dlopen failed: "has text re

问题现象

• 复现步骤
  • Android 7.0平台 + 32bit CPU
  • 安装中国移动的和彩云apk
  • 启动该App时报错

分析定位

初步分析

• 相关错误log如下

  07-13 10:33:13.317 11237 11237 E linker  : /data/app-lib/hecaiyun_CMCC/libFastKDCore.so: has text relocations
  07-13 10:33:13.318 11237 11237 D AndroidRuntime: Shutting down VM
  07-13 10:33:13.360 11237 11237 E Exception:: Thread.getName()=main id=1 state=RUNNABLE
  07-13 10:33:13.361 11237 11237 E Exception:: Error[java.lang.UnsatisfiedLinkError: dlopen failed: /data/app-lib/hecaiyun_CMCC/libFastKDCore.so: has text relocations
  07-13 10:33:13.361 11237 11237 E Exception::    at java.lang.Runtime.loadLibrary0(Runtime.java:977)
  07-13 10:33:13.361 11237 11237 E Exception::    at java.lang.System.loadLibrary(System.java:1530)
  07-13 10:33:13.361 11237 11237 E Exception::    at com.chinamobile.mcloud.client.component.xmpp.bridge.impl.EngineBridge.<init>(Unknown Source)
  07-13 10:33:13.361 11237 11237 E Exception::    at com.chinamobile.mcloud.client.component.xmpp.bridge.impl.EngineBridge.getInstance(Unknown Source)
  07-13 10:33:13.361 11237 11237 E Exception::    at com.chinamobile.mcloud.client.component.service.impl.XmppImpl.init(Unknown Source)
  07-13 10:33:13.361 11237 11237 E Exception::    at com.chinamobile.mcloud.client.component.service.core.BaseService.onCreate(Unknown Source)
  07-13 10:33:13.361 11237 11237 E Exception::    at android.app.ActivityThread.handleCreateService(ActivityThread.java:3197)
  07-13 10:33:13.361 11237 11237 E Exception::    at android.app.ActivityThread.-wrap5(ActivityThread.java)
  07-13 10:33:13.361 11237 11237 E Exception::    at  android.app.ActivityThread$H.handleMessage(ActivityThread.java:1570)
  07-13 10:33:13.361 11237 11237 E Exception::    at android.os.Handler.dispatchMessage(Handler.java:102)
  07-13 10:33:13.361 11237 11237 E Exception::    at android.os.Looper.loop(Looper.java:154)
  07-13 10:33:13.361 11237 11237 E Exception::    at android.app.ActivityThread.main(ActivityThread.java:6162)
  07-13 10:33:13.361 11237 11237 E Exception::    at java.lang.reflect.Method.invoke(Native Method)
  07-13 10:33:13.361 11237 11237 E Exception::    at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:865)
  07-13 10:33:13.361 11237 11237 E Exception::    at  com.android.internal.os.ZygoteInit.main(ZygoteInit.java:755)
  07-13 10:33:13.361 11237 11237 E Exception:: ]
  07-13 10:33:13.456 11237 11248 I art     : Starting a blocking GC HomogeneousSpaceCompact
  07-13 10:33:13.472 11237 11244 I art     : Debugger is no longer active
  07-13 10:33:13.472 11237 11244 I art     : Starting a blocking GC Instrumentation
  07-13 10:33:14.871 11237 11283 E Exception:: Thread.getName()=Thread-3 id=202 state=RUNNABLE
  07-13 10:33:14.872 11237 11283 E Exception:: Error[java.lang.InternalError: Thread starting during runtime shutdown
  07-13 10:33:14.872 11237 11283 E Exception::    at java.lang.Thread.nativeCreate(Native Method)
  07-13 10:33:14.872 11237 11283 E Exception::    at java.lang.Thread.start(Thread.java:730)
  07-13 10:33:14.872 11237 11283 E Exception::    at com.huawei.mcs.ability.net.NetDetector.startPing(Unknown Source)
  07-13 10:33:14.872 11237 11283 E Exception::    at com.huawei.mcs.ability.net.NetDetector.netSnifferCallback(Unknown Source)
  07-13 10:33:14.872 11237 11283 E Exception::    at com.huawei.mcs.ability.net.NetSniffer.startSniffer(Unknown Source)
  07-13 10:33:14.872 11237 11283 E Exception::    at com.huawei.mcs.ability.net.NetSniffer.run(Unknown Source)
  07-13 10:33:14.872 11237 11283 E Exception:: ]
  

从错误log来看，linker检测到libFastKDCore.so有问题: 该库允许代码重定位．

排查对比

• Nexus 6p(Android 7.0)上仍然复现

so库分析

• 查看相应的so库

  $ readelf -a libFastKDCore.so|grep TEXTREL
    0x00000016 (TEXTREL)                    0x0
  

• Google对此描述

  • Android 6.0 change

  • 相关描述如下:

    On previous versions of Android, if your app requested the system to load a shared library with text relocations, the system displayed a warning but still allowed the library to be loaded. Beginning in this release, the system rejects this library if your app's target SDK version is 23 or higher. To help you detect if a library failed to load, your app should log the dlopen(3) failure, and include the problem description text that the dlerror(3) call returns. To learn more about handling text relocations, see this guide.

  • Android 6.0/7.0代码

    bool soinfo::link_image(const soinfo_list_t& global_group, const soinfo_list_t& local_group,
                        const android_dlextinfo* extinfo) {
    
    local_group_root_ = local_group.front();
    if (local_group_root_ == nullptr) {
      local_group_root_ = this;
    }
    
    if ((flags_ & FLAG_LINKER) == 0 && local_group_root_ == this) {
      target_sdk_version_ = get_application_target_sdk_version();
    }
    
    VersionTracker version_tracker;
    
    if (!version_tracker.init(this)) {
      return false;
    }
    
    #if !defined(__LP64__)
    if (has_text_relocations) {
      // Fail if app is targeting sdk version > 22
      if (get_application_target_sdk_version() > 22) {
        PRINT("%s: has text relocations", get_realpath());
        DL_ERR("%s: has text relocations", get_realpath());
        return false;
      }    
      // Make segments writable to allow text relocations to work properly. We will later call
      // phdr_table_protect_segments() after all of them are applied.
      DL_WARN("%s has text relocations. This is wasting memory and prevents "
            "security hardening. Please fix.", get_realpath());
      add_dlwarning(get_realpath(), "text relocations");
      if (phdr_table_unprotect_segments(phdr, phnum, load_bias) < 0) { 
        DL_ERR("can't unprotect loadable segments for \"%s\": %s",
             get_realpath(), strerror(errno));
        return false;
      }    
    }
    #endif
    ... ...
    

  • Android 5.1

    bool soinfo::LinkImage(const android_dlextinfo* extinfo) {
    
    #if !defined(__LP64__)
      if (has_text_relocations) {
      // Make segments writable to allow text relocations to work properly. We will later call
      // phdr_table_protect_segments() after all of them are applied and all constructors are run.
      DL_WARN("%s has text relocations. This is wasting memory and prevents "
            "security hardening. Please fix.", name);
      if (phdr_table_unprotect_segments(phdr, phnum, load_bias) < 0) {
        DL_ERR("can't unprotect loadable segments for \"%s\": %s",
             name, strerror(errno));
        return false;
      }
    }
    #endif
    

  • 总结来说，针对32bit App, 若使用的so库包含text relocation，

    • 在Android 5.1会报出警告，但仍允许执行。
    • 在Android 6.0及更高版本，会停止运行(增加runtime开销影响性能， 并引入安全问题)。

对比实验

• 基于NDK r4/r8b编译出的so库，都有此问题

  $ readelf -a libs/armeabi/libMyNdkBuild.so |grep TEXTREL
  0x00000016 (TEXTREL)                    0x0
  

• 基于NDK r5/r11c/r14b编译出的so库，没有此问题

  $ readelf -a libs/armeabi/libMyNdkBuild.so |grep TEXTREL
  

• 基于NDK r14b版本，编译不带-fpic的so
  • Android.mk

    LOCAL_CFLAGS += -v -fno-pic
    LOCAL_LDLIBS += -Wl,--no-warn-shared-textrel
    

  • 编译出的so库包含TEXTREL

    $ readelf -a ./app/src/main/libs/armeabi/libMyNdkBuild.so|grep TEXTREL
    0x00000016 (TEXTREL)                    0x0
    0x0000001e (FLAGS)                      SYMBOLIC TEXTREL BIND_NOW
    

  • 启动测试App, log如下

    --------- beginning of main
    07-19 14:43:30.056 10197 10197 E linker  : /data/app/com.timzhang.testjnindkbuild-1/lib/arm/libMyNdkBuild.so: has text relocations
    07-19 14:43:30.057 10197 10197 D AndroidRuntime: Shutting down VM
    --------- beginning of crash
    07-19 14:43:30.059 10197 10197 E AndroidRuntime: FATAL EXCEPTION: main
    07-19 14:43:30.059 10197 10197 E AndroidRuntime: Process: com.timzhang.testjnindkbuild, PID: 10197
    07-19 14:43:30.059 10197 10197 E AndroidRuntime: java.lang.UnsatisfiedLinkError: dlopen failed: /data/app/com.timzhang.testjnindkbuild-1/lib/arm/libMyNdkBuild.so: has text relocations
    07-19 14:43:30.059 10197 10197 E AndroidRuntime:    at java.lang.Runtime.loadLibrary0(Runtime.java:977)
    07-19 14:43:30.059 10197 10197 E AndroidRuntime:    at java.lang.System.loadLibrary(System.java:1530)
    07-19 14:43:30.059 10197 10197 E AndroidRuntime:    at com.timzhang.testjnindkbuild.MyNdk.<clinit>(MyNdk.java:5)
    07-19 14:43:30.059 10197 10197 E AndroidRuntime:    at com.timzhang.testjnindkbuild.MainActivity.onCreate(MainActivity.java:12)
    07-19 14:43:30.059 10197 10197 E AndroidRuntime:    at android.app.Activity.performCreate(Activity.java:6666)
    07-19 14:43:30.059 10197 10197 E AndroidRuntime:    at android.app.Instrumentation.callActivityOnCreate(Instrumentation.java:1118)
    07-19 14:43:30.059 10197 10197 E AndroidRuntime:    at android.app.ActivityThread.performLaunchActivity(ActivityThread.java:2619)
    07-19 14:43:30.059 10197 10197 E AndroidRuntime:    at android.app.ActivityThread.handleLaunchActivity(ActivityThread.java:2733)
    07-19 14:43:30.059 10197 10197 E AndroidRuntime:    at android.app.ActivityThread.-wrap12(ActivityThread.java)
    07-19 14:43:30.059 10197 10197 E AndroidRuntime:    at android.app.ActivityThread$H.handleMessage(ActivityThread.java:1480)
    07-19 14:43:30.059 10197 10197 E AndroidRuntime:    at android.os.Handler.dispatchMessage(Handler.java:102)
    07-19 14:43:30.059 10197 10197 E AndroidRuntime:    at android.os.Looper.loop(Looper.java:154)
    07-19 14:43:30.059 10197 10197 E AndroidRuntime:    at android.app.ActivityThread.main(ActivityThread.java:6153)
    07-19 14:43:30.059 10197 10197 E AndroidRuntime:    at java.lang.reflect.Method.invoke(Native Method)
    07-19 14:43:30.059 10197 10197 E AndroidRuntime:    at com.android.internal.os.ZygoteInit$MethodAndArgsCaller.run(ZygoteInit.java:865)
    07-19 14:43:30.059 10197 10197 E AndroidRuntime:    at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:755)
    07-19 14:43:30.061 10197 10197 D HprofFactory: Create HprofDebugEx
    

Root cause

• dlopen出现"has text relocations"的原因在于加载的so库需要重定位, Android 6.0及更高版本已明文禁止此种情形发生。

• 从多个NDK版本测试来看，so库包含text relocation跟编译so库的NDK版本相关，较新版本的NDK(如r14b)不存在此问题。

解决方案

• 由于是第三方App, 需要知会App厂商，基于最新的NDK版本重新编译so库(readelf查看不再含有TEXTREL)。