bionic: fix integer overflows in chk_malloc(), leak_malloc(), and leak_memalign()

The allocation size in chk_malloc(), leak_malloc(), and leak_memalign()
functions may be rounded up to a small value, leading to buffer overflows.
The code only runs in debugging mode.

This patch complements commit 6f04a0f4 (CVE-2009-0607).

Change-Id: Id899bcd2bcd2ea2205e5753c433390710032dc83
Signed-off-by: Xi Wang <xi.wang@gmail.com>
bionic: fix atfork hanlder_mutex deadlock

After applying the kernel_id fix, the system refused to boot up and we
got following crash log:
I/DEBUG   (  113): pid: 618, tid: 618  >>> org.simalliance.openmobileapi.service:remote <<<
I/DEBUG   (  113): signal 16 (SIGSTKFLT), code -6 (?), fault addr --------
I/DEBUG   (  113):  eax fffffe00  ebx b77de994  ecx 00000080  edx 00724002
I/DEBUG   (  113):  esi 00000000  edi 00004000
I/DEBUG   (  113):  xcs 00000073  xds 0000007b  xes 0000007b  xfs 00000000 xss 0000007b
I/DEBUG   (  113):  eip b7761351  ebp bfdf3de8  esp bfdf3dc4  flags 00000202
I/DEBUG   (  113):     #00  eip: 00015351  /system/lib/libc.so
I/DEBUG   (  113):     #01  eip: 0000d13c  /system/lib/libc.so (pthread_mutex_lock)
I/DEBUG   (  113):     #02  eip: 00077b48  /system/lib/libc.so (__bionic_atfork_run_prepare)
I/DEBUG   (  113):     #03  eip: 00052cdb  /system/lib/libc.so (fork)
I/DEBUG   (  113):     #04  eip: 0009ae91  /system/lib/libdvm.so (_Z18dvmOptimizeDexFileillPKcjjb)
I/DEBUG   (  113):     #05  eip: 000819d6  /system/lib/libdvm.so (_Z14dvmJarFileOpenPKcS0_PP7JarFileb)
I/DEBUG   (  113):     #06  eip: 000b175e  /system/lib/libdvm.so (_ZL40Dalvik_dalvik_system_DexFile_openDexFilePKjP6JValue)
I/DEBUG   (  113):     #07  eip: 0011fb94  /system/lib/libdvm.so

Root cause:
The atfork uses the mutex handler_mutex to protect the atfork_head. The
parent will call __bionic_atfork_run_prepare() to lock the handler_mutex,
and need both the parent and child to unlock their own copy of handler_mutex
after fork. At that time, the owner of hanlder_mutex is set as the parent.
If we apply the kernel_id fix, then the child's kernel_id will be set as
child's tid.
The handler_mutex is a recursive lock, and pthread_mutex_unlock(&hander_mutex)
will fail because the mutex owner is the parent, while the current tid
(__get_thread()->kernel_id) is child, not matched with the mutex owner.
At that time, the handler_mutex is left in lock state.If the child wants to
fork other process after than, then it will try to lock handler_mutex, and
then be deadlocked.

Fix:
Since the child has its own copy of vm space from the the parent, the
child space's handler_mutex should be reset to the initialized state.

Change-Id: I3907dd9a153418fb78862f2aa6d0302c375d9e27
Signed-off-by: Jack Ren <jack.ren@intel.com>
Signed-off-by: Chenyang Du <chenyang.du@intel.com>
Signed-off-by: Bruce Beare <bruce.j.beare@intel.com>
bionic/x86: fix one potential deadlock in __set_tls()

Fix bug:
Currently the mutex lock _tls_desc_lock is not released
when __set_thread_area() fails. That will leads to the deadlock
when __set_tls( ) is called later on.

Change-Id: Iea3267cb0659971cba7766cbc3346f6924274f86
Signed-off-by: Jin Wei <wei.a.jin@intel.com>
Signed-off-by: Jack Ren <jack.ren@intel.com>
Signed-off-by: Bruce Beare <bruce.j.beare@intel.com>
Redesign dlopen() locks to be recursive per thread.

That is to fix the bug:
dlxxx functions can't be called recursively.
For example, if we use dlopen() to use open one library whose constructor
also calls dlopen() in order to open another library, then the thread is
dead-blocked.

By changing the dl_lock from a non-recursive lock to a recursive lock, we can
prevent the thread from dead-blocked by recursive dlxxx calls in the same
thread context.

Change-Id: I1018b41c82f4641cc009c0a2eda31f5a47a534f9
Signed-off-by: Pavel Chupin <pavel.v.chupin@intel.com>
Signed-off-by: Jack Ren <jack.ren@intel.com>
Signed-off-by: Bruce Beare <bruce.j.beare@intel.com>
bionic: Fix wrong kernel_id in pthread descriptor after fork()

After forking, the kernel_id field in the phtread_internal_t returned by pthread_self()
is incorrect --- it's the tid from the parent, not the new tid of the
child.

The root cause is that: currently the kernel_id is set by
_init_thread(), which is called in 2 cases:
(1) called by __libc_init_common(). That happens when the execv( ) is
called after fork( ). But when the zygote tries to fork the android
application, the child application doesn't call execv( ), instread, it
tries to call the Java main method directly.
(2) called by pthread_create(). That happens when a new thread is
created.

For the lead thread which is the thread created by fork(), it should
call execv() but it doesn't, as described in (1) above. So its kernel_id
will inherit the parent's kernel_id.

Fixed it in this patch.

Change-Id: I63513e82af40ec5fe51fbb69456b1843e4bc0fc7
Signed-off-by: Chenyang Du <chenyang.du@intel.com>
Signed-off-by: Jack Ren <jack.ren@intel.com>
Signed-off-by: Bruce Beare <bruce.j.beare@intel.com>
libm: fix invalid result of function remquo/remquof

Currently we will get the wrong result as follows:
remquof(0x7bb33336, 0x63000000) = -671088640, 0x00000000
remquo(0xbff0000000000003, 0x3ff0000000000003) = 1, 0x8000000000000000
remquo(0x9120000000000001, 0x0000000000000005) = -1288490188, 0x0000000000000004
while the correct one should be:
remquof(0x7bb33336, 0x63000000) = 1476395008, 0x00000000
remquo(0xbff0000000000003, 0x3ff0000000000003) = -1, 0x8000000000000000
remquo(0x9120000000000001, 0x0000000000000005) = -1288490189, 0x0000000000000001

Fixed in this patch.

Change-Id: I540b348cd10a539f3b39b1753945c893c4c7ec46
Signed-off-by: Jingwei Zhang <jingwei.zhang@intel.com>
Signed-off-by: Jin Wei <wei.a.jin@intel.com>
Signed-off-by: Jack Ren <jack.ren@intel.com>
Signed-off-by: Bruce Beare <bruce.j.beare@intel.com>
bionic: Fix wrong prototype of system call getresuid/getresgid

In bionic/libc/SYSCALLS.TXT, the prototypes of system call
getresuid/getresgid are incorrect.

According to man page, they should be:
    int getresuid(uid_t *ruid, uid_t *euid, uid_t *suid);
    int getresgid(gid_t *rgid, gid_t *egid, gid_t *sgid);

Change-Id: I676098868bb05a9e1fe45419b234cf397626fdad
Signed-off-by: Jin Wei <wei.a.jin@intel.com>
Signed-off-by: Jack Ren <jack.ren@intel.com>
Signed-off-by: Bruce Beare <bruce.j.beare@intel.com>
Bionic: Fix wrong prototype of system call clock_nanosleep

In bionic/libc/SYSCALLS.TXT, the prototype of system call
clock_nanosleep is incorrect.

According to man page:
int clock_nanosleep(clockid_t clock_id, int flags,
                    const struct timespec *request,
                    struct timespec *remain);

Change-Id: Ic44c6db3d632293aa17998035554eacd664c2d57
Signed-off-by: Jin Wei <wei.a.jin@intel.com>
Signed-off-by: Jack Ren <jack.ren@intel.com>
Signed-off-by: Bruce Beare <bruce.j.beare@intel.com>
Add linker support for PIE

Modify the dynamic linker so that executables can be loaded
at locations other than 0x00000000.

Modify crtbegin* so that non-PIC compilant "thumb interwork
veneers" are not created by the linker.

Bug: 5323301
Change-Id: Iece0272e2b708c79034f302c20160e1fe9029588
linker: Fix the computation of si->base

The computation of si->base assumed that the first entry in the
program header table is a PT_PHDR. This results in the dynamic
linker crashing with a SIGSEGV/MAPERR when trying to load some
of the NDK unit test programs, which happen to have an EXIDX
header first, followed byu a PHDR one.

This patch fixes the computation by parsing the program header
table, looking explicitely for the PHDR entry. This fixes the
load of the NDK unit test programs, and doesn't affect system
libraries.

Change-Id: Id18ea6037dbe950b5abbbce816c2960321f0b81d
linker: set LOCAL_NO_CRT := true

Use LOCAL_NO_CRT to prevent linking against crtbegin.o, rather than
messing with build rules. This also prevents linking against crtend.o,
which isn't needed for the linker.

Change-Id: I0c5b9999be7e8676560fe145c1c033ffce8db4d1
Make the linker relocatable.

Previously, the linker always loaded itself into the same
location in memory, which inhibited the effectiveness of Android's
ASLR implementation. Modify the linker code so it can be relocatable
and link itself at runtime.

Change-Id: Ia80273d7a00ff648b4da545f4b69debee6343968

Conflicts:

	linker/Android.mk