Re: [PATCH 2/2] LoongArch: Fix R_LARCH_IRELATIVE insertion after elf_link_sort_relocs

[liuzhensong <liuzhensong@loongson.cn>]

在 2022/9/13 下午11:44, Xi Ruoyao 写道:
> loongarch_elf_finish_dynamic_symbol is called after elf_link_sort_relocs
> if -z combreloc.  elf_link_sort_relocs redistributes the contents of
> .rela.* sections those would be merged into .rela.dyn, so the slot for
> R_LARCH_IRELATIVE may be out of relplt->contents now.

It May be unnecessary find the slot in section of .rela.dyn.

The slot of R_LARCH_IRELATIVE is within the scope relplt->contents (the 
space

is calculated in function local_allocate_ifunc_dyn_relocs).

We can find the slot just in relplt->contents(Only for dynamic ifunc. I 
did not test for static ifunc.).

>
> To make things worse, the boundary check
>
>      dyn < dyn + relplt->size / sizeof (*dyn)
>
> is obviously wrong ("x + 10 < x"? :), causing the issue undetected
> during the linking process and the resulted executable suddenly crashes
> at runtime.
>
> The issue was found during an attempt to add static-pie support to the
> toolchain.
>
> Fix it by iterating through the inputs of .rela.dyn to find the slot.
> ---
>   bfd/elfnn-loongarch.c | 41 ++++++++++++++++++++++++-----------------
>   1 file changed, 24 insertions(+), 17 deletions(-)
>
> diff --git a/bfd/elfnn-loongarch.c b/bfd/elfnn-loongarch.c
> index 4b408b1db72..1de9dbfecfa 100644
> --- a/bfd/elfnn-loongarch.c
> +++ b/bfd/elfnn-loongarch.c
> @@ -3511,6 +3511,12 @@ loongarch_elf_finish_dynamic_symbol (bfd *output_bfd,
>   {
>     struct loongarch_elf_link_hash_table *htab = loongarch_elf_hash_table (info);
>     const struct elf_backend_data *bed = get_elf_backend_data (output_bfd);
> +  asection *rela_dyn = bfd_get_section_by_name (output_bfd, ".rela.dyn");
> +  struct bfd_link_order *lo = NULL;
> +  Elf_Internal_Rela *slot = NULL, *last_slot = NULL;
> +
> +  if (rela_dyn)
> +    lo = rela_dyn->map_head.link_order;
>   
>     if (h->plt.offset != MINUS_ONE)
>       {
> @@ -3520,6 +3526,7 @@ loongarch_elf_finish_dynamic_symbol (bfd *output_bfd,
>         uint32_t plt_entry[PLT_ENTRY_INSNS];
>         bfd_byte *loc;
>         Elf_Internal_Rela rela;
> +      asection *rela_sec = NULL;
>   
>         if (htab->elf.splt)
>   	{
> @@ -3572,31 +3579,31 @@ loongarch_elf_finish_dynamic_symbol (bfd *output_bfd,
>   	  && (relplt == htab->elf.srelgot
>   	      || relplt == htab->elf.irelplt))
>   	{
> -	    {
> -	      rela.r_info = ELFNN_R_INFO (0, R_LARCH_IRELATIVE);
> -	      rela.r_addend = (h->root.u.def.value
> +	  rela.r_info = ELFNN_R_INFO (0, R_LARCH_IRELATIVE);
> +	  rela.r_addend = (h->root.u.def.value
>   			       + h->root.u.def.section->output_section->vma
>   			       + h->root.u.def.section->output_offset);
> -	    }
>   
> -	    /* Find the space after dyn sort.  */
> +	  /* Find the space after dyn sort.  */
> +	  while (slot == last_slot || slot->r_offset != 0)
>   	    {
> -	      Elf_Internal_Rela *dyn = (Elf_Internal_Rela *)relplt->contents;
> -	      bool fill = false;
> -	      for (;dyn < dyn + relplt->size / sizeof (*dyn); dyn++)
My mistake.
> +	      if (slot != last_slot)
>   		{
> -		  if (0 == dyn->r_offset)
> -		    {
> -		      bed->s->swap_reloca_out (output_bfd, &rela,
> -					       (bfd_byte *)dyn);
> -		      relplt->reloc_count++;
> -		      fill = true;
> -		      break;
> -		    }
> +		  slot++;
> +		  continue;
>   		}
> -	      BFD_ASSERT (fill);
> +
> +	      BFD_ASSERT (lo != NULL);
> +	      rela_sec = lo->u.indirect.section;
> +	      lo = lo->next;
> +
> +	      slot = (Elf_Internal_Rela *)rela_sec->contents;
> +	      last_slot = (Elf_Internal_Rela *)(rela_sec->contents +
> +						rela_sec->size);
>   	    }
>   
> +	  bed->s->swap_reloca_out (output_bfd, &rela, (bfd_byte *)slot);
> +	  rela_sec->reloc_count++;
>   	}
>         else
>   	{