Bug 25900 - RISC-V: null pointer dereference in ld
Summary: RISC-V: null pointer dereference in ld
Status: RESOLVED FIXED
Alias: None
Product: binutils
Classification: Unclassified
Component: ld (show other bugs)
Version: 2.34
: P2 normal
Target Milestone: ---
Assignee: Alan Modra
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2020-04-30 15:46 UTC by fedora.dm0
Modified: 2020-05-07 16:20 UTC (History)
1 user (show)

See Also:
Host:
Target:
Build:
Last reconfirmed: 2020-05-01 00:00:00


Attachments
Fix null pointer dereference (494 bytes, application/mbox)
2020-04-30 15:46 UTC, fedora.dm0
Details
A better patch (741 bytes, patch)
2020-05-01 05:02 UTC, Alan Modra
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description fedora.dm0 2020-04-30 15:46:59 UTC
Created attachment 12496 [details]
Fix null pointer dereference

(Sorry for double-posting between this and the mailing list; I forgot I had a bugzilla account here.)

I tried to test the Linux RISC-V UEFI stub by cross-compiling this branch with binutils 2.34 and GCC 9.3.0:

    https://github.com/atishp04/linux/tree/uefi_riscv_pr

It results in a segfault in ld while linking vmlinux because the pointer h->root.u.def.section is NULL in one instance.  The attached patch fixes the segfault and results in a usable UEFI kernel, but I am not familiar with this code, so I don't know if it is the correct behavior.

Can someone verify this?  Let me know if you need configs etc.
Comment 1 Alan Modra 2020-05-01 04:51:29 UTC
Posting patches to binutils@sourceware.org is fine.  Your patch isn't quite correct though.  Or at least, it doesn't address the real underlying problem that u.def.section is being accessed *before* a type of bfd_link_hash_defined or bfd_link_hash_defweak is found.
Comment 2 Alan Modra 2020-05-01 05:02:19 UTC
Created attachment 12498 [details]
A better patch
Comment 3 Sourceware Commits 2020-05-01 06:03:36 UTC
The master branch has been updated by Alan Modra <amodra@sourceware.org>:

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=a2714d6cca1f1c7695f8dc84b49a4a51d1db86c8

commit a2714d6cca1f1c7695f8dc84b49a4a51d1db86c8
Author: Alan Modra <amodra@gmail.com>
Date:   Fri May 1 15:32:00 2020 +0930

    PR25900, RISC-V: null pointer dereference
    
            PR 25900
            * elfnn-riscv.c (_bfd_riscv_relax_section): Check root.type before
            accessing root.u.def of symbols.  Also check root.u.def.section
            is non-NULL.  Reverse tests so as to make the logic positive.
Comment 4 Jim Wilson 2020-05-07 16:20:09 UTC
I got a bug report pointing at this code once, I think from the RISC-V FreeBSD folks, but unfortunately didn't get a testcase or a good enough description of the failure to figure out what was wrong.  I suspect that it was the some problem.  They just worked around it by reverting the patch that added this code which was safe because this was a minor optimization.

Anyways, fixed now on mainline by Alan Modra so closing.