[PATCH v2] binfmt_flat: do not stop relocating GOT entries prematurely on riscv

[Niklas Cassel]

On Thu, Apr 14, 2022 at 04:05:54PM -0700, Kees Cook wrote:
> On Thu, Apr 14, 2022 at 11:10:18AM +0200, Niklas Cassel wrote:

(snip)

> > +static inline u32 __user *skip_got_header(u32 __user *rp)
> > +{
> > +	if (IS_ENABLED(CONFIG_RISCV)) {
> > +		/*
> > +		 * RISC-V has a 16 byte GOT PLT header for elf64-riscv
> > +		 * and 8 byte GOT PLT header for elf32-riscv.
> > +		 * Skip the whole GOT PLT header, since it is reserved
> > +		 * for the dynamic linker (ld.so).
> > +		 */
> > +		u32 rp_val0, rp_val1;
> > +
> > +		if (get_user(rp_val0, rp))
> > +			return rp;
> > +		if (get_user(rp_val1, rp + 1))
> > +			return rp;
> > +
> > +		if (rp_val0 == 0xffffffff && rp_val1 == 0xffffffff)
> > +			rp += 4;
> > +		else if (rp_val0 == 0xffffffff)
> > +			rp += 2;
> 
> Just so I understand; due to the FILL(0) and the ALIGN, val1 will be 0
> (or more specifically, not -1) in all other cases, yes?

For elf64-riscv with a .got.plt header:
rp+0: -1, rp+1: -1, rp+2: 0, rp+3: 0

For elf32-riscv with a .got.plt header:
rp+0: -1, rp+1: 0

At least riscv binutils 2.32, 2.37 and 2.38 all create a .got.plt header
even when there are no .got.plt entries following the header.

Even if the .got.plt section was empty, there will still be data in the
.got section, so rp+0 will still not be -1.

If there is no data in the .got section, then the _GLOBAL_OFFSET_TABLE_
symbol will not be defined, so elf2flt will not set the FLAT_FLAG_GOTPIC
flag. (This code is only executed if that flag is set.)


Kind regards,
Niklas