ELF: Forbid all relative relocations to absolute symbols in PIC, except for weak undefined.

[pcc]

Summary

Weak undefined symbols resolve to the image base. This is a little strange,
but it allows us to link function calls to such symbols. Normally such a
call will be guarded with a comparison, which will load a zero from the GOT.

There's one example of such a function call in crti.o in Linux's CRT.

As part of this change, I also needed to make the synthetic start and end
symbols image base relative in the case where their sections were empty,
so that PC-relative references to those symbols would continue to work.

[ruiu]

Is a DefinedSynthetic with the null output section different from a DefinedRegular with the null input section? Both seems to be resolved to the same address.

[pcc]

Isn't a DefinedRegular with a null input section an absolute symbol? What we need here is an image base relative symbol.

[ruiu]

LGTM with nits.

ELF/Writer.cpp

465

Remove else after return.

467–468

You want to return false (or true, as it is just a dummy value) after error() because error is not a noreturn function.

ELF/OutputSections.cpp

void SymbolTableSection<ELFT>::writeGlobalSymbols(uint8_t *Buf) {
   }
 }
 
 template <class ELFT>
 const OutputSectionBase<ELFT> *
 SymbolTableSection<ELFT>::getOutputSection(SymbolBody *Sym) {
   switch (Sym->kind()) {
   case SymbolBody::DefinedSyntheticKind:
-    return &cast<DefinedSynthetic<ELFT>>(Sym)->Section;
+    return cast<DefinedSynthetic<ELFT>>(Sym)->Section;
   case SymbolBody::DefinedRegularKind: {
     auto &D = cast<DefinedRegular<ELFT>>(*Sym);
     if (D.Section)
       return D.Section->OutSec;
     break;
   }
   case SymbolBody::DefinedCommonKind:
     return Out<ELFT>::Bss;

ELF/SymbolTable.h

public:
 
   Symbol *addUndefined(StringRef Name);
   Symbol *addUndefined(StringRef Name, uint8_t Binding, uint8_t StOther,
                        uint8_t Type, InputFile *File);
 
   Symbol *addRegular(StringRef Name, const Elf_Sym &Sym,
                      InputSectionBase<ELFT> *Section);
   Symbol *addRegular(StringRef Name, uint8_t Binding, uint8_t StOther);
-  Symbol *addSynthetic(StringRef N, OutputSectionBase<ELFT> &Section,
+  Symbol *addSynthetic(StringRef N, OutputSectionBase<ELFT> *Section,
                        uintX_t Value);
   void addShared(SharedFile<ELFT> *F, StringRef Name, const Elf_Sym &Sym,
                  const typename ELFT::Verdef *Verdef);
 
   void addLazyArchive(ArchiveFile *F, const llvm::object::Archive::Symbol S);
   void addLazyObject(StringRef Name, MemoryBufferRef MBRef);
   Symbol *addBitcode(StringRef Name, bool IsWeak, uint8_t StOther, uint8_t Type,
                      bool CanOmitFromDynSym, BitcodeFile *File);

ELF/SymbolTable.cpp

if (Cmp > 0)
     replaceBody<DefinedRegular<ELFT>>(S, Name, StOther);
   else if (Cmp == 0)
     reportDuplicate(S->body(), nullptr);
   return S;
 }
 
 template <typename ELFT>
 Symbol *SymbolTable<ELFT>::addSynthetic(StringRef N,
-                                        OutputSectionBase<ELFT> &Section,
+                                        OutputSectionBase<ELFT> *Section,
                                         uintX_t Value) {
   Symbol *S;
   bool WasInserted;
   std::tie(S, WasInserted) =
       insert(N, STT_NOTYPE, STV_HIDDEN, /*CanOmitFromDynSym*/ false,
              /*IsUsedInRegularObj*/ true, nullptr);
   int Cmp = compareDefinedNonCommon(S, WasInserted, STB_GLOBAL);
   if (Cmp > 0)

ELF/Symbols.h

 
 template <class ELFT>
 InputSectionBase<ELFT> *DefinedRegular<ELFT>::NullInputSection;
 
 // DefinedSynthetic is a class to represent linker-generated ELF symbols.
 // The difference from the regular symbol is that DefinedSynthetic symbols
 // don't belong to any input files or sections. Thus, its constructor
 // takes an output section to calculate output VA, etc.
+// If Section is null, this symbol is relative to the image base.
 template <class ELFT> class DefinedSynthetic : public Defined {
 public:
   typedef typename ELFT::uint uintX_t;
   DefinedSynthetic(StringRef N, uintX_t Value,
-                   OutputSectionBase<ELFT> &Section);
+                   OutputSectionBase<ELFT> *Section);
 
   static bool classof(const SymbolBody *S) {
     return S->kind() == SymbolBody::DefinedSyntheticKind;
   }
 
   // Special value designates that the symbol 'points'
   // to the end of the section.
   static const uintX_t SectionEnd = uintX_t(-1);
 
   uintX_t Value;
-  const OutputSectionBase<ELFT> &Section;
+  const OutputSectionBase<ELFT> *Section;
 };
 
 class Undefined : public SymbolBody {
 public:
   Undefined(StringRef Name, uint8_t StOther, uint8_t Type);
   Undefined(uint32_t NameOffset, uint8_t StOther, uint8_t Type);
 
   static bool classof(const SymbolBody *S) {

ELF/Symbols.cpp

 template <class ELFT>
 static typename ELFT::uint getSymVA(const SymbolBody &Body,
                                     typename ELFT::uint &Addend) {
   typedef typename ELFT::uint uintX_t;
 
   switch (Body.kind()) {
   case SymbolBody::DefinedSyntheticKind: {
     auto &D = cast<DefinedSynthetic<ELFT>>(Body);
+    const OutputSectionBase<ELFT> *Sec = D.Section;
+    if (!Sec)
+      return D.Value;
     if (D.Value == DefinedSynthetic<ELFT>::SectionEnd)
-      return D.Section.getVA() + D.Section.getSize();
-    return D.Section.getVA() + D.Value;
+      return Sec->getVA() + Sec->getSize();
+    return Sec->getVA() + D.Value;
   }
   case SymbolBody::DefinedRegularKind: {
     auto &D = cast<DefinedRegular<ELFT>>(Body);
     InputSectionBase<ELFT> *SC = D.Section;
 
     // According to the ELF spec reference to a local symbol from outside
     // the group are not allowed. Unfortunately .eh_frame breaks that rule
     // and must be treated specially. For now we just replace the symbol with

 Undefined::Undefined(StringRef Name, uint8_t StOther, uint8_t Type)
     : SymbolBody(SymbolBody::UndefinedKind, Name, StOther, Type) {}
 
 Undefined::Undefined(uint32_t NameOffset, uint8_t StOther, uint8_t Type)
     : SymbolBody(SymbolBody::UndefinedKind, NameOffset, StOther, Type) {}
 
 template <typename ELFT>
 DefinedSynthetic<ELFT>::DefinedSynthetic(StringRef N, uintX_t Value,
-                                         OutputSectionBase<ELFT> &Section)
+                                         OutputSectionBase<ELFT> *Section)
     : Defined(SymbolBody::DefinedSyntheticKind, N, STV_HIDDEN, 0 /* Type */),
       Value(Value), Section(Section) {}
 
 DefinedCommon::DefinedCommon(StringRef N, uint64_t Size, uint64_t Alignment,
                              uint8_t StOther, uint8_t Type)
     : Defined(SymbolBody::DefinedCommonKind, N, StOther, Type),
       Alignment(Alignment), Size(Size) {}
 

ELF/Writer.cpp

static bool isRelRelative(RelExpr E, uint32_t Type, const SymbolBody &Body) {
 
   bool RelE = E == R_PC || E == R_PLT_PC || E == R_GOT_PC || E == R_GOTREL ||
               E == R_PAGE_PC;
   if (AbsVal && !RelE)
     return true;
   if (!AbsVal && RelE)
     return true;
 
+  // Relative relocation to an absolute value. This is normally unrepresentable,
+  // but if the relocation refers to a weak undefined symbol, we allow it to
+  // resolve to the image base. This is a little strange, but it allows us to
+  // link function calls to such symbols. Normally such a call will be guarded
+  // with a comparison, which will load a zero from the GOT.
+  if (AbsVal && RelE) {
+    if (Body.isUndefined() && !Body.isLocal() && Body.symbol()->isWeak())
+      return true;
+    else {
+      StringRef S = getELFRelocationTypeName(Config->EMachine, Type);
+      error("relocation " + S + " cannot refer to absolute symbol " +
+            Body.getName());
+    }
+  }
+
   return Target->usesOnlyLowPageBits(Type);
 }
 
 static RelExpr toPlt(RelExpr Expr) {
   if (Expr == R_PPC_OPD)
     return R_PPC_PLT_OPD;
   if (Expr == R_PC)
     return R_PLT_PC;

 template <class ELFT>
 bool Writer<ELFT>::isDiscarded(InputSectionBase<ELFT> *S) const {
   return !S || S == &InputSection<ELFT>::Discarded || !S->Live ||
          Script<ELFT>::X->isDiscarded(S);
 }
 
 template <class ELFT>
 static Symbol *addOptionalSynthetic(SymbolTable<ELFT> &Table, StringRef Name,
-                                    OutputSectionBase<ELFT> &Sec,
+                                    OutputSectionBase<ELFT> *Sec,
                                     typename ELFT::uint Val) {
   if (!Table.find(Name))
     return nullptr;
   return Table.addSynthetic(Name, Sec, Val);
 }
 
 // The beginning and the ending of .rel[a].plt section are marked
 // with __rel[a]_iplt_{start,end} symbols if it is a statically linked
 // executable. The runtime needs these symbols in order to resolve
 // all IRELATIVE relocs on startup. For dynamic executables, we don't
 // need these symbols, since IRELATIVE relocs are resolved through GOT
 // and PLT. For details, see http://www.airs.com/blog/archives/403.
 template <class ELFT> void Writer<ELFT>::addRelIpltSymbols() {
   if (isOutputDynamic() || !Out<ELFT>::RelaPlt)
     return;
   StringRef S = Config->Rela ? "__rela_iplt_start" : "__rel_iplt_start";
-  addOptionalSynthetic(Symtab, S, *Out<ELFT>::RelaPlt, 0);
+  addOptionalSynthetic(Symtab, S, Out<ELFT>::RelaPlt, 0);
 
   S = Config->Rela ? "__rela_iplt_end" : "__rel_iplt_end";
-  addOptionalSynthetic(Symtab, S, *Out<ELFT>::RelaPlt,
+  addOptionalSynthetic(Symtab, S, Out<ELFT>::RelaPlt,
                        DefinedSynthetic<ELFT>::SectionEnd);
 }
 
 template <class ELFT> static bool includeInSymtab(const SymbolBody &B) {
   if (!B.symbol()->IsUsedInRegularObj)
     return false;
 
   if (auto *D = dyn_cast<DefinedRegular<ELFT>>(&B)) {

 // The linker is expected to define some symbols depending on
 // the linking result. This function defines such symbols.
 template <class ELFT> void Writer<ELFT>::addReservedSymbols() {
   if (Config->EMachine == EM_MIPS) {
     // Define _gp for MIPS. st_value of _gp symbol will be updated by Writer
     // so that it points to an absolute address which is relative to GOT.
     // See "Global Data Symbols" in Chapter 6 in the following document:
     // ftp://www.linux-mips.org/pub/linux/mips/doc/ABI/mipsabi.pdf
-    Symtab.addSynthetic("_gp", *Out<ELFT>::Got, MipsGPOffset);
+    Symtab.addSynthetic("_gp", Out<ELFT>::Got, MipsGPOffset);
 
     // On MIPS O32 ABI, _gp_disp is a magic symbol designates offset between
     // start of function and 'gp' pointer into GOT.
     ElfSym<ELFT>::MipsGpDisp =
-        addOptionalSynthetic(Symtab, "_gp_disp", *Out<ELFT>::Got, MipsGPOffset)
+        addOptionalSynthetic(Symtab, "_gp_disp", Out<ELFT>::Got, MipsGPOffset)
             ->body();
     // The __gnu_local_gp is a magic symbol equal to the current value of 'gp'
     // pointer. This symbol is used in the code generated by .cpload pseudo-op
     // in case of using -mno-shared option.
     // https://sourceware.org/ml/binutils/2004-12/msg00094.html
-    addOptionalSynthetic(Symtab, "__gnu_local_gp", *Out<ELFT>::Got,
+    addOptionalSynthetic(Symtab, "__gnu_local_gp", Out<ELFT>::Got,
                          MipsGPOffset);
   }
 
   // In the assembly for 32 bit x86 the _GLOBAL_OFFSET_TABLE_ symbol
   // is magical and is used to produce a R_386_GOTPC relocation.
   // The R_386_GOTPC relocation value doesn't actually depend on the
   // symbol value, so it could use an index of STN_UNDEF which, according
   // to the spec, means the symbol value is 0.
for (OutputSectionBase<ELFT> *Sec : RegularSections)
       addStartStopSymbols(Sec);
   }
 
   // Add _DYNAMIC symbol. Unlike GNU gold, our _DYNAMIC symbol has no type.
   // It should be okay as no one seems to care about the type.
   // Even the author of gold doesn't remember why gold behaves that way.
   // https://sourceware.org/ml/binutils/2002-03/msg00360.html
   if (isOutputDynamic())
-    Symtab.addSynthetic("_DYNAMIC", *Out<ELFT>::Dynamic, 0);
+    Symtab.addSynthetic("_DYNAMIC", Out<ELFT>::Dynamic, 0);
 
   // Define __rel[a]_iplt_{start,end} symbols if needed.
   addRelIpltSymbols();
 
   if (Out<ELFT>::EhFrameHdr->Sec)
     Out<ELFT>::EhFrameHdr->Sec->finalize();
 
   // Scan relocations. This must be done after every symbol is declared so that

 }
 
 // The linker is expected to define SECNAME_start and SECNAME_end
 // symbols for a few sections. This function defines them.
 template <class ELFT> void Writer<ELFT>::addStartEndSymbols() {
   auto Define = [&](StringRef Start, StringRef End,
                     OutputSectionBase<ELFT> *OS) {
     if (OS) {
-      this->Symtab.addSynthetic(Start, *OS, 0);
-      this->Symtab.addSynthetic(End, *OS, DefinedSynthetic<ELFT>::SectionEnd);
+      this->Symtab.addSynthetic(Start, OS, 0);
+      this->Symtab.addSynthetic(End, OS, DefinedSynthetic<ELFT>::SectionEnd);
     } else {
-      this->Symtab.addIgnored(Start);
-      this->Symtab.addIgnored(End);
+      addOptionalSynthetic(this->Symtab, Start,
+                           (OutputSectionBase<ELFT> *)nullptr, 0);
+      addOptionalSynthetic(this->Symtab, End,
+                           (OutputSectionBase<ELFT> *)nullptr, 0);
     }
   };
 
   Define("__preinit_array_start", "__preinit_array_end",
          Out<ELFT>::Dynamic->PreInitArraySec);
   Define("__init_array_start", "__init_array_end",
          Out<ELFT>::Dynamic->InitArraySec);
   Define("__fini_array_start", "__fini_array_end",
void Writer<ELFT>::addStartStopSymbols(OutputSectionBase<ELFT> *Sec) {
   StringRef S = Sec->getName();
   if (!isValidCIdentifier(S))
     return;
   StringSaver Saver(Alloc);
   StringRef Start = Saver.save("__start_" + S);
   StringRef Stop = Saver.save("__stop_" + S);
   if (SymbolBody *B = Symtab.find(Start))
     if (B->isUndefined())
-      Symtab.addSynthetic(Start, *Sec, 0);
+      Symtab.addSynthetic(Start, Sec, 0);
   if (SymbolBody *B = Symtab.find(Stop))
     if (B->isUndefined())
-      Symtab.addSynthetic(Stop, *Sec, DefinedSynthetic<ELFT>::SectionEnd);
+      Symtab.addSynthetic(Stop, Sec, DefinedSynthetic<ELFT>::SectionEnd);
 }
 
 template <class ELFT> static bool needsPtLoad(OutputSectionBase<ELFT> *Sec) {
   if (!(Sec->getFlags() & SHF_ALLOC))
     return false;
 
   // Don't allocate VA space for TLS NOBITS sections. The PT_TLS PHDR is
   // responsible for allocating space for them, not the PT_LOAD that

test/ELF/relocation-relative-absolute.s

+# REQUIRES: x86
+# RUN: llvm-mc -filetype=obj -triple=x86_64-pc-linux %s -o %t.o
+# RUN: not ld.lld %t.o -o %t -pie 2>&1 | FileCheck %s
+
+.globl _start
+_start:
+
+# CHECK: relocation R_X86_64_PLT32 cannot refer to absolute symbol answer
+call answer@PLT
+
+.globl answer
+answer = 42

test/ELF/relocation-relative-synthetic.s

+# REQUIRES: x86
+# RUN: llvm-mc -filetype=obj -triple=x86_64-pc-linux %s -o %t.o
+# RUN: ld.lld %t.o -o %t -pie
+# RUN: llvm-readobj -dyn-relocations %t | FileCheck %s
+
+# CHECK:      Dynamic Relocations {
+# CHECK-NEXT: }
+
+.globl _start
+_start:
+call __init_array_start@PLT

test/ELF/relocation-relative-weak.s

+# REQUIRES: x86
+# RUN: llvm-mc -filetype=obj -triple=x86_64-pc-linux %s -o %t.o
+# RUN: ld.lld %t.o -o %t -pie
+# RUN: llvm-readobj -dyn-relocations %t | FileCheck %s
+
+# CHECK:      Dynamic Relocations {
+# CHECK-NEXT: }
+
+.globl _start
+_start:
+
+.globl w
+.weak w
+call w@PLT