Skip to content

Commit

Permalink
Copy RELRO symbols to .copyrel.rel.ro instead of to .copyrel
Browse files Browse the repository at this point in the history
So that readonly data wouldn't become writable by copy relocations.
  • Loading branch information
rui314 committed Aug 17, 2023
1 parent f02db0f commit 1b1ab74
Show file tree
Hide file tree
Showing 2 changed files with 42 additions and 1 deletion.
3 changes: 2 additions & 1 deletion elf/input-files.cc
Original file line number Diff line number Diff line change
Expand Up @@ -1538,7 +1538,8 @@ bool SharedFile<E>::is_readonly(Symbol<E> *sym) {
u64 val = sym->esym().st_value;

for (ElfPhdr<E> &phdr : this->get_phdrs())
if (phdr.p_type == PT_LOAD && !(phdr.p_flags & PF_W) &&
if ((phdr.p_type == PT_LOAD || phdr.p_type == PT_GNU_RELRO) &&
!(phdr.p_flags & PF_W) &&
phdr.p_vaddr <= val && val < phdr.p_vaddr + phdr.p_memsz)
return true;
return false;
Expand Down
40 changes: 40 additions & 0 deletions test/elf/copyrel-relro2.sh
Original file line number Diff line number Diff line change
@@ -0,0 +1,40 @@
#!/bin/bash
. $(dirname $0)/common.inc

cat <<EOF | $CC -o $t/a.o -c -xc -fno-PIE -
#include <setjmp.h>
#include <signal.h>
#include <stdio.h>
extern char readonly[100];
extern char readwrite[100];
static int segv = 0;
static jmp_buf buf;
void handler(int sig) {
segv = 1;
longjmp(buf, 1);
}
int main() {
signal(SIGSEGV, handler);
readwrite[0] = 5;
int x = segv;
if (setjmp(buf) == 0)
*(char *)readonly = 5;
int y = segv;
printf("sigsegv %d %d\n", x, y);
}
EOF

cat <<EOF | $CC -fPIC -shared -o $t/b.so -xc -
__attribute__((section (".data.rel.ro"))) char readonly[100] = "abc";
char readwrite[100] = "abc";
EOF

$CC -B. $t/a.o $t/b.so -o $t/exe -no-pie
$QEMU $t/exe | grep -q '^sigsegv 0 1$'

0 comments on commit 1b1ab74

Please sign in to comment.