Bug #1301

ld crashes with '-z ignore' due to a null data descriptor

Added by Josef Sipek over 6 years ago. Updated over 6 years ago.

Status:ResolvedStart date:2011-07-29
Priority:NormalDue date:
Assignee:Rich Lowe% Done:


Category:cmd - userland programs
Target version:-
Difficulty:Medium Tags:


When ld is passed -z ignore it, in certain cases, will temporarily create output sections with no data descriptors.
This trips an assert in ld introduced with the fix for #308, and otherwise crashes with a write to NULL+0x20:

fffffd7fffdff590 libld.so.4`ld32_create_outfile+0x79c()
fffffd7fffdff5e0 libld.so.4`ld32_main+0x5e7()
fffffd7fffdff620 main+0xb9()
fffffd7fffdff630 0x401efc()
call   -0x2a48c <PLT=libelf.so.1`elf_getdata>
libld.so.4`ld32_create_outfile+0x79c:   movq   %r14,0x20(%rax)
> <rax=K
> ::offsetof Elf_Data d_align
offsetof (Elf_Data, d_align) = 0x20, sizeof (...->d_align) = 8

This is as we try to increase the alignment of that empty section to match those following it, per #308.

This is because in ld_create_outfile the output .data section already exists, and so while we mark it discarded, we don't have the opportunity to elide it from the list of output section descriptors, it is instead dropped later, while re-initializing section descriptors we prune any output descriptor with a NULL os_scn.

We should be sure that a sections data descriptor is not-NULL before assigning to its d_align. If the first data descriptor is NULL, I believe it is safe to assume that the entire section is discarded, the logic being that with no data descriptors it also has no size, alignment, etc.

Given we got into this bug, however, due to a set of asserts that a wide range of software failed to trip, I'm not entirely sure how safe it is to assume this.

Related issues

Related to illumos gate - Bug #308: ld may misalign sections only preceded by empty sections Resolved 2010-10-06


#1 Updated by Rich Lowe over 6 years ago

  • Category set to cmd - userland programs
  • Status changed from New to In Progress
  • % Done changed from 0 to 50
  • Tags deleted (needs-triage)

#2 Updated by Rich Lowe over 6 years ago

  • Status changed from In Progress to Resolved
  • % Done changed from 50 to 100

Resolved in r13438 commit:084a34091b25

Also available in: Atom