powerpc: Fix stack buffer overflow in _dl_reloc_overflwo (bug 34541)

  Consolidate the 32-bit and 64-bit implementation and use
_dl_exception_create_format to create an exception message of the
correct size.

---
 sysdeps/powerpc/Makefile               |  2 +-
 sysdeps/powerpc/dl-reloc_overflow.c    | 48 ++++++++++++++++++++++++++++++++++
 sysdeps/powerpc/powerpc32/dl-machine.c | 24 -----------------
 sysdeps/powerpc/powerpc64/dl-machine.c | 27 -------------------
 4 files changed, 49 insertions(+), 52 deletions(-)


base-commit: a0faa928b094be829c52d1e493442ba3b48954b1
  

Hi Florian,

On Wed, 19 Aug 2026 11:29:58 +0200
Florian Weimer <fweimer@redhat.com> wrote:

> Consolidate the 32-bit and 64-bit implementation and use
> _dl_exception_create_format to create an exception message of the
> correct size.

there is a typo in the title/subject - _dl_reloc_overflwo should be
_dl_reloc_overflow


		Dan

> 
> ---
>  sysdeps/powerpc/Makefile               |  2 +-
>  sysdeps/powerpc/dl-reloc_overflow.c    | 48 ++++++++++++++++++++++++++++++++++
>  sysdeps/powerpc/powerpc32/dl-machine.c | 24 -----------------
>  sysdeps/powerpc/powerpc64/dl-machine.c | 27 -------------------
>  4 files changed, 49 insertions(+), 52 deletions(-)
> 
> diff --git a/sysdeps/powerpc/Makefile b/sysdeps/powerpc/Makefile
> index 5cdb64f29b..f3b6d5d725 100644
> --- a/sysdeps/powerpc/Makefile
> +++ b/sysdeps/powerpc/Makefile
> @@ -4,7 +4,7 @@ endif
>  
>  ifeq ($(subdir),elf)
>  # extra shared linker files to link into dl-allobjs.so and libc
> -sysdep-dl-routines += dl-machine hwcapinfo
> +sysdep-dl-routines += dl-machine dl-reloc_overflow hwcapinfo
>  sysdep_routines += dl-machine hwcapinfo
>  # extra shared linker files to link only into dl-allobjs.so
>  sysdep-rtld-routines += dl-machine hwcapinfo
> diff --git a/sysdeps/powerpc/dl-reloc_overflow.c b/sysdeps/powerpc/dl-reloc_overflow.c
> new file mode 100644
> index 0000000000..a8ebc0f7a2
> --- /dev/null
> +++ b/sysdeps/powerpc/dl-reloc_overflow.c
> @@ -0,0 +1,48 @@
> +/* Relocation overflow reporting for POWER.
> +   Copyright (C) 1995-2026 Free Software Foundation, Inc.
> +   This file is part of the GNU C Library.
> +
> +   The GNU C Library is free software; you can redistribute it and/or
> +   modify it under the terms of the GNU Library General Public License as
> +   published by the Free Software Foundation; either version 2 of the
> +   License, or (at your option) any later version.
> +
> +   The GNU C Library is distributed in the hope that it will be useful,
> +   but WITHOUT ANY WARRANTY; without even the implied warranty of
> +   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
> +   Library General Public License for more details.
> +
> +   You should have received a copy of the GNU Library General Public
> +   License along with the GNU C Library; see the file COPYING.LIB.  If
> +   not, see <https://www.gnu.org/licenses/>.  */
> +
> +#include <ldsodefs.h>
> +#include <dl-machine.h>
> +
> +void
> +_dl_reloc_overflow (struct link_map *map,
> +                    const char *name,
> +                    Elf64_Addr *const reloc_addr,
> +                    const Elf64_Sym *refsym)
> +{
> +  struct dl_exception exc;
> +
> +  char address[sizeof (void *) * 2 + 1];
> +  memset (address, '0', sizeof (address) - 1);
> +  address[sizeof (address) - 1] = '\0';
> +  _itoa_word ((unsigned long int) reloc_addr,
> +              &address[sizeof (address) -1], 16, 0);
> +
> +  const char *strtab = (const void *) D_PTR (map, l_info[DT_STRTAB]);
> +  if (refsym != NULL)
> +    _dl_exception_create_format
> +      (&exc, map->l_name,
> +       "%s reloc at 0x%s for symbol '%s' out of range",
> +       name, address, strtab + refsym->st_name);
> +  else
> +    _dl_exception_create_format
> +      (&exc, map->l_name,
> +       "%s reloc at 0x%s out of range", name, address);
> +
> +  _dl_signal_exception (0, &exc, NULL);
> +}
> diff --git a/sysdeps/powerpc/powerpc32/dl-machine.c b/sysdeps/powerpc/powerpc32/dl-machine.c
> index ebdfc63a47..bc538b7f4c 100644
> --- a/sysdeps/powerpc/powerpc32/dl-machine.c
> +++ b/sysdeps/powerpc/powerpc32/dl-machine.c
> @@ -377,30 +377,6 @@ __elf_machine_fixup_plt (struct link_map *map,
>    return finaladdr;
>  }
>  
> -void
> -_dl_reloc_overflow (struct link_map *map,
> -		    const char *name,
> -		    Elf32_Addr *const reloc_addr,
> -		    const Elf32_Sym *refsym)
> -{
> -  char buffer[128];
> -  char *t;
> -  t = stpcpy (buffer, name);
> -  t = stpcpy (t, " relocation at 0x00000000");
> -  _itoa_word ((unsigned) reloc_addr, t, 16, 0);
> -  if (refsym)
> -    {
> -      const char *strtab;
> -
> -      strtab = (const void *) D_PTR (map, l_info[DT_STRTAB]);
> -      t = stpcpy (t, " for symbol `");
> -      t = stpcpy (t, strtab + refsym->st_name);
> -      t = stpcpy (t, "'");
> -    }
> -  t = stpcpy (t, " out of range");
> -  _dl_signal_error (0, map->l_name, NULL, buffer);
> -}
> -
>  void
>  __process_machine_rela (struct link_map *map,
>  			const Elf32_Rela *reloc,
> diff --git a/sysdeps/powerpc/powerpc64/dl-machine.c b/sysdeps/powerpc/powerpc64/dl-machine.c
> index 29fd15c8c7..37427b46b2 100644
> --- a/sysdeps/powerpc/powerpc64/dl-machine.c
> +++ b/sysdeps/powerpc/powerpc64/dl-machine.c
> @@ -22,33 +22,6 @@
>  #include <_itoa.h>
>  #include <dl-machine.h>
>  
> -void
> -_dl_reloc_overflow (struct link_map *map,
> -		    const char *name,
> -		    Elf64_Addr *const reloc_addr,
> -		    const Elf64_Sym *refsym)
> -{
> -  char buffer[1024];
> -  char *t;
> -  t = stpcpy (buffer, name);
> -  /* Notice that _itoa_word() writes characters from the higher address to the
> -     lower address, requiring the destination string to reserve all the
> -     required size before the call.  */
> -  t = stpcpy (t, " reloc at 0x0000000000000000");
> -  _itoa_word ((unsigned long) reloc_addr, t, 16, 0);
> -  if (refsym)
> -    {
> -      const char *strtab;
> -
> -      strtab = (const void *) D_PTR (map, l_info[DT_STRTAB]);
> -      t = stpcpy (t, " for symbol `");
> -      t = stpcpy (t, strtab + refsym->st_name);
> -      t = stpcpy (t, "'");
> -    }
> -  t = stpcpy (t, " out of range");
> -  _dl_signal_error (0, map->l_name, NULL, buffer);
> -}
> -
>  #if _CALL_ELF == 2
>  void
>  _dl_error_localentry (struct link_map *map, const Elf64_Sym *refsym)
> 
> base-commit: a0faa928b094be829c52d1e493442ba3b48954b1
>
  

* Dan Horák:

> Hi Florian,
>
> On Wed, 19 Aug 2026 11:29:58 +0200
> Florian Weimer <fweimer@redhat.com> wrote:
>
>> Consolidate the 32-bit and 64-bit implementation and use
>> _dl_exception_create_format to create an exception message of the
>> correct size.
>
> there is a typo in the title/subject - _dl_reloc_overflwo should be
> _dl_reloc_overflow

Thanks, fixed locally.

Florian
  

On 19/08/26 06:29, Florian Weimer wrote:
> Consolidate the 32-bit and 64-bit implementation and use
> _dl_exception_create_format to create an exception message of the
> correct size.

There are some build issues, along with some suggestions, a lingering issue
found while reviewing it, and a similar bug on a different function.

I have created a branch with all my suggestion incorporated [1].

[1] https://sourceware.org/git/?p=glibc.git;a=shortlog;h=refs/heads/azanella/bz34541-dl-reloc-overflow

> 
> ---
>  sysdeps/powerpc/Makefile               |  2 +-
>  sysdeps/powerpc/dl-reloc_overflow.c    | 48 ++++++++++++++++++++++++++++++++++
>  sysdeps/powerpc/powerpc32/dl-machine.c | 24 -----------------
>  sysdeps/powerpc/powerpc64/dl-machine.c | 27 -------------------
>  4 files changed, 49 insertions(+), 52 deletions(-)
> 
> diff --git a/sysdeps/powerpc/Makefile b/sysdeps/powerpc/Makefile
> index 5cdb64f29b..f3b6d5d725 100644
> --- a/sysdeps/powerpc/Makefile
> +++ b/sysdeps/powerpc/Makefile
> @@ -4,7 +4,7 @@ endif
>  
>  ifeq ($(subdir),elf)
>  # extra shared linker files to link into dl-allobjs.so and libc
> -sysdep-dl-routines += dl-machine hwcapinfo
> +sysdep-dl-routines += dl-machine dl-reloc_overflow hwcapinfo
>  sysdep_routines += dl-machine hwcapinfo
>  # extra shared linker files to link only into dl-allobjs.so
>  sysdep-rtld-routines += dl-machine hwcapinfo

I think you can add testcase for this (we need the mod-reloc-overflow.S
so we store an address into a field narrower than a pointer):

$ cat << EOF > provider.c
int reloc_overflow_symbol_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx = 42;
EOF
$ cat << EOF > mod-reloc-overflow.S
        .data
        .globl  refword
        .type   refword, @object
refword:
        .short  reloc_overflow_symbol_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
        .size   refword, 2
EOF
$ cat << EOF > tst-reloc-overflow.c
#include <stdio.h>
#include <stdlib.h>
#include <dlfcn.h>
#include <assert.h>

int
main (int argc, char **argv)
{
  const char *mod = argc > 1 ? argv[1] : "./mod-reloc-overflow.so";

  void *h = dlopen (mod, RTLD_NOW);
  assert (h != NULL);

  const char *e = dlerror ();
  printf ("dlerror: %s\n", e != NULL ? e : "(null)");
  printf ("PASS: relocation overflow reported without crashing\n");
  return 0;
}
EOF

$ powerpc-linux-gnu-gcc -shared -fPIC provider.c -o libprovider.so
$ powerpc-linux-gnu-gcc -c mod-reloc-overflow.S -o mod-reloc-overflow.o
$ powerpc-linux-gnu-gcc -shared mod-reloc-overflow.o -o mod-reloc-overflow.so -L. -lprovider '-Wl,-rpath,$ORIGIN'
$ powerpc-linux-gnu-gcc /home/azanella/Projects/glibc/poc-bz34541/tst-reloc-overflow.c -o tst-reloc-overflow -ldl

$ elf/ld.so --library-path /home/azanella/Projects/glibc/build/powerpc-linux-gnu ./tst-reloc-overflow
qemu: uncaught target signal 11 (Segmentation fault) - core dumped

It works for powerpc64 and powerpc64le as well, but I think we will need a
larger symbol overflow to *always* trigger an stack overflow.

> diff --git a/sysdeps/powerpc/dl-reloc_overflow.c b/sysdeps/powerpc/dl-reloc_overflow.c
> new file mode 100644
> index 0000000000..a8ebc0f7a2
> --- /dev/null
> +++ b/sysdeps/powerpc/dl-reloc_overflow.c
> @@ -0,0 +1,48 @@
> +/* Relocation overflow reporting for POWER.
> +   Copyright (C) 1995-2026 Free Software Foundation, Inc.
> +   This file is part of the GNU C Library.
> +
> +   The GNU C Library is free software; you can redistribute it and/or
> +   modify it under the terms of the GNU Library General Public License as
> +   published by the Free Software Foundation; either version 2 of the
> +   License, or (at your option) any later version.
> +
> +   The GNU C Library is distributed in the hope that it will be useful,
> +   but WITHOUT ANY WARRANTY; without even the implied warranty of
> +   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
> +   Library General Public License for more details.
> +
> +   You should have received a copy of the GNU Library General Public
> +   License along with the GNU C Library; see the file COPYING.LIB.  If
> +   not, see <https://www.gnu.org/licenses/>.  */
> +
> +#include <ldsodefs.h>
> +#include <dl-machine.h>
> +
> +void
> +_dl_reloc_overflow (struct link_map *map,
> +                    const char *name,
> +                    Elf64_Addr *const reloc_addr,
> +                    const Elf64_Sym *refsym)

You need to make it wordsize agnostic by using ElfW on the types.

> +{
> +  struct dl_exception exc;
> +
> +  char address[sizeof (void *) * 2 + 1];
> +  memset (address, '0', sizeof (address) - 1);
> +  address[sizeof (address) - 1] = '\0';
> +  _itoa_word ((unsigned long int) reloc_addr,
> +              &address[sizeof (address) -1], 16, 0);
> +
> +  const char *strtab = (const void *) D_PTR (map, l_info[DT_STRTAB]);
> +  if (refsym != NULL)
> +    _dl_exception_create_format
> +      (&exc, map->l_name,
> +       "%s reloc at 0x%s for symbol '%s' out of range",
> +       name, address, strtab + refsym->st_name);

There is no need to use _itoa_word/memset, just use "%lx":

   if (refsym != NULL)
    {
      const char *strtab = (const void *) D_PTR (map, l_info[DT_STRTAB]);
      _dl_exception_create_format
        (&exc, map->l_name, "%s reloc at 0x%lx for symbol `%s' out of range",
         name, (unsigned long int) reloc_addr, strtab + refsym->st_name);
    }
   else
    _dl_exception_create_format
      (&exc, map->l_name, "%s reloc at 0x%lx out of range",
       name, (unsigned long int) reloc_addr);

But this does not really work because we have another latent issue with
_dl_exception_create_format where it does not consume all the inputs
during the first va_start/va_end iteration, resulting in a wrong
size for '%s' inputs:

diff --git a/elf/dl-exception.c b/elf/dl-exception.c
index 392c7b4b2d..aac73ec435 100644
--- a/elf/dl-exception.c
+++ b/elf/dl-exception.c
@@ -130,12 +131,14 @@ _dl_exception_create_format (struct dl_exception *exception, const char *objname
            case 'z':
              if (p[1] == 'x')
                {
+                 va_arg (ap, unsigned long int);
                  length += LONG_WIDTH / 4;
                  ++p;
                  break;
                }
              [[fallthrough]];
            case 'x':
+             va_arg (ap, unsigned int);
              length += INT_WIDTH / 4;
              break;
             default:
diff --git a/elf/tst-create_format1.c b/elf/tst-create_format1.c
index 3190c7b579..14ce8ea5a5 100644
--- a/elf/tst-create_format1.c
+++ b/elf/tst-create_format1.c
@@ -90,6 +90,11 @@ do_test (void)
   TEST_LONG ("fffffffe",      "test", "%zx",      (size_t)~1ul);
   TEST_LONG ("fffffffe-test", "test", "%zx-test", (size_t)~1ul);

+  TEST ("0000007b-test",       NULL, "%x-%s",       123, "test");
+  TEST ("0000007b-test-000001c8", NULL, "%x-%s-%x", 123, "test", 456);
+  TEST_LONG ("fffffffd-test",  NULL, "%lx-%s",      (long int)~2ul, "test");
+  TEST_LONG ("fffffffe-test",  NULL, "%zx-%s",      (size_t)~1ul, "test");
+
   struct support_capture_subprocess result;
   result = support_capture_subprocess (do_test_invalid_conversion, NULL);
   support_capture_subprocess_check (&result, "dl-exception",


> +  else
> +    _dl_exception_create_format
> +      (&exc, map->l_name,
> +       "%s reloc at 0x%s out of range", name, address);
> +
> +  _dl_signal_exception (0, &exc, NULL);
> +}
> diff --git a/sysdeps/powerpc/powerpc32/dl-machine.c b/sysdeps/powerpc/powerpc32/dl-machine.c
> index ebdfc63a47..bc538b7f4c 100644
> --- a/sysdeps/powerpc/powerpc32/dl-machine.c
> +++ b/sysdeps/powerpc/powerpc32/dl-machine.c
> @@ -377,30 +377,6 @@ __elf_machine_fixup_plt (struct link_map *map,
>    return finaladdr;
>  }
>  

You can remove the '#include <_itoa.h>', same for the powerpc64 version.

> -void
> -_dl_reloc_overflow (struct link_map *map,
> -		    const char *name,
> -		    Elf32_Addr *const reloc_addr,
> -		    const Elf32_Sym *refsym)
> -{
> -  char buffer[128];
> -  char *t;
> -  t = stpcpy (buffer, name);
> -  t = stpcpy (t, " relocation at 0x00000000");
> -  _itoa_word ((unsigned) reloc_addr, t, 16, 0);
> -  if (refsym)
> -    {
> -      const char *strtab;
> -
> -      strtab = (const void *) D_PTR (map, l_info[DT_STRTAB]);
> -      t = stpcpy (t, " for symbol `");
> -      t = stpcpy (t, strtab + refsym->st_name);
> -      t = stpcpy (t, "'");
> -    }
> -  t = stpcpy (t, " out of range");
> -  _dl_signal_error (0, map->l_name, NULL, buffer);
> -}
> -
>  void
>  __process_machine_rela (struct link_map *map,
>  			const Elf32_Rela *reloc,

It fails to build on powerpc32:

powerpc-glibc-linux-gnu-gcc ../sysdeps/powerpc/powerpc32/dl-machine.c [...]
[...]
../sysdeps/powerpc/powerpc32/dl-machine.c: In function ‘__process_machine_rela’:
../sysdeps/powerpc/powerpc32/dl-machine.c:418:9: error: implicit declaration of function ‘_dl_reloc_overflow’ [-Wimplicit-function-declaration]
  418 |         _dl_reloc_overflow (map,  "R_PPC_ADDR24", reloc_addr, refsym);
      |         ^~~~~~~~~~~~~~~~~~

You need to move it outside of RESOLVE_MAP.  I think adding a powerpc
generic dl-machine.h would result in a much more complex code.


> diff --git a/sysdeps/powerpc/powerpc64/dl-machine.c b/sysdeps/powerpc/powerpc64/dl-machine.c
> index 29fd15c8c7..37427b46b2 100644
> --- a/sysdeps/powerpc/powerpc64/dl-machine.c
> +++ b/sysdeps/powerpc/powerpc64/dl-machine.c
> @@ -22,33 +22,6 @@
>  #include <_itoa.h>
>  #include <dl-machine.h>
>  
> -void
> -_dl_reloc_overflow (struct link_map *map,
> -		    const char *name,
> -		    Elf64_Addr *const reloc_addr,
> -		    const Elf64_Sym *refsym)
> -{
> -  char buffer[1024];
> -  char *t;
> -  t = stpcpy (buffer, name);
> -  /* Notice that _itoa_word() writes characters from the higher address to the
> -     lower address, requiring the destination string to reserve all the
> -     required size before the call.  */
> -  t = stpcpy (t, " reloc at 0x0000000000000000");
> -  _itoa_word ((unsigned long) reloc_addr, t, 16, 0);
> -  if (refsym)
> -    {
> -      const char *strtab;
> -
> -      strtab = (const void *) D_PTR (map, l_info[DT_STRTAB]);
> -      t = stpcpy (t, " for symbol `");
> -      t = stpcpy (t, strtab + refsym->st_name);
> -      t = stpcpy (t, "'");
> -    }
> -  t = stpcpy (t, " out of range");
> -  _dl_signal_error (0, map->l_name, NULL, buffer);
> -}
> -
>  #if _CALL_ELF == 2
>  void
>  _dl_error_localentry (struct link_map *map, const Elf64_Sym *refsym)

This function has the same issue, maybe it would be good to fix it as well:

void
_dl_error_localentry (struct link_map *map, const Elf64_Sym *refsym)
{
  const char *strtab = (const void *) D_PTR (map, l_info[DT_STRTAB]);

  struct dl_exception exc;
  _dl_exception_create_format (&exc, map->l_name, "expected localentry:0 `%s'",
                               strtab + refsym->st_name);
  _dl_signal_exception (0, &exc, NULL);
}

> 
> base-commit: a0faa928b094be829c52d1e493442ba3b48954b1