dynrelro section for read-only dynamic symbols copied into executable

Variables defined in shared libraries are copied into an executable's
.bss section when code in the executable is non-PIC and thus would
require dynamic text relocations to access the variable directly in
the shared library.  Recent x86 toolchains also copy variables into
the executable to gain a small speed improvement.

The problem is that if the variable was originally read-only, the copy
in .bss is writable, potentially opening a security hole.  This patch
cures that problem by putting the copy in a section that becomes
read-only after ld.so relocation, provided -z relro is in force.

The patch also fixes a microblaze linker segfault on attempting to
use dynamic bss variables.

bfd/
	PR ld/20995
	* elf-bfd.h (struct elf_link_hash_table): Add sdynrelro and
	sreldynrelro.
	(struct elf_backend_data): Add want_dynrelro.
	* elfxx-target.h (elf_backend_want_dynrelro): Define.
	(elfNN_bed): Update initializer.
	* elflink.c (_bfd_elf_create_dynamic_sections): Create
	sdynrelro and sreldynrelro sections.
	* elf32-arm.c (elf32_arm_adjust_dynamic_symbol): Place variables
	copied into the executable from read-only sections into sdynrelro.
	(elf32_arm_size_dynamic_sections): Handle sdynrelro.
	(elf32_arm_finish_dynamic_symbol): Select sreldynrelro for
	dynamic relocs in sdynrelro.
	(elf_backend_want_dynrelro): Define.
	* elf32-hppa.c (elf32_hppa_adjust_dynamic_symbol)
	(elf32_hppa_size_dynamic_sections, elf32_hppa_finish_dynamic_symbol)
	(elf_backend_want_dynrelro): As above.
	* elf32-i386.c (elf_i386_adjust_dynamic_symbol)
	(elf_i386_size_dynamic_sections, elf_i386_finish_dynamic_symbol)
	(elf_backend_want_dynrelro): As above.
	* elf32-metag.c (elf_metag_adjust_dynamic_symbol)
	(elf_metag_size_dynamic_sections, elf_metag_finish_dynamic_symbol)
	(elf_backend_want_dynrelro): As above.
	* elf32-microblaze.c (microblaze_elf_adjust_dynamic_symbol)
	(microblaze_elf_size_dynamic_sections)
	(microblaze_elf_finish_dynamic_symbol)
	(elf_backend_want_dynrelro): As above.
	* elf32-nios2.c (nios2_elf32_finish_dynamic_symbol)
	(nios2_elf32_adjust_dynamic_symbol)
	(nios2_elf32_size_dynamic_sections)
	(elf_backend_want_dynrelro): As above.
	* elf32-or1k.c (or1k_elf_finish_dynamic_symbol)
	(or1k_elf_adjust_dynamic_symbol, or1k_elf_size_dynamic_sections)
	(elf_backend_want_dynrelro): As above.
	* elf32-ppc.c (ppc_elf_adjust_dynamic_symbol)
	(ppc_elf_size_dynamic_sections, ppc_elf_finish_dynamic_symbol)
	(elf_backend_want_dynrelro): As above.
	* elf32-s390.c (elf_s390_adjust_dynamic_symbol)
	(elf_s390_size_dynamic_sections, elf_s390_finish_dynamic_symbol)
	(elf_backend_want_dynrelro): As above.
	* elf32-tic6x.c (elf32_tic6x_adjust_dynamic_symbol)
	(elf32_tic6x_size_dynamic_sections)
	(elf32_tic6x_finish_dynamic_symbol)
	(elf_backend_want_dynrelro): As above.
	* elf32-tilepro.c (tilepro_elf_adjust_dynamic_symbol)
	(tilepro_elf_size_dynamic_sections)
	(tilepro_elf_finish_dynamic_symbol)
	(elf_backend_want_dynrelro): As above.
	* elf64-ppc.c (ppc64_elf_adjust_dynamic_symbol)
	(ppc64_elf_size_dynamic_sections, ppc64_elf_finish_dynamic_symbol)
	(elf_backend_want_dynrelro): As above.
	* elf64-s390.c (elf_s390_adjust_dynamic_symbol)
	(elf_s390_size_dynamic_sections, elf_s390_finish_dynamic_symbol)
	(elf_backend_want_dynrelro): As above.
	* elf64-x86-64.c (elf_x86_64_adjust_dynamic_symbol)
	(elf_x86_64_size_dynamic_sections)
	(elf_x86_64_finish_dynamic_symbol)
	(elf_backend_want_dynrelro): As above.
	* elfnn-aarch64.c (elfNN_aarch64_adjust_dynamic_symbol)
	(elfNN_aarch64_size_dynamic_sections)
	(elfNN_aarch64_finish_dynamic_symbol)
	(elf_backend_want_dynrelro): As above.
	* elfnn-riscv.c (riscv_elf_adjust_dynamic_symbol)
	(riscv_elf_size_dynamic_sections, riscv_elf_finish_dynamic_symbol)
	(elf_backend_want_dynrelro): As above.
	* elfxx-mips.c (_bfd_mips_elf_adjust_dynamic_symbol)
	(_bfd_mips_elf_size_dynamic_sections)
	(_bfd_mips_vxworks_finish_dynamic_symbol): As above.
	* elfxx-sparc.c (_bfd_sparc_elf_adjust_dynamic_symbol)
	(_bfd_sparc_elf_size_dynamic_sections)
	(_bfd_sparc_elf_finish_dynamic_symbol): As above.
	* elfxx-tilegx.c (tilegx_elf_adjust_dynamic_symbol)
	(tilegx_elf_size_dynamic_sections)
	(tilegx_elf_finish_dynamic_symbol): As above.
	* elf32-mips.c (elf_backend_want_dynrelro): Define.
	* elf64-mips.c (elf_backend_want_dynrelro): Define.
	* elf32-sparc.c (elf_backend_want_dynrelro): Define.
	* elf64-sparc.c (elf_backend_want_dynrelro): Define.
	* elf32-tilegx.c (elf_backend_want_dynrelro): Define.
	* elf64-tilegx.c (elf_backend_want_dynrelro): Define.
	* elf32-microblaze.c (microblaze_elf_adjust_dynamic_symbol): Tidy.
	(microblaze_elf_size_dynamic_sections): Handle sdynbss.
	* elf32-nios2.c (nios2_elf32_size_dynamic_sections): Make use
	of linker shortcuts to dynamic sections rather than comparing
	names.  Correctly set "got" flag.
ld/
	PR ld/20995
	* testsuite/ld-arm/farcall-mixed-app-v5.d: Update to suit changed
	stub hash table traversal caused by section id increment.  Accept
	the previous output too.
	* testsuite/ld-arm/farcall-mixed-app.d: Likewise.
	* testsuite/ld-arm/farcall-mixed-lib-v4t.d: Likewise.
	* testsuite/ld-arm/farcall-mixed-lib.d: Likewise.
	* testsuite/ld-elf/pr20995a.s, * testsuite/ld-elf/pr20995b.s,
	* testsuite/ld-elf/pr20995.r: New test.
	* testsuite/ld-elf/elf.exp: Run it.

9 files changed, 88 insertions, 32 deletions

diff --git a/ld/ChangeLog b/ld/ChangeLog
index a9f157e..1b8f59a 100644
--- a/ld/ChangeLog
+++ b/ld/ChangeLog
@@ -1,5 +1,18 @@
 2016-12-26  Alan Modra  <amodra@gmail.com>
 
+	PR ld/20995
+	* testsuite/ld-arm/farcall-mixed-app-v5.d: Update to suit changed
+	stub hash table traversal caused by section id increment.  Accept
+	the previous output too.
+	* testsuite/ld-arm/farcall-mixed-app.d: Likewise.
+	* testsuite/ld-arm/farcall-mixed-lib-v4t.d: Likewise.
+	* testsuite/ld-arm/farcall-mixed-lib.d: Likewise.
+	* testsuite/ld-elf/pr20995a.s, * testsuite/ld-elf/pr20995b.s,
+	* testsuite/ld-elf/pr20995.r: New test.
+	* testsuite/ld-elf/elf.exp: Run it.
+
+2016-12-26  Alan Modra  <amodra@gmail.com>
+
 	* scripttempl/elf.sc: Don't use $BSS_NAME in .dynbss.
 
 2016-12-23  Tristan Gingold  <gingold@adacore.com>
diff --git a/ld/testsuite/ld-arm/farcall-mixed-app-v5.d b/ld/testsuite/ld-arm/farcall-mixed-app-v5.d
index b570bad..af44198 100644
--- a/ld/testsuite/ld-arm/farcall-mixed-app-v5.d
+++ b/ld/testsuite/ld-arm/farcall-mixed-app-v5.d
@@ -50,8 +50,8 @@ Disassembly of section .far_arm:
 .* <app_func>:
  .*:	e1a0c00d 	mov	ip, sp
  .*:	e92dd800 	push	{fp, ip, lr, pc}
- .*:	eb0000.. 	bl	.* <__lib_func1_veneer>
- .*:	eb0000.. 	bl	.* <__lib_func2_veneer>
+ .*:	eb00000(6|8) 	bl	.* <__lib_func1_veneer>
+ .*:	eb00000(7|5) 	bl	.* <__lib_func2_veneer>
  .*:	e89d6800 	ldm	sp, {fp, sp, lr}
  .*:	e12fff1e 	bx	lr
  .*:	e1a00000 	nop			; \(mov r0, r0\)
@@ -61,12 +61,12 @@ Disassembly of section .far_arm:
  .*:	e12fff1e 	bx	lr
 #...
 
-.* <__lib_func1_veneer>:
- .*:	e51ff004 	ldr	pc, \[pc, #-4\]	; .* <__lib_func1_veneer\+0x4>
- .*:	000081e8 	.word	0x000081e8
-.* <__lib_func2_veneer>:
- .*:	e51ff004 	ldr	pc, \[pc, #-4\]	; .* <__lib_func2_veneer\+0x4>
- .*:	000081dc 	.word	0x000081dc
+.* <__lib_func(1|2)_veneer>:
+ .*:	e51ff004 	ldr	pc, \[pc, #-4\]	; .* <__lib_func(1|2)_veneer\+0x4>
+ .*:	000081(e8|dc) 	.word	0x000081(e8|dc)
+.* <__lib_func(2|1)_veneer>:
+ .*:	e51ff004 	ldr	pc, \[pc, #-4\]	; .* <__lib_func(2|1)_veneer\+0x4>
+ .*:	000081(dc|e8) 	.word	0x000081(dc|e8)
 
 Disassembly of section .far_thumb:
 
diff --git a/ld/testsuite/ld-arm/farcall-mixed-app.d b/ld/testsuite/ld-arm/farcall-mixed-app.d
index 9fa97dc..f3be54f 100644
--- a/ld/testsuite/ld-arm/farcall-mixed-app.d
+++ b/ld/testsuite/ld-arm/farcall-mixed-app.d
@@ -52,8 +52,8 @@ Disassembly of section .far_arm:
 .* <app_func>:
  .*:	e1a0c00d 	mov	ip, sp
  .*:	e92dd800 	push	{fp, ip, lr, pc}
- .*:	eb000006 	bl	.* <__lib_func1_veneer>
- .*:	eb000007 	bl	.* <__lib_func2_veneer>
+ .*:	eb00000(6|8) 	bl	.* <__lib_func1_veneer>
+ .*:	eb00000(7|5) 	bl	.* <__lib_func2_veneer>
  .*:	e89d6800 	ldm	sp, {fp, sp, lr}
  .*:	e12fff1e 	bx	lr
  .*:	e1a00000 	nop			; \(mov r0, r0\)
@@ -63,12 +63,12 @@ Disassembly of section .far_arm:
  .*:	e12fff1e 	bx	lr
 #...
 
-.* <__lib_func1_veneer>:
- .*:	e51ff004 	ldr	pc, \[pc, #-4\]	; .* <__lib_func1_veneer\+0x4>
- .*:	000081ec 	.word	0x000081ec
-.* <__lib_func2_veneer>:
- .*:	e51ff004 	ldr	pc, \[pc, #-4\]	; .* <__lib_func2_veneer\+0x4>
- .*:	000081e0 	.word	0x000081e0
+.* <__lib_func(1|2)_veneer>:
+ .*:	e51ff004 	ldr	pc, \[pc, #-4\]	; .* <__lib_func(1|2)_veneer\+0x4>
+ .*:	000081e(c|0) 	.word	0x000081e(c|0)
+.* <__lib_func(2|1)_veneer>:
+ .*:	e51ff004 	ldr	pc, \[pc, #-4\]	; .* <__lib_func(2|1)_veneer\+0x4>
+ .*:	000081e(0|c) 	.word	0x000081e(0|c)
 
 Disassembly of section .far_thumb:
 
diff --git a/ld/testsuite/ld-arm/farcall-mixed-lib-v4t.d b/ld/testsuite/ld-arm/farcall-mixed-lib-v4t.d
index fa52ad1..83b15a0 100644
--- a/ld/testsuite/ld-arm/farcall-mixed-lib-v4t.d
+++ b/ld/testsuite/ld-arm/farcall-mixed-lib-v4t.d
@@ -87,24 +87,24 @@ Disassembly of section .text:
 	...
 
 .* <__real_lib_func3>:
- .*:	f000 f80e 	bl	2000390 <__app_func_from_thumb>
- .*:	f000 f804 	bl	2000380 <__app_func_weak_from_thumb>
+ .*:	f000 f80(e|6) 	bl	.* <__app_func_from_thumb>
+ .*:	f000 f80(4|c) 	bl	.* <__app_func_weak_from_thumb>
  .*:	4770      	bx	lr
 #...
 
-.* <__app_func_weak_from_thumb>:
+.* <__app_func(_weak)?_from_thumb>:
  .*:	4778      	bx	pc
  .*:	46c0      	nop			; \(mov r8, r8\)
- .*:	e59fc000 	ldr	ip, \[pc\]	; 200038c <__app_func_weak_from_thumb\+0xc>
+ .*:	e59fc000 	ldr	ip, \[pc\]	; 200038c <__app_func(_weak)?_from_thumb\+0xc>
  .*:	e08cf00f 	add	pc, ip, pc
- .*:	fdffff28 	.word	0xfdffff28
+ .*:	fdffff(2|1)8 	.word	0xfdffff(2|1)8
 
-.* <__app_func_from_thumb>:
+.* <__app_func(_weak)?_from_thumb>:
  .*:	4778      	bx	pc
  .*:	46c0      	nop			; \(mov r8, r8\)
- .*:	e59fc000 	ldr	ip, \[pc\]	; 200039c <__app_func_from_thumb\+0xc>
+ .*:	e59fc000 	ldr	ip, \[pc\]	; 200039c <__app_func(_weak)?_from_thumb\+0xc>
  .*:	e08cf00f 	add	pc, ip, pc
- .*:	fdffff08 	.word	0xfdffff08
+ .*:	fdffff(0|1)8 	.word	0xfdffff(0|1)8
 
 .* <lib_func3>:
  .*:	e59fc004 	ldr	ip, \[pc, #4\]	; 20003ac <lib_func3\+0xc>
diff --git a/ld/testsuite/ld-arm/farcall-mixed-lib.d b/ld/testsuite/ld-arm/farcall-mixed-lib.d
index ad7352b..d256477 100644
--- a/ld/testsuite/ld-arm/farcall-mixed-lib.d
+++ b/ld/testsuite/ld-arm/farcall-mixed-lib.d
@@ -72,18 +72,18 @@ Disassembly of section .text:
 	...
 
 .* <lib_func3>:
- .*:	f000 e80c 	blx	200037c <__app_func_from_thumb>
- .*:	f000 e804 	blx	2000370 <__app_func_weak_from_thumb>
+ .*:	f000 e80(c|6) 	blx	.* <__app_func_from_thumb>
+ .*:	f000 e80(4|a) 	blx	.* <__app_func_weak_from_thumb>
  .*:	4770      	bx	lr
 #...
 
-.* <__app_func_weak_from_thumb>:
- .*:	e59fc000 	ldr	ip, \[pc\]	; 2000378 <__app_func_weak_from_thumb\+0x8>
+.* <__app_func(_weak)?_from_thumb>:
+ .*:	e59fc000 	ldr	ip, \[pc\]	; 2000378 <__app_func(_weak)?_from_thumb\+0x8>
  .*:	e08ff00c 	add	pc, pc, ip
- .*:	fdffff34 	.word	0xfdffff34
+ .*:	fdffff(34|28) 	.word	0xfdffff(34|28)
 
-.* <__app_func_from_thumb>:
- .*:	e59fc000 	ldr	ip, \[pc\]	; 2000384 <__app_func_from_thumb\+0x8>
+.* <__app_func(_weak)?_from_thumb>:
+ .*:	e59fc000 	ldr	ip, \[pc\]	; 2000384 <__app_func(_weak)?_from_thumb\+0x8>
  .*:	e08ff00c 	add	pc, pc, ip
- .*:	fdffff1c 	.word	0xfdffff1c
+ .*:	fdffff(1c|28) 	.word	0xfdffff(1c|28)
 	...
diff --git a/ld/testsuite/ld-elf/elf.exp b/ld/testsuite/ld-elf/elf.exp
index f93ad46..9b1fbeb 100644
--- a/ld/testsuite/ld-elf/elf.exp
+++ b/ld/testsuite/ld-elf/elf.exp
@@ -127,6 +127,20 @@ if { [check_shared_lib_support] } then {
 	    {symbolic-func.s} {{readelf {-r --wide} symbolic-func.r}}
 	    "symbolic-func.so"}
     }
+    # xfail on tic6x due to non-PIC/non-PID warnings
+    setup_xfail "tic6x-*-*"
+    run_ld_link_tests {
+	{"Build pr20995.so"
+	    "-shared" "" ""
+	    {pr20995b.s} {} "pr20995.so"}
+    }
+    # These targets don't copy dynamic variables into .bss.
+    setup_xfail "alpha-*-*" "bfin-*-*" "ia64-*-*" "xtensa-*-*"
+    run_ld_link_tests {
+	{"pr20995"
+	    "" "tmpdir/pr20995.so" ""
+	    {pr20995a.s} {{readelf {-S --wide} pr20995.r}} "pr20995"}
+    }
 }
 
 set test_list [lsort [glob -nocomplain $srcdir/$subdir/*.d]]
diff --git a/ld/testsuite/ld-elf/pr20995.r b/ld/testsuite/ld-elf/pr20995.r
new file mode 100644
index 0000000..7336de6
--- /dev/null
+++ b/ld/testsuite/ld-elf/pr20995.r
@@ -0,0 +1,5 @@
+#...
+.* \.data\.rel\.ro +PROGBITS +[^ ]+ [^ ]+ [^ ]*[1-9a-f]0* .*
+#...
+.* \.bss +NOBITS +[^ ]+ [^ ]+ [^ ]*[1-9a-f]0* .*
+#...
diff --git a/ld/testsuite/ld-elf/pr20995a.s b/ld/testsuite/ld-elf/pr20995a.s
new file mode 100644
index 0000000..8da589c
--- /dev/null
+++ b/ld/testsuite/ld-elf/pr20995a.s
@@ -0,0 +1,11 @@
+	.text
+	.global start
+start:
+	.global _start
+_start:
+	.global __start
+__start:
+	.global main
+main:
+	.dc.a rw
+	.dc.a ro
diff --git a/ld/testsuite/ld-elf/pr20995b.s b/ld/testsuite/ld-elf/pr20995b.s
new file mode 100644
index 0000000..7ff76ee
--- /dev/null
+++ b/ld/testsuite/ld-elf/pr20995b.s
@@ -0,0 +1,13 @@
+	.data
+	.type rw,%object
+	.globl rw
+rw:
+	.dc.a 0
+	.size rw, . - rw
+
+	.text
+	.type ro,%object
+	.globl ro
+ro:
+	.dc.a 0
+	.size ro, . - ro