https://sourceware.org/bugzilla/show_bug.cgi?id=34999
Bug ID: 34999
Summary: elf_link_convert_common_type() in ld aborts when an
input object contains a symbol with STB_WEAK binding
and st_shndx = SHN_COMMON. gas rejects this
combination; ld does not.
Product: binutils
Version: 2.48 (HEAD)
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: ld
Assignee: unassigned at sourceware dot org
Reporter: emily.west286 at gmail dot com
Target Milestone: ---
Created attachment 17277
--> https://sourceware.org/bugzilla/attachment.cgi?id=17277&action=edit
test case id003358 -- original finding
Binutils ld: internal abort in elf_link_convert_common_type on weak common
symbol
Component: ld
Version: binutils-gdb master, found on commit
c79376a262328164cdf81eddfcc5518314b1856a
Target: x86_64-pc-linux-gnu
Summary:
ld aborts when an input object contains a symbol with STB_WEAK binding and
st_shndx = SHN_COMMON.
ld-new: BFD (GNU Binutils) ... internal error, aborting at elflink.c:10744 in
elf_link_convert_common_type
ld-new: Please report this bug.
Reproducers:
id003358 (attached): ld -o /tmp/out id003358
weak-common.o (attached): minimal reproducer targeting the finding's root
cause.
Backtrace for id003358:
#0 _bfd_abort bfd/bfd.c:2315
#1 elf_link_convert_common_type bfd/elflink.c:10744
#2 elf_link_output_extsym bfd/elflink.c:11014
#3 bfd_hash_traverse bfd/hash.c:814
#4 _bfd_elf_final_link bfd/elflink.c:13440
#5 ldwrite ld/ldwrite.c:548
#6 main ld/ldmain.c:1001
Root cause:
elf_link_convert_common_type aborts in non-relocatable links:
c
if (!bfd_link_relocatable (info))
abort ();
For a weak common symbol:
The hash entry is created as bfd_link_hash_defweak with section COM.
lang_common allocates only bfd_link_hash_common entries, so the symbol is not
allocated.
In elf_link_output_extsym, the defweak branch derives sym.st_shndx = SHN_COMMON
from COM. bed->common_definition (&sym) returns true and
elf_link_convert_common_type is called in a final link.
c
case bfd_link_hash_defined:
case bfd_link_hash_defweak:
if (bed->common_definition (&sym))
type = elf_link_convert_common_type (flinfo->info, type);
gdb, id003358:
h->root.root.string = “_start”, h->root.type = bfd_link_hash_defweak
h->root.u.def.section->name = “COM”, flags = 0x1000 (SEC_IS_COMMON)
type = 1 (STT_OBJECT)
Impact:
Low -- requires a crafted object file. No memory errors reported by ASan.
Suggested fix:
Reject weak common symbols in elf_link_add_object_symbols, consistent with gas:
c
bind = ELF_ST_BIND (isym->st_info);
if (common && bind == STB_WEAK)
{
_bfd_error_handler (_("%pB: common symbol at index %lu"
" cannot be weak"),
abfd, (long) (isym - isymbuf + extsymoff));
bfd_set_error (bfd_error_bad_value);
goto error_free_vers;
}
common is bed->common_definition (isym), so this covers SHN_COMMON and
SHN_X86_64_LCOMMON.
Fix verification:
patch.dockerfile builds ld at the same commit with weak-common.patch applied.
Both inputs fail cleanly with an error instead of aborting.
docker build -f patch.dockerfile -t ld-fix-d .
docker run --rm -v "$PWD":/work ld-fix-d id003358
docker run --rm -v "$PWD":/work ld-fix-d weak-common.o
/src/build/ld/ld-new: split-inputs/id003358/id:003358: common symbol at index 1
cannot be weak
/src/build/ld/ld-new: split-inputs/id003358/id:003358: error adding symbols:
bad value
/src/build/ld/ld-new: D/weak-common.o: common symbol at index 1 cannot be weak
/src/build/ld/ld-new: D/weak-common.o: error adding symbols: bad value
Attachments:
id003358 orginal finding
weak-common.o minimal reproducer
weak-common.patch suggested fix
patch.dockerfile builds ld with the patch applied
--
You are receiving this mail because:
You are on the CC list for the bug.
