Created attachment 7328 [details]
simple proposed fix

Hi,

I don't have a non-gigantic test case but it's possible for the offset into the GOT used when accessing a __thread variable to be different from that written into the relocation (modulo confusions with terminology :).

This is the code that determines the offset to patch into the code (elfnn-aarch64.c line 3845):

                   value = (symbol_got_offset (input_bfd, h, r_symndx)
                            + globals->root.sgot->output_section->vma
                            + globals->root.sgot->output_section->output_offset);

and this is the code that determines the offset as written into the relocation (elfnn-aarch64.c line 4248):

                           off = symbol_got_offset (input_bfd, h, r_symndx);
                           ...
                               rela.r_offset = globals->root.sgot->output_section->vma +
                                 globals->root.sgot->output_offset + off;

The former is "root.sgot->output_section->output_offset", the latter is "root.sgot->output_offset".

I'll attach a very simple patch that seems to fix the problem.  A test case would be nice, but is beyond my knowledge currently.