LoongArch: fix .got.plt dislocation in static PDE
Checks
| Context |
Check |
Description |
| linaro-tcwg-bot/tcwg_binutils_build--master-arm |
success
|
Build passed
|
| linaro-tcwg-bot/tcwg_binutils_build--master-aarch64 |
success
|
Build passed
|
| linaro-tcwg-bot/tcwg_binutils_check--master-arm |
success
|
Test passed
|
| linaro-tcwg-bot/tcwg_binutils_check--master-aarch64 |
success
|
Test passed
|
Commit Message
The code path handling R_LARCH_GOT{64*,{,_PC}_LO12} miscalculated the
address of the .got.plt entry: it always counted the two .got.plt
entries reserved for ld.so, but in static PDE those two entries do not
exist (as in static PDE the PLT is solely for ifunc). Thus all
.got.plt entries dislocated for two slots.
Those affected relocations are practically always used together with
the R_LARCH_GOT_{PC_,}HI20 relocation. In 2.46 and earlier releases,
R_LARCH_GOT_{PC_,}HI20 set pointer_equality_needed, which caused the
R_LARCH_GOT_* relocs resolved to a .got entry (targeting the PLT stub)
instead of .got.plt in static PDE, thus the error was latent. But in
the 2.47 release R_LARCH_GOT_{PC_,}HI20 no longer sets
pointer_equality_needed so the error became exploitable.
Fix the issue by factoring out the correct .got.plt entry addressing
logic handling R_LARCH_GOT_{PC_,}HI20 into a subroutine and replace the
incorrect logic for R_LARCH_GOT{64*,{,_PC}_LO12} with a call to the
subroutine.
Signed-off-by: Xi Ruoyao <xry111@xry111.site>
---
bfd/elfnn-loongarch.c | 46 ++++++-------------
ld/testsuite/ld-loongarch-elf/ifunc.exp | 8 ++++
ld/testsuite/ld-loongarch-elf/static-ifunc.c | 27 +++++++++++
.../ld-loongarch-elf/static-ifunc.out | 1 +
4 files changed, 51 insertions(+), 31 deletions(-)
create mode 100644 ld/testsuite/ld-loongarch-elf/static-ifunc.c
create mode 100644 ld/testsuite/ld-loongarch-elf/static-ifunc.out
@@ -3513,6 +3513,19 @@ loongarch_resolve_pcrel_lo_relocs (loongarch_pcrel_relocs *p)
return true;
}
+static bfd_vma
+ifunc_got_off (struct elf_link_hash_table *htab,
+ struct elf_link_hash_entry *h)
+{
+ bfd_vma idx =
+ (h->plt.offset - (htab->splt ? PLT_HEADER_SIZE : 0)) / PLT_ENTRY_SIZE;
+
+ return sec_addr (htab->sgotplt)
+ + (htab->splt ? GOTPLT_HEADER_SIZE : 0)
+ + (idx * GOT_ENTRY_SIZE)
+ - sec_addr (htab->sgot);
+}
+
static int
loongarch_elf_relocate_section (struct bfd_link_info *info,
bfd *input_bfd, asection *input_section,
@@ -4539,25 +4552,7 @@ loongarch_elf_relocate_section (struct bfd_link_info *info,
/* Hidden symbol not has got entry,
* only got.plt entry so it is (plt - got). */
if (h->got.offset == MINUS_ONE && h->type == STT_GNU_IFUNC)
- {
- bfd_vma idx;
- if (htab->elf.splt != NULL)
- {
- idx = (h->plt.offset - PLT_HEADER_SIZE)
- / PLT_ENTRY_SIZE;
- got_off = sec_addr (htab->elf.sgotplt)
- + GOTPLT_HEADER_SIZE
- + (idx * GOT_ENTRY_SIZE)
- - sec_addr (htab->elf.sgot);
- }
- else
- {
- idx = h->plt.offset / PLT_ENTRY_SIZE;
- got_off = sec_addr (htab->elf.sgotplt)
- + (idx * GOT_ENTRY_SIZE)
- - sec_addr (htab->elf.sgot);
- }
- }
+ got_off = ifunc_got_off (&htab->elf, h);
if ((h->got.offset & 1) == 0)
{
@@ -4638,18 +4633,7 @@ loongarch_elf_relocate_section (struct bfd_link_info *info,
got_off = local_got_offsets[r_symndx] & (~(bfd_vma)1);
if (h && h->got.offset == MINUS_ONE && h->type == STT_GNU_IFUNC)
- {
- bfd_vma idx;
- if (htab->elf.splt != NULL)
- idx = (h->plt.offset - PLT_HEADER_SIZE) / PLT_ENTRY_SIZE;
- else
- idx = h->plt.offset / PLT_ENTRY_SIZE;
-
- got_off = sec_addr (htab->elf.sgotplt)
- + GOTPLT_HEADER_SIZE
- + (idx * GOT_ENTRY_SIZE)
- - sec_addr (htab->elf.sgot);
- }
+ got_off = ifunc_got_off (&htab->elf, h);
relocation = got_off + sec_addr (got);
}
@@ -30,5 +30,13 @@ if [istarget loongarch*-*-*] {
"attr-ifunc-4" \
"attr-ifunc-4.out" \
] \
+ [list \
+ "Run static-ifunc" \
+ "-static" \
+ "" \
+ {static-ifunc.c} \
+ "static-ifunc" \
+ "static-ifunc.out" \
+ ] \
]
}
new file mode 100644
@@ -0,0 +1,27 @@
+int
+f1 ()
+{
+ return 42;
+}
+int
+f2 ()
+{
+ return 47;
+}
+
+void *
+fx ()
+{
+ return f1;
+}
+
+[[gnu::ifunc ("fx")]] int f ();
+
+int
+main ()
+{
+ int (*p) () = f;
+ asm ("# prevent optimization" : "+r"(p));
+ __builtin_printf ("%d\n", p ());
+ return 0;
+}
new file mode 100644
@@ -0,0 +1 @@
+42