PR29355, ld segfaults with -r/-q and custom-named section .rela*

PR29355, ld segfaults with -r/-q and custom-named section .rela*

[Alan Modra]

The bug testcase uses an output section named .rel or .rela which has
input .data sections mapped to it.  The input .data section has
relocations.  When counting output relocations SHT_REL and SHT_RELA
section reloc_count is ignored, with the justification that reloc
sections themselves can't have relocations and some backends use
reloc_count in reloc sections.  However, the test wrongly used the
output section type (which normally would match input section type).
Fix that.  Note that it is arguably wrong for ld to leave the output
.rel/.rela section type as SHT_REL/SHT_RELA when non-empty non-reloc
sections are written to it, but I'm not going to change that since it
might be useful to hand-craft relocs in a data section that is then
written to a SHT_REL/SHT_RELA output section.

	PR 29355
	* elflink.c (bfd_elf_final_link): Use input section type rather
	than output section type to determine whether to exclude using
	reloc_count from that section.

diff --git a/bfd/elflink.c b/bfd/elflink.c
index dcafac32800..2b1450fa4e1 100644
--- a/bfd/elflink.c
+++ b/bfd/elflink.c
@@ -12413,8 +12413,10 @@ bfd_elf_final_link (bfd *abfd, struct bfd_link_info *info)
 		      && elf_symtab_shndx_list (sec->owner) != NULL)
 		    max_sym_shndx_count = sym_count;
 
-		  if (esdo->this_hdr.sh_type == SHT_REL
-		      || esdo->this_hdr.sh_type == SHT_RELA)
+		  esdi = elf_section_data (sec);
+
+		  if (esdi->this_hdr.sh_type == SHT_REL
+		      || esdi->this_hdr.sh_type == SHT_RELA)
 		    /* Some backends use reloc_count in relocation sections
 		       to count particular types of relocs.  Of course,
 		       reloc sections themselves can't have relocations.  */
@@ -12432,8 +12434,6 @@ bfd_elf_final_link (bfd *abfd, struct bfd_link_info *info)
 		  else if (bed->elf_backend_count_relocs)
 		    reloc_count = (*bed->elf_backend_count_relocs) (info, sec);
 
-		  esdi = elf_section_data (sec);
-
 		  if ((sec->flags & SEC_RELOC) != 0)
 		    {
 		      size_t ext_size = 0;

-- 
Alan Modra
Australia Development Lab, IBM

Re: PR29355, ld segfaults with -r/-q and custom-named section .rela*

[Michael Matz]

Hey,

On Tue, 12 Jul 2022, Alan Modra via Binutils wrote:

> Fix that.  Note that it is arguably wrong for ld to leave the output
> .rel/.rela section type as SHT_REL/SHT_RELA when non-empty non-reloc
> sections are written to it, but I'm not going to change that since it
> might be useful to hand-craft relocs in a data section that is then
> written to a SHT_REL/SHT_RELA output section.

Much to my dismay I remember having seen exactly this in the wild, in 
recent years, but I don't remember the details anymore :-/


Ciao,
Michael.