Bug 27746 - or1k bfd overflow in plt reloc argument
Summary: or1k bfd overflow in plt reloc argument
Status: RESOLVED FIXED
Alias: None
Product: binutils
Classification: Unclassified
Component: binutils (show other bugs)
Version: unspecified
: P2 normal
Target Milestone: ---
Assignee: Stafford Horne
URL:
Keywords:
Depends on:
Blocks: 21464
  Show dependency tree / graph
 
Reported: 2021-04-16 23:44 UTC by Stafford Horne
Modified: 2021-05-06 20:26 UTC (History)
0 users

See Also:
Host:
Target: or1k-*-*
Build:
Last reconfirmed:

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Stafford Horne 2021-04-16 23:44:14 UTC 
Related to 21464

When generating PLT entries the or1k bfd implementation will silently overflow the PLT argument to _dl_fixup causing a crash at runtime.  This was noticed with glibc test elf/tst-audit-threads.

Workaround run library with LD_BIND_NOW=1.

Example

.plt

   75e70:       19 80 00 0b     l.movhi r12,0xb
   75e74:       85 8c 95 64     l.lwz r12,-27292(r12)
   75e78:       44 00 60 00     l.jr r12
   75e7c:       a9 60 ff f0     l.ori r11,r0,0xfff0

   75e80:       19 80 00 0b     l.movhi r12,0xb
   75e84:       85 8c 95 68     l.lwz r12,-27288(r12)
   75e88:       44 00 60 00     l.jr r12
   75e8c:       a9 60 ff fc     l.ori r11,r0,0xfffc

   75e90:       19 80 00 0b     l.movhi r12,0xb
   75e94:       85 8c 95 6c     l.lwz r12,-27284(r12)
   75e98:       44 00 60 00     l.jr r12
   75e9c:       a9 61 00 08     l.ori r11,r1,0x8    < r0 changed to r1 from overflow
Comment 1 Sourceware Commits 2021-05-06 11:53:10 UTC 
The or1k-large-fixes branch has been updated by Stafford Horne <shorne@sourceware.org>:

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=284a1309021a0ef4c29f198470d95652f02b13f0

commit 284a1309021a0ef4c29f198470d95652f02b13f0
Author: Stafford Horne <shorne@gmail.com>
Date:   Thu May 6 20:51:25 2021 +0900

    or1k: Support large plt_relocs when generating plt entries
    
    The current PLT generation code will generate invalid code when the PLT
    relocation offset exceeds 64k.  This fixes the issue by detecting large
    plt_reloc offsets and generare code sequences to create larger plt
    relocations.
    
    The "large" plt code needs 2 extra instructions to create 32-bit offsets.
    
    bfd/ChangeLog:
    
            PR 27746
            * elf32-or1k.c (PLT_ENTRY_SIZE_LARGE, PLT_MAX_INSN_COUNT,
            OR1K_ADD, OR1K_ORI): New macros to help with plt creation.
            (elf_or1k_link_hash_table): New field plt_count.
            (elf_or1k_link_hash_entry): New field plt_index.
            (elf_or1k_plt_entry_size): New function.
            (or1k_write_plt_entry): Update to support variable size PLTs.
            (or1k_elf_finish_dynamic_sections): Use new or1k_write_plt_entry
            API.
            (or1k_elf_finish_dynamic_symbol): Update to write large PLTs
            when needed.
            (allocate_dynrelocs): Use elf_or1k_plt_entry_size to account for
            PLT size.
    
    ld/ChangeLog:
    
            PR 27746
            testsuite/ld-or1k/or1k.exp (or1kplttests): Add tests for linking
            along with gotha() relocations.
            testsuite/ld-or1k/gotha1.dd: New file.
            testsuite/ld-or1k/gotha1.s: New file.
            testsuite/ld-or1k/gotha2.dd: New file.
            testsuite/ld-or1k/gotha2.s: New file
            testsuite/ld-or1k/pltlib.s (x): Define size to avoid link
            failure.
Comment 2 Sourceware Commits 2021-05-06 11:53:55 UTC 
The master branch has been updated by Stafford Horne <shorne@sourceware.org>:

https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=284a1309021a0ef4c29f198470d95652f02b13f0

commit 284a1309021a0ef4c29f198470d95652f02b13f0
Author: Stafford Horne <shorne@gmail.com>
Date:   Thu May 6 20:51:25 2021 +0900

    or1k: Support large plt_relocs when generating plt entries
    
    The current PLT generation code will generate invalid code when the PLT
    relocation offset exceeds 64k.  This fixes the issue by detecting large
    plt_reloc offsets and generare code sequences to create larger plt
    relocations.
    
    The "large" plt code needs 2 extra instructions to create 32-bit offsets.
    
    bfd/ChangeLog:
    
            PR 27746
            * elf32-or1k.c (PLT_ENTRY_SIZE_LARGE, PLT_MAX_INSN_COUNT,
            OR1K_ADD, OR1K_ORI): New macros to help with plt creation.
            (elf_or1k_link_hash_table): New field plt_count.
            (elf_or1k_link_hash_entry): New field plt_index.
            (elf_or1k_plt_entry_size): New function.
            (or1k_write_plt_entry): Update to support variable size PLTs.
            (or1k_elf_finish_dynamic_sections): Use new or1k_write_plt_entry
            API.
            (or1k_elf_finish_dynamic_symbol): Update to write large PLTs
            when needed.
            (allocate_dynrelocs): Use elf_or1k_plt_entry_size to account for
            PLT size.
    
    ld/ChangeLog:
    
            PR 27746
            testsuite/ld-or1k/or1k.exp (or1kplttests): Add tests for linking
            along with gotha() relocations.
            testsuite/ld-or1k/gotha1.dd: New file.
            testsuite/ld-or1k/gotha1.s: New file.
            testsuite/ld-or1k/gotha2.dd: New file.
            testsuite/ld-or1k/gotha2.s: New file
            testsuite/ld-or1k/pltlib.s (x): Define size to avoid link
            failure.
Comment 3 Stafford Horne 2021-05-06 20:26:22 UTC 
The latest commit comment should have fixed this.