dynrelro section for read-only dynamic symbols copied into executable

Variables defined in shared libraries are copied into an executable's
.bss section when code in the executable is non-PIC and thus would
require dynamic text relocations to access the variable directly in
the shared library.  Recent x86 toolchains also copy variables into
the executable to gain a small speed improvement.

The problem is that if the variable was originally read-only, the copy
in .bss is writable, potentially opening a security hole.  This patch
cures that problem by putting the copy in a section that becomes
read-only after ld.so relocation, provided -z relro is in force.

The patch also fixes a microblaze linker segfault on attempting to
use dynamic bss variables.

bfd/
	PR ld/20995
	* elf-bfd.h (struct elf_link_hash_table): Add sdynrelro and
	sreldynrelro.
	(struct elf_backend_data): Add want_dynrelro.
	* elfxx-target.h (elf_backend_want_dynrelro): Define.
	(elfNN_bed): Update initializer.
	* elflink.c (_bfd_elf_create_dynamic_sections): Create
	sdynrelro and sreldynrelro sections.
	* elf32-arm.c (elf32_arm_adjust_dynamic_symbol): Place variables
	copied into the executable from read-only sections into sdynrelro.
	(elf32_arm_size_dynamic_sections): Handle sdynrelro.
	(elf32_arm_finish_dynamic_symbol): Select sreldynrelro for
	dynamic relocs in sdynrelro.
	(elf_backend_want_dynrelro): Define.
	* elf32-hppa.c (elf32_hppa_adjust_dynamic_symbol)
	(elf32_hppa_size_dynamic_sections, elf32_hppa_finish_dynamic_symbol)
	(elf_backend_want_dynrelro): As above.
	* elf32-i386.c (elf_i386_adjust_dynamic_symbol)
	(elf_i386_size_dynamic_sections, elf_i386_finish_dynamic_symbol)
	(elf_backend_want_dynrelro): As above.
	* elf32-metag.c (elf_metag_adjust_dynamic_symbol)
	(elf_metag_size_dynamic_sections, elf_metag_finish_dynamic_symbol)
	(elf_backend_want_dynrelro): As above.
	* elf32-microblaze.c (microblaze_elf_adjust_dynamic_symbol)
	(microblaze_elf_size_dynamic_sections)
	(microblaze_elf_finish_dynamic_symbol)
	(elf_backend_want_dynrelro): As above.
	* elf32-nios2.c (nios2_elf32_finish_dynamic_symbol)
	(nios2_elf32_adjust_dynamic_symbol)
	(nios2_elf32_size_dynamic_sections)
	(elf_backend_want_dynrelro): As above.
	* elf32-or1k.c (or1k_elf_finish_dynamic_symbol)
	(or1k_elf_adjust_dynamic_symbol, or1k_elf_size_dynamic_sections)
	(elf_backend_want_dynrelro): As above.
	* elf32-ppc.c (ppc_elf_adjust_dynamic_symbol)
	(ppc_elf_size_dynamic_sections, ppc_elf_finish_dynamic_symbol)
	(elf_backend_want_dynrelro): As above.
	* elf32-s390.c (elf_s390_adjust_dynamic_symbol)
	(elf_s390_size_dynamic_sections, elf_s390_finish_dynamic_symbol)
	(elf_backend_want_dynrelro): As above.
	* elf32-tic6x.c (elf32_tic6x_adjust_dynamic_symbol)
	(elf32_tic6x_size_dynamic_sections)
	(elf32_tic6x_finish_dynamic_symbol)
	(elf_backend_want_dynrelro): As above.
	* elf32-tilepro.c (tilepro_elf_adjust_dynamic_symbol)
	(tilepro_elf_size_dynamic_sections)
	(tilepro_elf_finish_dynamic_symbol)
	(elf_backend_want_dynrelro): As above.
	* elf64-ppc.c (ppc64_elf_adjust_dynamic_symbol)
	(ppc64_elf_size_dynamic_sections, ppc64_elf_finish_dynamic_symbol)
	(elf_backend_want_dynrelro): As above.
	* elf64-s390.c (elf_s390_adjust_dynamic_symbol)
	(elf_s390_size_dynamic_sections, elf_s390_finish_dynamic_symbol)
	(elf_backend_want_dynrelro): As above.
	* elf64-x86-64.c (elf_x86_64_adjust_dynamic_symbol)
	(elf_x86_64_size_dynamic_sections)
	(elf_x86_64_finish_dynamic_symbol)
	(elf_backend_want_dynrelro): As above.
	* elfnn-aarch64.c (elfNN_aarch64_adjust_dynamic_symbol)
	(elfNN_aarch64_size_dynamic_sections)
	(elfNN_aarch64_finish_dynamic_symbol)
	(elf_backend_want_dynrelro): As above.
	* elfnn-riscv.c (riscv_elf_adjust_dynamic_symbol)
	(riscv_elf_size_dynamic_sections, riscv_elf_finish_dynamic_symbol)
	(elf_backend_want_dynrelro): As above.
	* elfxx-mips.c (_bfd_mips_elf_adjust_dynamic_symbol)
	(_bfd_mips_elf_size_dynamic_sections)
	(_bfd_mips_vxworks_finish_dynamic_symbol): As above.
	* elfxx-sparc.c (_bfd_sparc_elf_adjust_dynamic_symbol)
	(_bfd_sparc_elf_size_dynamic_sections)
	(_bfd_sparc_elf_finish_dynamic_symbol): As above.
	* elfxx-tilegx.c (tilegx_elf_adjust_dynamic_symbol)
	(tilegx_elf_size_dynamic_sections)
	(tilegx_elf_finish_dynamic_symbol): As above.
	* elf32-mips.c (elf_backend_want_dynrelro): Define.
	* elf64-mips.c (elf_backend_want_dynrelro): Define.
	* elf32-sparc.c (elf_backend_want_dynrelro): Define.
	* elf64-sparc.c (elf_backend_want_dynrelro): Define.
	* elf32-tilegx.c (elf_backend_want_dynrelro): Define.
	* elf64-tilegx.c (elf_backend_want_dynrelro): Define.
	* elf32-microblaze.c (microblaze_elf_adjust_dynamic_symbol): Tidy.
	(microblaze_elf_size_dynamic_sections): Handle sdynbss.
	* elf32-nios2.c (nios2_elf32_size_dynamic_sections): Make use
	of linker shortcuts to dynamic sections rather than comparing
	names.  Correctly set "got" flag.
ld/
	PR ld/20995
	* testsuite/ld-arm/farcall-mixed-app-v5.d: Update to suit changed
	stub hash table traversal caused by section id increment.  Accept
	the previous output too.
	* testsuite/ld-arm/farcall-mixed-app.d: Likewise.
	* testsuite/ld-arm/farcall-mixed-lib-v4t.d: Likewise.
	* testsuite/ld-arm/farcall-mixed-lib.d: Likewise.
	* testsuite/ld-elf/pr20995a.s, * testsuite/ld-elf/pr20995b.s,
	* testsuite/ld-elf/pr20995.r: New test.
	* testsuite/ld-elf/elf.exp: Run it.

1 files changed, 26 insertions, 16 deletions

diff --git a/bfd/elf32-microblaze.c b/bfd/elf32-microblaze.c
index 33c6026e85..31527d5a45 100644
--- a/bfd/elf32-microblaze.c
+++ b/bfd/elf32-microblaze.c
@@ -2557,9 +2557,8 @@ microblaze_elf_adjust_dynamic_symbol (struct bfd_link_info *info,
   struct elf32_mb_link_hash_table *htab;
   struct elf32_mb_link_hash_entry * eh;
   struct elf32_mb_dyn_relocs *p;
-  asection *sdynbss, *s;
+  asection *s, *srel;
   unsigned int power_of_two;
-  bfd *dynobj;
 
   htab = elf32_mb_hash_table (info);
   if (htab == NULL)
@@ -2658,11 +2657,19 @@ microblaze_elf_adjust_dynamic_symbol (struct bfd_link_info *info,
   /* We must generate a R_MICROBLAZE_COPY reloc to tell the dynamic linker
      to copy the initial value out of the dynamic object and into the
      runtime process image.  */
-  dynobj = elf_hash_table (info)->dynobj;
-  BFD_ASSERT (dynobj != NULL);
+  if ((h->root.u.def.section->flags & SEC_READONLY) != 0)
+    {
+      s = htab->elf.sdynrelro;
+      srel = htab->elf.sreldynrelro;
+    }
+  else
+    {
+      s = htab->elf.sdynbss;
+      srel = htab->elf.srelbss;
+    }
   if ((h->root.u.def.section->flags & SEC_ALLOC) != 0)
     {
-      htab->elf.srelbss->size += sizeof (Elf32_External_Rela);
+      srel->size += sizeof (Elf32_External_Rela);
       h->needs_copy = 1;
     }
 
@@ -2672,21 +2679,20 @@ microblaze_elf_adjust_dynamic_symbol (struct bfd_link_info *info,
   if (power_of_two > 3)
     power_of_two = 3;
 
-  sdynbss = htab->elf.sdynbss;
   /* Apply the required alignment.  */
-  sdynbss->size = BFD_ALIGN (sdynbss->size, (bfd_size_type) (1 << power_of_two));
-  if (power_of_two > bfd_get_section_alignment (dynobj, sdynbss))
+  s->size = BFD_ALIGN (s->size, (bfd_size_type) (1 << power_of_two));
+  if (power_of_two > s->alignment_power)
     {
-      if (! bfd_set_section_alignment (dynobj, sdynbss, power_of_two))
+      if (!bfd_set_section_alignment (s->owner, s, power_of_two))
 	return FALSE;
     }
 
   /* Define the symbol as being at this point in the section.  */
-  h->root.u.def.section = sdynbss;
-  h->root.u.def.value = sdynbss->size;
+  h->root.u.def.section = s;
+  h->root.u.def.value = s->size;
 
   /* Increment the section size to make room for the symbol.  */
-  sdynbss->size += h->size;
+  s->size += h->size;
   return TRUE;
 }
 
@@ -3050,7 +3056,9 @@ microblaze_elf_size_dynamic_sections (bfd *output_bfd ATTRIBUTE_UNUSED,
         }
       else if (s != htab->elf.splt
 	       && s != htab->elf.sgot
-	       && s != htab->elf.sgotplt)
+	       && s != htab->elf.sgotplt
+	       && s != htab->elf.sdynbss
+	       && s != htab->elf.sdynrelro)
         {
           /* It's not one of our sections, so don't allocate space.  */
           continue;
@@ -3256,14 +3264,15 @@ microblaze_elf_finish_dynamic_symbol (bfd *output_bfd,
 
       BFD_ASSERT (h->dynindx != -1);
 
-      s = bfd_get_linker_section (htab->elf.dynobj, ".rela.bss");
-      BFD_ASSERT (s != NULL);
-
       rela.r_offset = (h->root.u.def.value
                        + h->root.u.def.section->output_section->vma
                        + h->root.u.def.section->output_offset);
       rela.r_info = ELF32_R_INFO (h->dynindx, R_MICROBLAZE_COPY);
       rela.r_addend = 0;
+      if ((h->root.u.def.section->flags & SEC_READONLY) != 0)
+	s = htab->elf.sreldynrelro;
+      else
+	s = htab->elf.srelbss;
       loc = s->contents + s->reloc_count++ * sizeof (Elf32_External_Rela);
       bfd_elf32_swap_reloca_out (output_bfd, &rela, loc);
     }
@@ -3439,6 +3448,7 @@ microblaze_elf_add_symbol_hook (bfd *abfd,
 #define elf_backend_want_got_plt    		1
 #define elf_backend_plt_readonly    		1
 #define elf_backend_got_header_size 		12
+#define elf_backend_want_dynrelro		1
 #define elf_backend_rela_normal     		1
 #define elf_backend_dtrel_excludes_plt		1