diff options
author | Ashish Sharma <asharma@mvista.com> | 2025-04-16 14:38:01 +0530 |
---|---|---|
committer | Steve Sakoman <steve@sakoman.com> | 2025-04-19 14:42:10 -0700 |
commit | 9ef34c9ce9f60077856d0145f66f734f696fa409 (patch) | |
tree | c5fc544eaa54ee8208259eca1fdad44e0ecde0d0 /meta/recipes-devtools/binutils | |
parent | 757102953a852d23a11710daa4ecb038e64c5e24 (diff) | |
download | poky-9ef34c9ce9f60077856d0145f66f734f696fa409.tar.gz |
binutils: patch CVE-2025-1181
Import patches from ubuntu:
Upstream-Status: Backport [ https://git.launchpad.net/ubuntu/+source/binutils/plain/debian/patches/CVE-2025-1181-pre.patch?h=applied/ubuntu/noble-security&id=d6b5bf57cf048c42e4bcd3a4ab32116d0b809774 &&
https://git.launchpad.net/ubuntu/+source/binutils/plain/debian/patches/CVE-2025-1181.patch?h=applied/ubuntu/noble-security&id=d6b5bf57cf048c42e4bcd3a4ab32116d0b809774
Upstream commit: https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=931494c9a89558acb36a03a340c01726545eef24 ]
(From OE-Core rev: abb575f6ac1f5badae2825f1cb6152379a6658ee)
Signed-off-by: Ashish Sharma <asharma@mvista.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Diffstat (limited to 'meta/recipes-devtools/binutils')
3 files changed, 498 insertions, 0 deletions
diff --git a/meta/recipes-devtools/binutils/binutils-2.42.inc b/meta/recipes-devtools/binutils/binutils-2.42.inc index d366350556..758bd8dcce 100644 --- a/meta/recipes-devtools/binutils/binutils-2.42.inc +++ b/meta/recipes-devtools/binutils/binutils-2.42.inc | |||
@@ -42,5 +42,7 @@ SRC_URI = "\ | |||
42 | file://CVE-2025-1176.patch \ | 42 | file://CVE-2025-1176.patch \ |
43 | file://CVE-2025-1178.patch \ | 43 | file://CVE-2025-1178.patch \ |
44 | file://CVE-2024-57360.patch \ | 44 | file://CVE-2024-57360.patch \ |
45 | file://CVE-2025-1181-pre.patch \ | ||
46 | file://CVE-2025-1181.patch \ | ||
45 | " | 47 | " |
46 | S = "${WORKDIR}/git" | 48 | S = "${WORKDIR}/git" |
diff --git a/meta/recipes-devtools/binutils/binutils/CVE-2025-1181-pre.patch b/meta/recipes-devtools/binutils/binutils/CVE-2025-1181-pre.patch new file mode 100644 index 0000000000..280e522a28 --- /dev/null +++ b/meta/recipes-devtools/binutils/binutils/CVE-2025-1181-pre.patch | |||
@@ -0,0 +1,151 @@ | |||
1 | Backported of: | ||
2 | |||
3 | From 18cc11a2771d9e40180485da9a4fb660c03efac3 Mon Sep 17 00:00:00 2001 | ||
4 | From: Nick Clifton <nickc@redhat.com> | ||
5 | Date: Wed, 5 Feb 2025 14:31:10 +0000 | ||
6 | Subject: [PATCH] Prevent illegal memory access when checking relocs in a | ||
7 | corrupt ELF binary. | ||
8 | |||
9 | PR 32641 | ||
10 | |||
11 | Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/binutils/plain/debian/patches/CVE-2025-1181-pre.patch?h=applied/ubuntu/noble-security&id=d6b5bf57cf048c42e4bcd3a4ab32116d0b809774] | ||
12 | Upstream commit [https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=931494c9a89558acb36a03a340c01726545eef24] | ||
13 | |||
14 | CVE: CVE-2025-1181 | ||
15 | |||
16 | Signed-off-by: Ashish Sharma <asharma@mvista.com> | ||
17 | |||
18 | bfd/elf-bfd.h | 3 +++ | ||
19 | bfd/elf64-x86-64.c | 10 +++++----- | ||
20 | bfd/elflink.c | 24 ++++++++++++++++++++++++ | ||
21 | bfd/elfxx-x86.c | 20 +++++++------------- | ||
22 | 4 files changed, 39 insertions(+), 18 deletions(-) | ||
23 | diff --git a/bfd/elf-bfd.h b/bfd/elf-bfd.h | ||
24 | index 3ed22fa6..07add7d0 100644 | ||
25 | --- a/bfd/elf-bfd.h | ||
26 | +++ b/bfd/elf-bfd.h | ||
27 | @@ -3126,6 +3126,9 @@ extern bool _bfd_elf_maybe_set_textrel | ||
28 | extern bool _bfd_elf_add_dynamic_tags | ||
29 | (bfd *, struct bfd_link_info *, bool); | ||
30 | |||
31 | +extern struct elf_link_hash_entry * _bfd_elf_get_link_hash_entry | ||
32 | + (struct elf_link_hash_entry **, unsigned int, Elf_Internal_Shdr *); | ||
33 | + | ||
34 | /* Large common section. */ | ||
35 | extern asection _bfd_elf_large_com_section; | ||
36 | |||
37 | diff --git a/bfd/elf64-x86-64.c b/bfd/elf64-x86-64.c | ||
38 | index d0d3b0e5..c3fb375c 100644 | ||
39 | --- a/bfd/elf64-x86-64.c | ||
40 | +++ b/bfd/elf64-x86-64.c | ||
41 | @@ -1665,7 +1665,7 @@ elf_x86_64_convert_load_reloc (bfd *abfd, | ||
42 | bool to_reloc_pc32; | ||
43 | bool abs_symbol; | ||
44 | bool local_ref; | ||
45 | - asection *tsec; | ||
46 | + asection *tsec = NULL; | ||
47 | bfd_signed_vma raddend; | ||
48 | unsigned int opcode; | ||
49 | unsigned int modrm; | ||
50 | @@ -1831,6 +1831,9 @@ elf_x86_64_convert_load_reloc (bfd *abfd, | ||
51 | return true; | ||
52 | } | ||
53 | |||
54 | + if (tsec == NULL) | ||
55 | + return false; | ||
56 | + | ||
57 | /* Don't convert GOTPCREL relocation against large section. */ | ||
58 | if (elf_section_data (tsec) != NULL | ||
59 | && (elf_section_flags (tsec) & SHF_X86_64_LARGE) != 0) | ||
60 | @@ -2127,10 +2130,7 @@ elf_x86_64_scan_relocs (bfd *abfd, struct bfd_link_info *info, | ||
61 | else | ||
62 | { | ||
63 | isym = NULL; | ||
64 | - h = sym_hashes[r_symndx - symtab_hdr->sh_info]; | ||
65 | - while (h->root.type == bfd_link_hash_indirect | ||
66 | - || h->root.type == bfd_link_hash_warning) | ||
67 | - h = (struct elf_link_hash_entry *) h->root.u.i.link; | ||
68 | + h = _bfd_elf_get_link_hash_entry (sym_hashes, r_symndx, symtab_hdr); | ||
69 | } | ||
70 | |||
71 | /* Check invalid x32 relocations. */ | ||
72 | diff --git a/bfd/elflink.c b/bfd/elflink.c | ||
73 | index 11ec6bd9..e5521d7b 100644 | ||
74 | --- a/bfd/elflink.c | ||
75 | +++ b/bfd/elflink.c | ||
76 | @@ -49,6 +49,27 @@ struct elf_info_failed | ||
77 | static bool _bfd_elf_fix_symbol_flags | ||
78 | (struct elf_link_hash_entry *, struct elf_info_failed *); | ||
79 | |||
80 | +struct elf_link_hash_entry * | ||
81 | +_bfd_elf_get_link_hash_entry (struct elf_link_hash_entry ** sym_hashes, | ||
82 | + unsigned int symndx, | ||
83 | + Elf_Internal_Shdr * symtab_hdr) | ||
84 | +{ | ||
85 | + if (symndx < symtab_hdr->sh_info) | ||
86 | + return NULL; | ||
87 | + | ||
88 | + struct elf_link_hash_entry *h = sym_hashes[symndx - symtab_hdr->sh_info]; | ||
89 | + | ||
90 | + /* The hash might be empty. See PR 32641 for an example of this. */ | ||
91 | + if (h == NULL) | ||
92 | + return NULL; | ||
93 | + | ||
94 | + while (h->root.type == bfd_link_hash_indirect | ||
95 | + || h->root.type == bfd_link_hash_warning) | ||
96 | + h = (struct elf_link_hash_entry *) h->root.u.i.link; | ||
97 | + | ||
98 | + return h; | ||
99 | +} | ||
100 | + | ||
101 | static struct elf_link_hash_entry * | ||
102 | get_ext_sym_hash (struct elf_reloc_cookie *cookie, unsigned long r_symndx) | ||
103 | { | ||
104 | @@ -62,6 +83,9 @@ get_ext_sym_hash (struct elf_reloc_cookie *cookie, unsigned long r_symndx) | ||
105 | |||
106 | h = cookie->sym_hashes[r_symndx - cookie->extsymoff]; | ||
107 | |||
108 | + if (h == NULL) | ||
109 | + return NULL; | ||
110 | + | ||
111 | while (h->root.type == bfd_link_hash_indirect | ||
112 | || h->root.type == bfd_link_hash_warning) | ||
113 | h = (struct elf_link_hash_entry *) h->root.u.i.link; | ||
114 | diff --git a/bfd/elfxx-x86.c b/bfd/elfxx-x86.c | ||
115 | index 508fd771..8c261cf8 100644 | ||
116 | --- a/bfd/elfxx-x86.c | ||
117 | +++ b/bfd/elfxx-x86.c | ||
118 | @@ -972,15 +972,7 @@ _bfd_x86_elf_check_relocs (bfd *abfd, | ||
119 | goto error_return; | ||
120 | } | ||
121 | |||
122 | - if (r_symndx < symtab_hdr->sh_info) | ||
123 | - h = NULL; | ||
124 | - else | ||
125 | - { | ||
126 | - h = sym_hashes[r_symndx - symtab_hdr->sh_info]; | ||
127 | - while (h->root.type == bfd_link_hash_indirect | ||
128 | - || h->root.type == bfd_link_hash_warning) | ||
129 | - h = (struct elf_link_hash_entry *) h->root.u.i.link; | ||
130 | - } | ||
131 | + h = _bfd_elf_get_link_hash_entry (sym_hashes, r_symndx, symtab_hdr); | ||
132 | |||
133 | if (X86_NEED_DYNAMIC_RELOC_TYPE_P (is_x86_64, r_type) | ||
134 | && NEED_DYNAMIC_RELOCATION_P (is_x86_64, info, true, h, sec, | ||
135 | @@ -1205,10 +1197,12 @@ _bfd_x86_elf_link_relax_section (bfd *abfd ATTRIBUTE_UNUSED, | ||
136 | else | ||
137 | { | ||
138 | /* Get H and SEC for GENERATE_DYNAMIC_RELOCATION_P below. */ | ||
139 | - h = sym_hashes[r_symndx - symtab_hdr->sh_info]; | ||
140 | - while (h->root.type == bfd_link_hash_indirect | ||
141 | - || h->root.type == bfd_link_hash_warning) | ||
142 | - h = (struct elf_link_hash_entry *) h->root.u.i.link; | ||
143 | + h = _bfd_elf_get_link_hash_entry (sym_hashes, r_symndx, symtab_hdr); | ||
144 | + if (h == NULL) | ||
145 | + { | ||
146 | + /* FIXMEL: Issue an error message ? */ | ||
147 | + continue; | ||
148 | + } | ||
149 | |||
150 | if (h->root.type == bfd_link_hash_defined | ||
151 | || h->root.type == bfd_link_hash_defweak) | ||
diff --git a/meta/recipes-devtools/binutils/binutils/CVE-2025-1181.patch b/meta/recipes-devtools/binutils/binutils/CVE-2025-1181.patch new file mode 100644 index 0000000000..70b7485777 --- /dev/null +++ b/meta/recipes-devtools/binutils/binutils/CVE-2025-1181.patch | |||
@@ -0,0 +1,345 @@ | |||
1 | Backported of: | ||
2 | |||
3 | From 931494c9a89558acb36a03a340c01726545eef24 Mon Sep 17 00:00:00 2001 | ||
4 | From: Nick Clifton <nickc@redhat.com> | ||
5 | Date: Wed, 5 Feb 2025 15:43:04 +0000 | ||
6 | Subject: [PATCH] Add even more checks for corrupt input when processing | ||
7 | relocations for ELF files. | ||
8 | |||
9 | PR 32643 | ||
10 | |||
11 | Upstream-Status: Backport [import from ubuntu https://git.launchpad.net/ubuntu/+source/binutils/plain/debian/patches/CVE-2025-1181.patch?h=applied/ubuntu/noble-security&id=d6b5bf57cf048c42e4bcd3a4ab32116d0b809774] | ||
12 | Upstream commit [https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;h=931494c9a89558acb36a03a340c01726545eef24] | ||
13 | |||
14 | CVE: CVE-2025-1181 | ||
15 | |||
16 | Signed-off-by: Ashish Sharma <asharma@mvista.com> | ||
17 | |||
18 | |||
19 | diff --git a/bfd/elflink.c b/bfd/elflink.c | ||
20 | index e5521d7b..ff84229c 100644 | ||
21 | --- a/bfd/elflink.c | ||
22 | +++ b/bfd/elflink.c | ||
23 | @@ -49,15 +49,17 @@ struct elf_info_failed | ||
24 | static bool _bfd_elf_fix_symbol_flags | ||
25 | (struct elf_link_hash_entry *, struct elf_info_failed *); | ||
26 | |||
27 | -struct elf_link_hash_entry * | ||
28 | -_bfd_elf_get_link_hash_entry (struct elf_link_hash_entry ** sym_hashes, | ||
29 | - unsigned int symndx, | ||
30 | - Elf_Internal_Shdr * symtab_hdr) | ||
31 | +static struct elf_link_hash_entry * | ||
32 | +get_link_hash_entry (struct elf_link_hash_entry ** sym_hashes, | ||
33 | + unsigned int symndx, | ||
34 | + unsigned int ext_sym_start) | ||
35 | { | ||
36 | - if (symndx < symtab_hdr->sh_info) | ||
37 | + if (sym_hashes == NULL | ||
38 | + /* Guard against corrupt input. See PR 32636 for an example. */ | ||
39 | + || symndx < ext_sym_start) | ||
40 | return NULL; | ||
41 | |||
42 | - struct elf_link_hash_entry *h = sym_hashes[symndx - symtab_hdr->sh_info]; | ||
43 | + struct elf_link_hash_entry *h = sym_hashes[symndx - ext_sym_start]; | ||
44 | |||
45 | /* The hash might be empty. See PR 32641 for an example of this. */ | ||
46 | if (h == NULL) | ||
47 | @@ -70,29 +72,28 @@ _bfd_elf_get_link_hash_entry (struct elf_link_hash_entry ** sym_hashes, | ||
48 | return h; | ||
49 | } | ||
50 | |||
51 | -static struct elf_link_hash_entry * | ||
52 | -get_ext_sym_hash (struct elf_reloc_cookie *cookie, unsigned long r_symndx) | ||
53 | +struct elf_link_hash_entry * | ||
54 | +_bfd_elf_get_link_hash_entry (struct elf_link_hash_entry ** sym_hashes, | ||
55 | + unsigned int symndx, | ||
56 | + Elf_Internal_Shdr * symtab_hdr) | ||
57 | { | ||
58 | - struct elf_link_hash_entry *h = NULL; | ||
59 | - | ||
60 | - if ((r_symndx >= cookie->locsymcount | ||
61 | - || ELF_ST_BIND (cookie->locsyms[r_symndx].st_info) != STB_LOCAL) | ||
62 | - /* Guard against corrupt input. See PR 32636 for an example. */ | ||
63 | - && r_symndx >= cookie->extsymoff) | ||
64 | - { | ||
65 | - | ||
66 | - h = cookie->sym_hashes[r_symndx - cookie->extsymoff]; | ||
67 | - | ||
68 | - if (h == NULL) | ||
69 | - return NULL; | ||
70 | + if (symtab_hdr == NULL) | ||
71 | + return NULL; | ||
72 | |||
73 | - while (h->root.type == bfd_link_hash_indirect | ||
74 | - || h->root.type == bfd_link_hash_warning) | ||
75 | - h = (struct elf_link_hash_entry *) h->root.u.i.link; | ||
76 | + return get_link_hash_entry (sym_hashes, symndx, symtab_hdr->sh_info); | ||
77 | +} | ||
78 | |||
79 | - } | ||
80 | +static struct elf_link_hash_entry * | ||
81 | +get_ext_sym_hash_from_cookie (struct elf_reloc_cookie *cookie, unsigned long r_symndx) | ||
82 | +{ | ||
83 | + if (cookie == NULL || cookie->sym_hashes == NULL) | ||
84 | + return NULL; | ||
85 | + | ||
86 | + if (r_symndx >= cookie->locsymcount | ||
87 | + || ELF_ST_BIND (cookie->locsyms[r_symndx].st_info) != STB_LOCAL) | ||
88 | + return get_link_hash_entry (cookie->sym_hashes, r_symndx, cookie->extsymoff); | ||
89 | |||
90 | - return h; | ||
91 | + return NULL; | ||
92 | } | ||
93 | |||
94 | asection * | ||
95 | @@ -102,7 +103,7 @@ _bfd_elf_section_for_symbol (struct elf_reloc_cookie *cookie, | ||
96 | { | ||
97 | struct elf_link_hash_entry *h; | ||
98 | |||
99 | - h = get_ext_sym_hash (cookie, r_symndx); | ||
100 | + h = get_ext_sym_hash_from_cookie (cookie, r_symndx); | ||
101 | |||
102 | if (h != NULL) | ||
103 | { | ||
104 | @@ -8906,7 +8907,6 @@ set_symbol_value (bfd *bfd_with_globals, | ||
105 | size_t symidx, | ||
106 | bfd_vma val) | ||
107 | { | ||
108 | - struct elf_link_hash_entry **sym_hashes; | ||
109 | struct elf_link_hash_entry *h; | ||
110 | size_t extsymoff = locsymcount; | ||
111 | |||
112 | @@ -8929,12 +8929,12 @@ set_symbol_value (bfd *bfd_with_globals, | ||
113 | |||
114 | /* It is a global symbol: set its link type | ||
115 | to "defined" and give it a value. */ | ||
116 | - | ||
117 | - sym_hashes = elf_sym_hashes (bfd_with_globals); | ||
118 | - h = sym_hashes [symidx - extsymoff]; | ||
119 | - while (h->root.type == bfd_link_hash_indirect | ||
120 | - || h->root.type == bfd_link_hash_warning) | ||
121 | - h = (struct elf_link_hash_entry *) h->root.u.i.link; | ||
122 | + h = get_link_hash_entry (elf_sym_hashes (bfd_with_globals), symidx, extsymoff); | ||
123 | + if (h == NULL) | ||
124 | + { | ||
125 | + /* FIXMEL What should we do ? */ | ||
126 | + return; | ||
127 | + } | ||
128 | h->root.type = bfd_link_hash_defined; | ||
129 | h->root.u.def.value = val; | ||
130 | h->root.u.def.section = bfd_abs_section_ptr; | ||
131 | @@ -11405,10 +11405,19 @@ elf_link_input_bfd (struct elf_final_link_info *flinfo, bfd *input_bfd) | ||
132 | || (elf_bad_symtab (input_bfd) | ||
133 | && flinfo->sections[symndx] == NULL)) | ||
134 | { | ||
135 | - struct elf_link_hash_entry *h = sym_hashes[symndx - extsymoff]; | ||
136 | - while (h->root.type == bfd_link_hash_indirect | ||
137 | - || h->root.type == bfd_link_hash_warning) | ||
138 | - h = (struct elf_link_hash_entry *) h->root.u.i.link; | ||
139 | + struct elf_link_hash_entry *h; | ||
140 | + | ||
141 | + h = get_link_hash_entry (sym_hashes, symndx, extsymoff); | ||
142 | + if (h == NULL) | ||
143 | + { | ||
144 | + _bfd_error_handler | ||
145 | + /* xgettext:c-format */ | ||
146 | + (_("error: %pB: unable to create group section symbol"), | ||
147 | + input_bfd); | ||
148 | + bfd_set_error (bfd_error_bad_value); | ||
149 | + return false; | ||
150 | + } | ||
151 | + | ||
152 | /* Arrange for symbol to be output. */ | ||
153 | h->indx = -2; | ||
154 | elf_section_data (osec)->this_hdr.sh_info = -2; | ||
155 | @@ -11542,7 +11551,7 @@ elf_link_input_bfd (struct elf_final_link_info *flinfo, bfd *input_bfd) | ||
156 | || (elf_bad_symtab (input_bfd) | ||
157 | && flinfo->sections[r_symndx] == NULL)) | ||
158 | { | ||
159 | - h = sym_hashes[r_symndx - extsymoff]; | ||
160 | + h = get_link_hash_entry (sym_hashes, r_symndx, extsymoff); | ||
161 | |||
162 | /* Badly formatted input files can contain relocs that | ||
163 | reference non-existant symbols. Check here so that | ||
164 | @@ -11551,17 +11560,13 @@ elf_link_input_bfd (struct elf_final_link_info *flinfo, bfd *input_bfd) | ||
165 | { | ||
166 | _bfd_error_handler | ||
167 | /* xgettext:c-format */ | ||
168 | - (_("error: %pB contains a reloc (%#" PRIx64 ") for section %pA " | ||
169 | + (_("error: %pB contains a reloc (%#" PRIx64 ") for section '%pA' " | ||
170 | "that references a non-existent global symbol"), | ||
171 | input_bfd, (uint64_t) rel->r_info, o); | ||
172 | bfd_set_error (bfd_error_bad_value); | ||
173 | return false; | ||
174 | } | ||
175 | |||
176 | - while (h->root.type == bfd_link_hash_indirect | ||
177 | - || h->root.type == bfd_link_hash_warning) | ||
178 | - h = (struct elf_link_hash_entry *) h->root.u.i.link; | ||
179 | - | ||
180 | s_type = h->type; | ||
181 | |||
182 | /* If a plugin symbol is referenced from a non-IR file, | ||
183 | @@ -11777,7 +11782,6 @@ elf_link_input_bfd (struct elf_final_link_info *flinfo, bfd *input_bfd) | ||
184 | && flinfo->sections[r_symndx] == NULL)) | ||
185 | { | ||
186 | struct elf_link_hash_entry *rh; | ||
187 | - unsigned long indx; | ||
188 | |||
189 | /* This is a reloc against a global symbol. We | ||
190 | have not yet output all the local symbols, so | ||
191 | @@ -11786,15 +11790,16 @@ elf_link_input_bfd (struct elf_final_link_info *flinfo, bfd *input_bfd) | ||
192 | reloc to point to the global hash table entry | ||
193 | for this symbol. The symbol index is then | ||
194 | set at the end of bfd_elf_final_link. */ | ||
195 | - indx = r_symndx - extsymoff; | ||
196 | - rh = elf_sym_hashes (input_bfd)[indx]; | ||
197 | - while (rh->root.type == bfd_link_hash_indirect | ||
198 | - || rh->root.type == bfd_link_hash_warning) | ||
199 | - rh = (struct elf_link_hash_entry *) rh->root.u.i.link; | ||
200 | - | ||
201 | - /* Setting the index to -2 tells | ||
202 | - elf_link_output_extsym that this symbol is | ||
203 | - used by a reloc. */ | ||
204 | + rh = get_link_hash_entry (elf_sym_hashes (input_bfd), | ||
205 | + r_symndx, extsymoff); | ||
206 | + if (rh == NULL) | ||
207 | + { | ||
208 | + /* FIXME: Generate an error ? */ | ||
209 | + continue; | ||
210 | + } | ||
211 | + | ||
212 | + /* Setting the index to -2 tells elf_link_output_extsym | ||
213 | + that this symbol is used by a reloc. */ | ||
214 | BFD_ASSERT (rh->indx < 0); | ||
215 | rh->indx = -2; | ||
216 | *rel_hash = rh; | ||
217 | @@ -13758,25 +13763,21 @@ _bfd_elf_gc_mark_hook (asection *sec, | ||
218 | struct elf_link_hash_entry *h, | ||
219 | Elf_Internal_Sym *sym) | ||
220 | { | ||
221 | - if (h != NULL) | ||
222 | + if (h == NULL) | ||
223 | + return bfd_section_from_elf_index (sec->owner, sym->st_shndx); | ||
224 | + | ||
225 | + switch (h->root.type) | ||
226 | { | ||
227 | - switch (h->root.type) | ||
228 | - { | ||
229 | - case bfd_link_hash_defined: | ||
230 | - case bfd_link_hash_defweak: | ||
231 | - return h->root.u.def.section; | ||
232 | + case bfd_link_hash_defined: | ||
233 | + case bfd_link_hash_defweak: | ||
234 | + return h->root.u.def.section; | ||
235 | |||
236 | - case bfd_link_hash_common: | ||
237 | - return h->root.u.c.p->section; | ||
238 | + case bfd_link_hash_common: | ||
239 | + return h->root.u.c.p->section; | ||
240 | |||
241 | - default: | ||
242 | - break; | ||
243 | - } | ||
244 | + default: | ||
245 | + return NULL; | ||
246 | } | ||
247 | - else | ||
248 | - return bfd_section_from_elf_index (sec->owner, sym->st_shndx); | ||
249 | - | ||
250 | - return NULL; | ||
251 | } | ||
252 | |||
253 | /* Return the debug definition section. */ | ||
254 | @@ -13825,46 +13826,49 @@ _bfd_elf_gc_mark_rsec (struct bfd_link_info *info, asection *sec, | ||
255 | if (r_symndx == STN_UNDEF) | ||
256 | return NULL; | ||
257 | |||
258 | - h = get_ext_sym_hash (cookie, r_symndx); | ||
259 | - | ||
260 | - if (h != NULL) | ||
261 | + h = get_ext_sym_hash_from_cookie (cookie, r_symndx); | ||
262 | + if (h == NULL) | ||
263 | { | ||
264 | - bool was_marked; | ||
265 | + /* A corrup tinput file can lead to a situation where the index | ||
266 | + does not reference either a local or an external symbol. */ | ||
267 | + if (r_symndx >= cookie->locsymcount) | ||
268 | + return NULL; | ||
269 | |||
270 | - was_marked = h->mark; | ||
271 | - h->mark = 1; | ||
272 | - /* Keep all aliases of the symbol too. If an object symbol | ||
273 | - needs to be copied into .dynbss then all of its aliases | ||
274 | - should be present as dynamic symbols, not just the one used | ||
275 | - on the copy relocation. */ | ||
276 | - hw = h; | ||
277 | - while (hw->is_weakalias) | ||
278 | - { | ||
279 | - hw = hw->u.alias; | ||
280 | - hw->mark = 1; | ||
281 | - } | ||
282 | + return (*gc_mark_hook) (sec, info, cookie->rel, NULL, | ||
283 | + &cookie->locsyms[r_symndx]); | ||
284 | + } | ||
285 | |||
286 | - if (!was_marked && h->start_stop && !h->root.ldscript_def) | ||
287 | - { | ||
288 | - if (info->start_stop_gc) | ||
289 | - return NULL; | ||
290 | + bool was_marked = h->mark; | ||
291 | |||
292 | - /* To work around a glibc bug, mark XXX input sections | ||
293 | - when there is a reference to __start_XXX or __stop_XXX | ||
294 | - symbols. */ | ||
295 | - else if (start_stop != NULL) | ||
296 | - { | ||
297 | - asection *s = h->u2.start_stop_section; | ||
298 | - *start_stop = true; | ||
299 | - return s; | ||
300 | - } | ||
301 | - } | ||
302 | + h->mark = 1; | ||
303 | + /* Keep all aliases of the symbol too. If an object symbol | ||
304 | + needs to be copied into .dynbss then all of its aliases | ||
305 | + should be present as dynamic symbols, not just the one used | ||
306 | + on the copy relocation. */ | ||
307 | + hw = h; | ||
308 | + while (hw->is_weakalias) | ||
309 | + { | ||
310 | + hw = hw->u.alias; | ||
311 | + hw->mark = 1; | ||
312 | + } | ||
313 | |||
314 | - return (*gc_mark_hook) (sec, info, cookie->rel, h, NULL); | ||
315 | + if (!was_marked && h->start_stop && !h->root.ldscript_def) | ||
316 | + { | ||
317 | + if (info->start_stop_gc) | ||
318 | + return NULL; | ||
319 | + | ||
320 | + /* To work around a glibc bug, mark XXX input sections | ||
321 | + when there is a reference to __start_XXX or __stop_XXX | ||
322 | + symbols. */ | ||
323 | + else if (start_stop != NULL) | ||
324 | + { | ||
325 | + asection *s = h->u2.start_stop_section; | ||
326 | + *start_stop = true; | ||
327 | + return s; | ||
328 | + } | ||
329 | } | ||
330 | |||
331 | - return (*gc_mark_hook) (sec, info, cookie->rel, NULL, | ||
332 | - &cookie->locsyms[r_symndx]); | ||
333 | + return (*gc_mark_hook) (sec, info, cookie->rel, h, NULL); | ||
334 | } | ||
335 | |||
336 | /* COOKIE->rel describes a relocation against section SEC, which is | ||
337 | @@ -14878,7 +14882,7 @@ bfd_elf_reloc_symbol_deleted_p (bfd_vma offset, void *cookie) | ||
338 | |||
339 | struct elf_link_hash_entry *h; | ||
340 | |||
341 | - h = get_ext_sym_hash (rcookie, r_symndx); | ||
342 | + h = get_ext_sym_hash_from_cookie (rcookie, r_symndx); | ||
343 | |||
344 | if (h != NULL) | ||
345 | { | ||