x86_64 / i686 no-PIE failures

x86_64 / i686 no-PIE failures

[Joseph Myers]

Now that the uchar.h failures with mainline GCC are fixed, other failures 
show up for x86_64 / i686 no-PIE with mainline GCC and binutils (I don't 
know how long these have been there):

/scratch/jmyers/glibc-bot/install/compilers/x86_64-linux-gnu/lib/gcc/x86_64-glibc-linux-gnu/13.0.0/../../../../x86_64-glibc-linux-gnu/bin/ld: /scratch/jmyers/glibc-bot/build/glibcs/x86_64-linux-gnu-no-pie/glibc/elf/ifuncmain1.o: non-canonical reference to canonical protected function `foo_protected' in /scratch/jmyers/glibc-bot/build/glibcs/x86_64-linux-gnu-no-pie/glibc/elf/ifuncmod1.so
/scratch/jmyers/glibc-bot/install/compilers/x86_64-linux-gnu/lib/gcc/x86_64-glibc-linux-gnu/13.0.0/../../../../x86_64-glibc-linux-gnu/bin/ld: failed to set dynamic section sizes: bad value
collect2: error: ld returned 1 exit status
../Rules:238: recipe for target '/scratch/jmyers/glibc-bot/build/glibcs/x86_64-linux-gnu-no-pie/glibc/elf/ifuncmain1' failed
make[3]: *** [/scratch/jmyers/glibc-bot/build/glibcs/x86_64-linux-gnu-no-pie/glibc/elf/ifuncmain1] Error 1
make[3]: Leaving directory '/scratch/jmyers/glibc-bot/src/glibc/elf'

-- 
Joseph S. Myers
joseph@codesourcery.com

Re: x86_64 / i686 no-PIE failures

[Florian Weimer]

* Joseph Myers:

> Now that the uchar.h failures with mainline GCC are fixed, other failures 
> show up for x86_64 / i686 no-PIE with mainline GCC and binutils (I don't 
> know how long these have been there):
>
> /scratch/jmyers/glibc-bot/install/compilers/x86_64-linux-gnu/lib/gcc/x86_64-glibc-linux-gnu/13.0.0/../../../../x86_64-glibc-linux-gnu/bin/ld: /scratch/jmyers/glibc-bot/build/glibcs/x86_64-linux-gnu-no-pie/glibc/elf/ifuncmain1.o: non-canonical reference to canonical protected function `foo_protected' in /scratch/jmyers/glibc-bot/build/glibcs/x86_64-linux-gnu-no-pie/glibc/elf/ifuncmod1.so
> /scratch/jmyers/glibc-bot/install/compilers/x86_64-linux-gnu/lib/gcc/x86_64-glibc-linux-gnu/13.0.0/../../../../x86_64-glibc-linux-gnu/bin/ld: failed to set dynamic section sizes: bad value
> collect2: error: ld returned 1 exit status
> ../Rules:238: recipe for target '/scratch/jmyers/glibc-bot/build/glibcs/x86_64-linux-gnu-no-pie/glibc/elf/ifuncmain1' failed
> make[3]: *** [/scratch/jmyers/glibc-bot/build/glibcs/x86_64-linux-gnu-no-pie/glibc/elf/ifuncmain1] Error 1
> make[3]: Leaving directory '/scratch/jmyers/glibc-bot/src/glibc/elf'

H.J.,

this test no longer seems valid with current binutils (or current
binutils is broken).

ifuncmain1.o has X86_64_32S and X86_64_PLT32 relocations for
foo_protected, so the main program must contain a PLT stub for
foo_protected.  Apparently, ld no longer produces such binaries.

What should we do about this?

Thanks,
Florian

Re: x86_64 / i686 no-PIE failures

[Szabolcs Nagy]

The 11/04/2022 08:12, Florian Weimer via Libc-alpha wrote:
> * Joseph Myers:
> 
> > Now that the uchar.h failures with mainline GCC are fixed, other failures 
> > show up for x86_64 / i686 no-PIE with mainline GCC and binutils (I don't 
> > know how long these have been there):
> >
> > /scratch/jmyers/glibc-bot/install/compilers/x86_64-linux-gnu/lib/gcc/x86_64-glibc-linux-gnu/13.0.0/../../../../x86_64-glibc-linux-gnu/bin/ld: /scratch/jmyers/glibc-bot/build/glibcs/x86_64-linux-gnu-no-pie/glibc/elf/ifuncmain1.o: non-canonical reference to canonical protected function `foo_protected' in /scratch/jmyers/glibc-bot/build/glibcs/x86_64-linux-gnu-no-pie/glibc/elf/ifuncmod1.so
> > /scratch/jmyers/glibc-bot/install/compilers/x86_64-linux-gnu/lib/gcc/x86_64-glibc-linux-gnu/13.0.0/../../../../x86_64-glibc-linux-gnu/bin/ld: failed to set dynamic section sizes: bad value
> > collect2: error: ld returned 1 exit status
> > ../Rules:238: recipe for target '/scratch/jmyers/glibc-bot/build/glibcs/x86_64-linux-gnu-no-pie/glibc/elf/ifuncmain1' failed
> > make[3]: *** [/scratch/jmyers/glibc-bot/build/glibcs/x86_64-linux-gnu-no-pie/glibc/elf/ifuncmain1] Error 1
> > make[3]: Leaving directory '/scratch/jmyers/glibc-bot/src/glibc/elf'
> 
> H.J.,
> 
> this test no longer seems valid with current binutils (or current
> binutils is broken).
> 
> ifuncmain1.o has X86_64_32S and X86_64_PLT32 relocations for
> foo_protected, so the main program must contain a PLT stub for
> foo_protected.  Apparently, ld no longer produces such binaries.
> 
> What should we do about this?

aarch64 has the same issue since

  binutils commit 90b7a5df152a64d2bea20beb438e8b81049a5c30
  aarch64: Disallow copy relocations on protected data

which should be in the binutils 2.39 release

ld.lld rejects such usage too, i think the plan was to not
support extern protected symbol refs with canonical address
moved to the main exe.

so the tests should be changed, but i'm not sure what's
the best approach (completely dropping protected or just
ensure the address is not taken in no-pie case).

Re: x86_64 / i686 no-PIE failures

[H.J. Lu]

On Fri, Nov 4, 2022 at 2:29 AM Szabolcs Nagy <szabolcs.nagy@arm.com> wrote:
>
> The 11/04/2022 08:12, Florian Weimer via Libc-alpha wrote:
> > * Joseph Myers:
> >
> > > Now that the uchar.h failures with mainline GCC are fixed, other failures
> > > show up for x86_64 / i686 no-PIE with mainline GCC and binutils (I don't
> > > know how long these have been there):
> > >
> > > /scratch/jmyers/glibc-bot/install/compilers/x86_64-linux-gnu/lib/gcc/x86_64-glibc-linux-gnu/13.0.0/../../../../x86_64-glibc-linux-gnu/bin/ld: /scratch/jmyers/glibc-bot/build/glibcs/x86_64-linux-gnu-no-pie/glibc/elf/ifuncmain1.o: non-canonical reference to canonical protected function `foo_protected' in /scratch/jmyers/glibc-bot/build/glibcs/x86_64-linux-gnu-no-pie/glibc/elf/ifuncmod1.so
> > > /scratch/jmyers/glibc-bot/install/compilers/x86_64-linux-gnu/lib/gcc/x86_64-glibc-linux-gnu/13.0.0/../../../../x86_64-glibc-linux-gnu/bin/ld: failed to set dynamic section sizes: bad value
> > > collect2: error: ld returned 1 exit status
> > > ../Rules:238: recipe for target '/scratch/jmyers/glibc-bot/build/glibcs/x86_64-linux-gnu-no-pie/glibc/elf/ifuncmain1' failed
> > > make[3]: *** [/scratch/jmyers/glibc-bot/build/glibcs/x86_64-linux-gnu-no-pie/glibc/elf/ifuncmain1] Error 1
> > > make[3]: Leaving directory '/scratch/jmyers/glibc-bot/src/glibc/elf'
> >
> > H.J.,
> >
> > this test no longer seems valid with current binutils (or current
> > binutils is broken).
> >
> > ifuncmain1.o has X86_64_32S and X86_64_PLT32 relocations for
> > foo_protected, so the main program must contain a PLT stub for
> > foo_protected.  Apparently, ld no longer produces such binaries.
> >
> > What should we do about this?
>
> aarch64 has the same issue since
>
>   binutils commit 90b7a5df152a64d2bea20beb438e8b81049a5c30
>   aarch64: Disallow copy relocations on protected data
>
> which should be in the binutils 2.39 release
>
> ld.lld rejects such usage too, i think the plan was to not
> support extern protected symbol refs with canonical address
> moved to the main exe.
>
> so the tests should be changed, but i'm not sure what's
> the best approach (completely dropping protected or just
> ensure the address is not taken in no-pie case).

Given the linker change, we should drop these tests for non-PIE.

-- 
H.J.

Re: x86_64 / i686 no-PIE failures

[Florian Weimer]

* H. J. Lu:

> On Fri, Nov 4, 2022 at 2:29 AM Szabolcs Nagy <szabolcs.nagy@arm.com> wrote:
>>
>> The 11/04/2022 08:12, Florian Weimer via Libc-alpha wrote:
>> > * Joseph Myers:
>> >
>> > > Now that the uchar.h failures with mainline GCC are fixed, other failures
>> > > show up for x86_64 / i686 no-PIE with mainline GCC and binutils (I don't
>> > > know how long these have been there):
>> > >
>> > > /scratch/jmyers/glibc-bot/install/compilers/x86_64-linux-gnu/lib/gcc/x86_64-glibc-linux-gnu/13.0.0/../../../../x86_64-glibc-linux-gnu/bin/ld: /scratch/jmyers/glibc-bot/build/glibcs/x86_64-linux-gnu-no-pie/glibc/elf/ifuncmain1.o: non-canonical reference to canonical protected function `foo_protected' in /scratch/jmyers/glibc-bot/build/glibcs/x86_64-linux-gnu-no-pie/glibc/elf/ifuncmod1.so
>> > > /scratch/jmyers/glibc-bot/install/compilers/x86_64-linux-gnu/lib/gcc/x86_64-glibc-linux-gnu/13.0.0/../../../../x86_64-glibc-linux-gnu/bin/ld: failed to set dynamic section sizes: bad value
>> > > collect2: error: ld returned 1 exit status
>> > > ../Rules:238: recipe for target '/scratch/jmyers/glibc-bot/build/glibcs/x86_64-linux-gnu-no-pie/glibc/elf/ifuncmain1' failed
>> > > make[3]: *** [/scratch/jmyers/glibc-bot/build/glibcs/x86_64-linux-gnu-no-pie/glibc/elf/ifuncmain1] Error 1
>> > > make[3]: Leaving directory '/scratch/jmyers/glibc-bot/src/glibc/elf'
>> >
>> > H.J.,
>> >
>> > this test no longer seems valid with current binutils (or current
>> > binutils is broken).
>> >
>> > ifuncmain1.o has X86_64_32S and X86_64_PLT32 relocations for
>> > foo_protected, so the main program must contain a PLT stub for
>> > foo_protected.  Apparently, ld no longer produces such binaries.
>> >
>> > What should we do about this?
>>
>> aarch64 has the same issue since
>>
>>   binutils commit 90b7a5df152a64d2bea20beb438e8b81049a5c30
>>   aarch64: Disallow copy relocations on protected data
>>
>> which should be in the binutils 2.39 release
>>
>> ld.lld rejects such usage too, i think the plan was to not
>> support extern protected symbol refs with canonical address
>> moved to the main exe.
>>
>> so the tests should be changed, but i'm not sure what's
>> the best approach (completely dropping protected or just
>> ensure the address is not taken in no-pie case).
>
> Given the linker change, we should drop these tests for non-PIE.

If we don't take the address of foo_protected, we'd only have an
X86_64_PLT32 relocation.  Would that be valid from a linker perspective?

Thanks,
Florian

Re: x86_64 / i686 no-PIE failures

[Fangrui Song]

On 2022-11-04, Florian Weimer wrote:
>* H. J. Lu:
>
>> On Fri, Nov 4, 2022 at 2:29 AM Szabolcs Nagy <szabolcs.nagy@arm.com> wrote:
>>>
>>> The 11/04/2022 08:12, Florian Weimer via Libc-alpha wrote:
>>> > * Joseph Myers:
>>> >
>>> > > Now that the uchar.h failures with mainline GCC are fixed, other failures
>>> > > show up for x86_64 / i686 no-PIE with mainline GCC and binutils (I don't
>>> > > know how long these have been there):
>>> > >
>>> > > /scratch/jmyers/glibc-bot/install/compilers/x86_64-linux-gnu/lib/gcc/x86_64-glibc-linux-gnu/13.0.0/../../../../x86_64-glibc-linux-gnu/bin/ld: /scratch/jmyers/glibc-bot/build/glibcs/x86_64-linux-gnu-no-pie/glibc/elf/ifuncmain1.o: non-canonical reference to canonical protected function `foo_protected' in /scratch/jmyers/glibc-bot/build/glibcs/x86_64-linux-gnu-no-pie/glibc/elf/ifuncmod1.so
>>> > > /scratch/jmyers/glibc-bot/install/compilers/x86_64-linux-gnu/lib/gcc/x86_64-glibc-linux-gnu/13.0.0/../../../../x86_64-glibc-linux-gnu/bin/ld: failed to set dynamic section sizes: bad value
>>> > > collect2: error: ld returned 1 exit status
>>> > > ../Rules:238: recipe for target '/scratch/jmyers/glibc-bot/build/glibcs/x86_64-linux-gnu-no-pie/glibc/elf/ifuncmain1' failed
>>> > > make[3]: *** [/scratch/jmyers/glibc-bot/build/glibcs/x86_64-linux-gnu-no-pie/glibc/elf/ifuncmain1] Error 1
>>> > > make[3]: Leaving directory '/scratch/jmyers/glibc-bot/src/glibc/elf'
>>> >
>>> > H.J.,
>>> >
>>> > this test no longer seems valid with current binutils (or current
>>> > binutils is broken).
>>> >
>>> > ifuncmain1.o has X86_64_32S and X86_64_PLT32 relocations for
>>> > foo_protected, so the main program must contain a PLT stub for
>>> > foo_protected.  Apparently, ld no longer produces such binaries.
>>> >
>>> > What should we do about this?
>>>
>>> aarch64 has the same issue since
>>>
>>>   binutils commit 90b7a5df152a64d2bea20beb438e8b81049a5c30
>>>   aarch64: Disallow copy relocations on protected data
>>>
>>> which should be in the binutils 2.39 release
>>>
>>> ld.lld rejects such usage too, i think the plan was to not
>>> support extern protected symbol refs with canonical address
>>> moved to the main exe.
>>>
>>> so the tests should be changed, but i'm not sure what's
>>> the best approach (completely dropping protected or just
>>> ensure the address is not taken in no-pie case).
>>
>> Given the linker change, we should drop these tests for non-PIE.

Agree.
https://sourceware.org/git/?p=glibc.git;a=commit;h=66a273d16a63d1ed74a8d14a210a04c6a0f5dd45
("elf: Disable ifuncmain{1,5,5pic,5pie} when using LLD")
disabled some tests about exe's direct references to protected DSO symbols.
binutils ports (aarch64 and x86) which have the strict behavior need to
disable the tests as well.

>If we don't take the address of foo_protected, we'd only have an
>X86_64_PLT32 relocation.  Would that be valid from a linker perspective?
>
>Thanks,
>Florian
>

R_X86_64_PLT32 is a PLT-generating relocation, not a direct reference.
It is compatible with a protected definition in a DSO.

See
https://maskray.me/blog/2021-01-09-copy-relocations-canonical-plt-entries-and-protected#protected-data-symbols-and-copy-relocations
for a very long write-up.

Re: x86_64 / i686 no-PIE failures

[Florian Weimer]

* Fangrui Song:

> On 2022-11-04, Florian Weimer wrote:
>>* H. J. Lu:
>>> Given the linker change, we should drop these tests for non-PIE.
>
> Agree.
> https://sourceware.org/git/?p=glibc.git;a=commit;h=66a273d16a63d1ed74a8d14a210a04c6a0f5dd45
> ("elf: Disable ifuncmain{1,5,5pic,5pie} when using LLD")
> disabled some tests about exe's direct references to protected DSO symbols.
> binutils ports (aarch64 and x86) which have the strict behavior need to
> disable the tests as well.
>
>>If we don't take the address of foo_protected, we'd only have an
>>X86_64_PLT32 relocation.  Would that be valid from a linker perspective?

> R_X86_64_PLT32 is a PLT-generating relocation, not a direct reference.
> It is compatible with a protected definition in a DSO.

Thanks, I'm testing a patch.

Florian