shared object and all objects needed by it for 141 * a symbol of the given name. Search order is breadth-first. Returns a pointer 142 * to the symbol, or NULL if no definition was found. 143 */ 144 const Elf_Sym * 145 _rtld_symlook_needed(const char *name, unsigned long hash, 146 const Needed_Entry *needed, const Obj_Entry **defobj_out, u_int flags, 147 const Ver_Entry *ventry, DoneList *breadth, DoneList *depth) 148 { 149 const Elf_Sym *def, *def_w; 150 const Needed_Entry *n; 151 const Obj_Entry *obj, *defobj, *defobj1; 152 153 def = def_w = NULL; 154 defobj = NULL; 155 for (n = needed; n != NULL; n = n->next) { 156 if ((obj = n->obj) == NULL) 157 continue; 158 if (_rtld_donelist_check(breadth, obj)) 159 continue; 160 def = _rtld_symlook_obj(name, hash, obj, flags, ventry); 161 if (def == NULL) 162 continue; 163 defobj = obj; 164 if (ELF_ST_BIND(def->st_info) != STB_WEAK) { 165 *defobj_out = defobj; 166 167 return (def); 168 } 169 } 170 /* 171 * Either the symbol definition has not been found in directly needed 172 * objects, or the found symbol is weak. 173 */ 174 for (n = needed; n != NULL; n = n->next) { 175 if ((obj = n->obj) == NULL) 176 continue; 177 if (_rtld_donelist_check(depth, obj)) 178 continue; 179 def_w = _rtld_symlook_needed(name, hash, obj->needed, &defobj1, 180 flags, ventry, breadth, depth); 181 if (def_w == NULL) 182 continue; 183 if (def == NULL || ELF_ST_BIND(def_w->st_info) != STB_WEAK) { 184 def = def_w; 185 defobj = defobj1; 186 if (ELF_ST_BIND(def_w->st_info) != STB_WEAK) 187 break; 188 } 189 } 190 if (def != NULL) 191 *defobj_out = defobj; 192 193 return def; 194 } 195 196 /* 197 * Search the symbol table of a single shared object for a symbol of 198 * the given name. Returns a pointer to the symbol, or NULL if no 199 * definition was found. 200 * 201 * The symbol's hash value is passed in for efficiency reasons; that 202 * eliminates many recomputations of the hash value. 203 */ 204 const Elf_Sym * 205 _rtld_symlook_obj(const char *name, unsigned long hash, 206 const Obj_Entry *obj, u_int flags, const Ver_Entry *ventry) 207 { 208 unsigned long symnum; 209 const Elf_Sym *vsymp = NULL; 210 Elf_Half verndx; 211 int vcount = 0; 212 213 for (symnum = obj->buckets[fast_remainder32(hash, obj->nbuckets, 214 obj->nbuckets_m, obj->nbuckets_s1, obj->nbuckets_s2)]; 215 symnum != ELF_SYM_UNDEFINED; 216 symnum = obj->chains[symnum]) { 217 const Elf_Sym *symp; 218 const char *strp; 219 220 assert(symnum < obj->nchains); 221 symp = obj->symtab + symnum; 222 strp = obj->strtab + symp->st_name; 223 rdbg(("check \"%s\" vs \"%s\" in %s", name, strp, obj->path)); 224 if (name[1] != strp[1] || strcmp(name, strp)) 225 continue; 226 #if defined(__mips__) || defined(__vax__) 227 if (symp->st_shndx == SHN_UNDEF) 228 continue; 229 #else 230 /* 231 * XXX DANGER WILL ROBINSON! 232 * If we have a function pointer in the executable's 233 * data section, it points to the executable's PLT 234 * slot, and there is NO relocation emitted. To make 235 * the function pointer comparable to function pointers 236 * in shared libraries, we must resolve data references 237 * in the libraries to point to PLT slots in the 238 * executable, if they exist. 239 */ 240 if (symp->st_shndx == SHN_UNDEF && 241 ((flags & SYMLOOK_IN_PLT) || 242 symp->st_value == 0 || 243 ELF_ST_TYPE(symp->st_info) != STT_FUNC)) 244 continue; 245 #endif 246 247 if (ventry == NULL) { 248 if (obj->versyms != NULL) { 249 verndx = VER_NDX(obj->versyms[symnum].vs_vers); 250 if (verndx > obj->vertabnum) { 251 _rtld_error("%s: symbol %s references " 252 "wrong version %d", obj->path, 253 &obj->strtab[symnum], verndx); 254 continue; 255 } 256 257 /* 258 * If we are not called from dlsym (i.e. this 259 * is a normal relocation from unversioned 260 * binary), accept the symbol immediately 261 * if it happens to have first version after 262 * this shared object became versioned. 263 * Otherwise, if symbol is versioned and not 264 * hidden, remember it. If it is the only 265 * symbol with this name exported by the shared 266 * object, it will be returned as a match at the 267 * end of the function. If symbol is global 268 * (verndx < 2) accept it unconditionally. 269 */ 270 if (!(flags & SYMLOOK_DLSYM) && 271 verndx == VER_NDX_GIVEN) { 272 return symp; 273 } else if (verndx >= VER_NDX_GIVEN) { 274 if (!(obj->versyms[symnum].vs_vers & VER_NDX_HIDDEN)) { 275 if (vsymp == NULL) 276 vsymp = symp; 277 vcount++; 278 } 279 continue; 280 } 281 } 282 return symp; 283 } else { 284 if (obj->versyms == NULL) { 285 if (_rtld_object_match_name(obj, ventry->name)){ 286 _rtld_error("%s: object %s should " 287 "provide version %s for symbol %s", 288 _rtld_objself.path, obj->path, 289 ventry->name, &obj->strtab[symnum]); 290 continue; 291 } 292 } else { 293 verndx = VER_NDX(obj->versyms[symnum].vs_vers); 294 if (verndx > obj->vertabnum) { 295 _rtld_error("%s: symbol %s references " 296 "wrong version %d", obj->path, 297 &obj->strtab[symnum], verndx); 298 continue; 299 } 300 if (obj->vertab[verndx].hash != ventry->hash || 301 strcmp(obj->vertab[verndx].name, ventry->name)) { 302 /* 303 * Version does not match. Look if this 304 * is a global symbol and if it is not 305 * hidden. If global symbol (verndx < 2) 306 * is available, use it. Do not return 307 * symbol if we are called by dlvsym, 308 * because dlvsym looks for a specific 309 * version and default one is not what 310 * dlvsym wants. 311 */ 312 if ((flags & SYMLOOK_DLSYM) || 313 (obj->versyms[symnum].vs_vers & VER_NDX_HIDDEN) || 314 (verndx >= VER_NDX_GIVEN)) 315 continue; 316 } 317 } 318 return symp; 319 } 320 } 321 if (vcount == 1) 322 return vsymp; 323 return NULL; 324 } 325 326 /* 327 * Given a symbol number in a referencing object, find the corresponding 328 * definition of the symbol. Returns a pointer to the symbol, or NULL if 329 * no definition was found. Returns a pointer to the Obj_Entry of the 330 * defining object via the reference parameter DEFOBJ_OUT. 331 */ 332 const Elf_Sym * 333 _rtld_find_symdef(unsigned long symnum, const Obj_Entry *refobj, 334 const Obj_Entry **defobj_out, u_int flags) 335 { 336 const Elf_Sym *ref; 337 const Elf_Sym *def; 338 const Obj_Entry *defobj; 339 const char *name; 340 unsigned long hash; 341 342 ref = refobj->symtab + symnum; 343 name = refobj->strtab + ref->st_name; 344 345 /* 346 * We don't have to do a full scale lookup if the symbol is local. 347 * We know it will bind to the instance in this load module; to 348 * which we already have a pointer (ie ref). 349 */ 350 if (ELF_ST_BIND(ref->st_info) != STB_LOCAL) { 351 if (ELF_ST_TYPE(ref->st_info) == STT_SECTION) { 352 _rtld_error("%s: Bogus symbol table entry %lu", 353 refobj->path, symnum); 354 } 355 356 hash = _rtld_elf_hash(name); 357 defobj = NULL; 358 def = _rtld_symlook_default(name, hash, refobj, &defobj, flags, 359 _rtld_fetch_ventry(refobj, symnum)); 360 } else { 361 rdbg(("STB_LOCAL symbol %s in %s", name, refobj->path)); 362 def = ref; 363 defobj = refobj; 364 } 365 366 /* 367 * If we found no definition and the reference is weak, treat the 368 * symbol as having the value zero. 369 */ 370 if (def == NULL && ELF_ST_BIND(ref->st_info) == STB_WEAK) { 371 rdbg((" returning _rtld_sym_zero@_rtld_objself")); 372 def = &_rtld_sym_zero; 373 defobj = &_rtld_objself; 374 } 375 376 if (def != NULL) { 377 *defobj_out = defobj; 378 } else { 379 rdbg(("lookup failed")); 380 _rtld_error("%s: Undefined %ssymbol \"%s\" (symnum = %ld)", 381 refobj->path, (flags & SYMLOOK_IN_PLT) ? "PLT " : "", 382 name, symnum); 383 } 384 return def; 385 } 386 387 const Elf_Sym * 388 _rtld_find_plt_symdef(unsigned long symnum, const Obj_Entry *obj, 389 const Obj_Entry **defobj, bool imm) 390 { 391 const Elf_Sym *def = _rtld_find_symdef(symnum, obj, defobj, 392 SYMLOOK_IN_PLT); 393 if (__predict_false(def == NULL)) 394 return NULL; 395 396 if (__predict_false(def == &_rtld_sym_zero)) { 397 /* tp is set during lazy binding. */ 398 if (imm) { 399 const Elf_Sym *ref = obj->symtab + symnum; 400 const char *name = obj->strtab + ref->st_name; 401 402 _rtld_error( 403 "%s: Trying to call undefined weak symbol `%s'", 404 obj->path, name); 405 return NULL; 406 } 407 } 408 return def; 409 } 410 411 /* 412 * Given a symbol name in a referencing object, find the corresponding 413 * definition of the symbol. Returns a pointer to the symbol, or NULL if 414 * no definition was found. Returns a pointer to the Obj_Entry of the 415 * defining object via the reference parameter DEFOBJ_OUT. 416 */ 417 const Elf_Sym * 418 _rtld_symlook_default(const char *name, unsigned long hash, 419 const Obj_Entry *refobj, const Obj_Entry **defobj_out, u_int flags, 420 const Ver_Entry *ventry) 421 { 422 const Elf_Sym *def; 423 const Elf_Sym *symp; 424 const Obj_Entry *obj; 425 const Obj_Entry *defobj; 426 const Objlist_Entry *elm; 427 def = NULL; 428 defobj = NULL; 429 DoneList donelist; 430 431 _rtld_donelist_init(&donelist); 432 433 /* Look first in the referencing object if linked symbolically. */ 434 if (refobj->symbolic && !_rtld_donelist_check(&donelist, refobj)) { 435 rdbg(("search referencing object for %s", name)); 436 symp = _rtld_symlook_obj(name, hash, refobj, flags, ventry); 437 if (symp != NULL) { 438 def = symp; 439 defobj = refobj; 440 } 441 } 442 443 /* Search all objects loaded at program start up. */ 444 if (def == NULL || ELF_ST_BIND(def->st_info) == STB_WEAK) { 445 rdbg(("search _rtld_list_main for %s", name)); 446 symp = _rtld_symlook_list(name, hash, &_rtld_list_main, &obj, 447 flags, ventry, &donelist); 448 if (symp != NULL && 449 (def == NULL || ELF_ST_BIND(symp->st_info) != STB_WEAK)) { 450 def = symp; 451 defobj = obj; 452 } 453 } 454 455 /* Search all RTLD_GLOBAL objects. */ 456 if (def == NULL || ELF_ST_BIND(def->st_info) == STB_WEAK) { 457 rdbg(("search _rtld_list_global for %s", name)); 458 symp = _rtld_symlook_list(name, hash, &_rtld_list_global, 459 &obj, flags, ventry, &donelist); 460 if (symp != NULL && 461 (def == NULL || ELF_ST_BIND(symp->st_info) != STB_WEAK)) { 462 def = symp; 463 defobj = obj; 464 } 465 } 466 467 /* Search all dlopened DAGs containing the referencing object. */ 468 SIMPLEQ_FOREACH(elm, &refobj->dldags, link) { 469 if (def != NULL && ELF_ST_BIND(def->st_info) != STB_WEAK) 470 break; 471 rdbg(("search DAG with root %p (%s) for %s", elm->obj, 472 elm->obj->path, name)); 473 symp = _rtld_symlook_list(name, hash, &elm->obj->dagmembers, 474 &obj, flags, ventry, &donelist); 475 if (symp != NULL && 476 (def == NULL || ELF_ST_BIND(symp->st_info) != STB_WEAK)) { 477 def = symp; 478 defobj = obj; 479 } 480 } 481 482 /* 483 * Finally, look in the referencing object if not linked symbolically. 484 * This is necessary for DF_1_NODELETE objects where the containing DAG 485 * has been unlinked, so local references are resolved properly. 486 */ 487 if ((def == NULL || ELF_ST_BIND(def->st_info) == STB_WEAK) && 488 !refobj->symbolic && !_rtld_donelist_check(&donelist, refobj)) { 489 rdbg(("search referencing object for %s", name)); 490 symp = _rtld_symlook_obj(name, hash, refobj, flags, ventry); 491 if (symp != NULL) { 492 def = symp; 493 defobj = refobj; 494 } 495 } 496 497 /* 498 * Search the dynamic linker itself, and possibly resolve the 499 * symbol from there. This is how the application links to 500 * dynamic linker services such as dlopen. 501 */ 502 if (def == NULL || ELF_ST_BIND(def->st_info) == STB_WEAK) { 503 rdbg(("Search the dynamic linker itself.")); 504 symp = _rtld_symlook_obj(name, hash, &_rtld_objself, flags, 505 ventry); 506 if (symp != NULL) { 507 def = symp; 508 defobj = &_rtld_objself; 509 } 510 } 511 512 if (def != NULL) 513 *defobj_out = defobj; 514 return def; 515 } 516