PR28306, segfault in _bfd_mips_elf_reloc_unshuffle

[Alan Modra]

On Fri, Sep 10, 2021 at 11:50:04AM +0200, Maciej W. Rozycki wrote:
> On Fri, 10 Sep 2021, Alan Modra wrote:
> 
> > > I don't think there is any easy and safe way of doing that.  Even
> > > though there is a nice tidy array of NULL terminated arelent pointers,
> > > the special_function doesn't see an arelent** but rather an arelent*.
> > > 
> > > Hmm, how about replacing !relocatable above with
> > > !(relocatable && !reloc_entry->howto->partial_inplace) ie. the
> > > condition under which _bfd_mips_elf_generic_reloc writes section
> > > contents?
> > 
> > Testing revealed some fails
> > mipsisa32r2el-elf  +FAIL: MIPS reloc against local symbol overflow
> > mipstx39-elf  +FAIL: MIPS reloc against local symbol overflow
> > 
> > The test in question puts a ".half" at the end of a section, with
> > resultant R_MIPS_16, a 4 byte relocation, 2 bytes before the end of
> > the section.  I think the test should fail on these targets.  With a
> > very carefully crafted testcase it should be possible to cause a gas
> > buffer overflow.
> 
>  Hmm, it looks to me like a bug in the implementation of the `.half' 
> pseudo-op (that it emits a 16-bit rather than a 32-bit data quantity with 
> R_MIPS_16 attached to the least significant halfword), but I'm not sure if 
> at this time of MIPS target's history it is safe to fix it.

R_MIPS_16 is specified by the ABI to be the low 16-bits within a
32-bit word.  That's a problem with .half as it is currently, since
gas emits the R_MIPS_16 at the .half address if a reloc is needed.
The result is that ld applies the relocation to the *next* halfword on
big-endian mips targets.  Effectively that means .half can only be
used with constants.

>  I'll have to 
> chew it over a bit and I'll be travelling over the next couple of days 
> anyway, so I'll get back to this discussion after the weekend (including 
> the issue of `arelent*' vs `arelent**').
> 
>   Maciej

-- 
Alan Modra
Australia Development Lab, IBM