On Thu, Apr 14, 2022 at 04:05:54PM -0700, Kees Cook wrote:
On Thu, Apr 14, 2022 at 11:10:18AM +0200, Niklas Cassel wrote:
(snip)
+static inline u32 __user *skip_got_header(u32 __user *rp) +{
- if (IS_ENABLED(CONFIG_RISCV)) {
/** RISC-V has a 16 byte GOT PLT header for elf64-riscv* and 8 byte GOT PLT header for elf32-riscv.* Skip the whole GOT PLT header, since it is reserved* for the dynamic linker (ld.so).*/u32 rp_val0, rp_val1;if (get_user(rp_val0, rp))return rp;if (get_user(rp_val1, rp + 1))return rp;if (rp_val0 == 0xffffffff && rp_val1 == 0xffffffff)rp += 4;else if (rp_val0 == 0xffffffff)rp += 2;Just so I understand; due to the FILL(0) and the ALIGN, val1 will be 0 (or more specifically, not -1) in all other cases, yes?
For elf64-riscv with a .got.plt header: rp+0: -1, rp+1: -1, rp+2: 0, rp+3: 0
For elf32-riscv with a .got.plt header: rp+0: -1, rp+1: 0
At least riscv binutils 2.32, 2.37 and 2.38 all create a .got.plt header even when there are no .got.plt entries following the header.
Even if the .got.plt section was empty, there will still be data in the .got section, so rp+0 will still not be -1.
If there is no data in the .got section, then the _GLOBAL_OFFSET_TABLE_ symbol will not be defined, so elf2flt will not set the FLAT_FLAG_GOTPIC flag. (This code is only executed if that flag is set.)
Kind regards, Niklas