https://sourceware.org/bugzilla/show_bug.cgi?id=34585
Bug ID: 34585
Summary: ld.bfd merges type/size from overridden weak DSO
symbol into regular definition
Product: binutils
Version: 2.47
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: binutils
Assignee: unassigned at sourceware dot org
Reporter: xusheng142 at gmail dot com
Target Milestone: ---
Created attachment 16972
--> https://sourceware.org/bugzilla/attachment.cgi?id=16972&action=edit
Minimal reproducer and observed outputs for ld.bfd ELF symbol metadata merge
issue
# Sourceware Bugzilla Draft
Product: binutils
Component: ld
Severity: normal
Version: 2.47
Host: x86_64-pc-linux-gnu
Target: x86_64-pc-linux-gnu
## Title
ld.bfd copies type and size from an overridden weak DSO symbol onto a regular
STT_NOTYPE definition
## Description
I believe ld.bfd can emit inconsistent ELF symbol metadata when a regular input
object definition overrides a weak definition from an input DSO.
In the attached reproducer:
- `crti_like.o` defines `_fini` in `.fini` as a global regular symbol. It has
no
`.type` or `.size`, so it is `STT_NOTYPE`, size 0.
- `crtn_like.o` contributes two more bytes to `.fini`.
- `libweak_fini.so` defines weak `_fini` as `STT_FUNC`, size 5.
- The final shared object is linked as:
```sh
ld.bfd -shared -o out-ld.bfd.so crti_like.o libweak_fini.so crtn_like.o
```
ld.bfd selects the regular definition for `_fini`'s address, binding, and
section, but appears to copy `STT_FUNC` and `st_size=5` from the overridden
weak
DSO definition. The output `.fini` section is only three bytes.
This creates a hybrid symbol whose declared extent does not match the selected
definition.
## Reproducer
Run:
```sh
bash repro/repro.sh
```
Or, to test a freshly built upstream ld:
```sh
LD_BFD=/path/to/binutils/ld/ld-new bash repro/repro.sh
```
The script builds all inputs from the attached assembly files and writes the
complete output to `repro/build/report.txt`, or to `$REPORT` if that variable
is set.
## Observed Output
Preliminary local run with Ubuntu binutils 2.42:
```text
input crti_like.o:
0 NOTYPE GLOBAL DEFAULT .fini _fini
input libweak_fini.so:
5 FUNC WEAK DEFAULT .text _fini
ld.bfd output:
0000000000001000 5 FUNC GLOBAL DEFAULT .fini _fini
ld.bfd output section:
.fini size = 0x3
gold output:
0000000000000298 0 NOTYPE GLOBAL DEFAULT .fini _fini
mold output:
00000000000012c4 0 NOTYPE GLOBAL DEFAULT .fini _fini
```
The same reproducer also fails with upstream binutils 2.47:
```text
ld.bfd output with /tmp/verilink-binutils-247.Hk5Xir/build/ld/ld-new:
GNU ld (GNU Binutils) 2.47.20260726
0000000000001000 5 FUNC GLOBAL DEFAULT .fini _fini
ld.bfd output section:
.fini size = 0x3
```
Full local outputs:
- `repro/build/report-system-binutils-2.42.txt`
- `repro/build/report-upstream-binutils-2.47.txt`
## Expected Behavior
The output `_fini` symbol should keep the metadata of the selected regular
definition, or at least should not combine address/section/binding from the
regular definition with type/size from the overridden weak DSO definition.
In this case, the expected output is `STT_NOTYPE`, size 0, matching the regular
input definition selected by the linker.
## Impact
ld.bfd emits internally inconsistent ELF symbol metadata. In actual musl-gcc
outputs observed during evaluation, `_fini` can have a declared five-byte
extent
although the selected regular definition and the output `.fini` section contain
only three bytes. The tested programs still start successfully; I am not
claiming a runtime crash or security impact. The demonstrated impact is on ELF
validators, binary analysis, symbolization, and tools that rely on symbol
extents.
## Environment
- preliminary ld.bfd version:
GNU ld (GNU Binutils for Ubuntu) 2.42, Ubuntu package 2.42-4ubuntu2.10
- upstream ld.bfd version:
GNU ld (GNU Binutils) 2.47.20260726
- upstream binutils tarball:
`/tmp/verilink-binutils-247.Hk5Xir/binutils-2.47.tar.xz`
- upstream binutils tarball sha256:
`154ab23b60070e8f27013c22977f1129425d67d1e8acd6e13010e617811e4cff`
- configure command:
`/tmp/verilink-binutils-247.Hk5Xir/binutils-2.47/configure --disable-nls
--disable-werror --disable-gprofng --disable-gdb --disable-gdbserver
--disable-sim --disable-gas --disable-binutils --disable-libctf --enable-ld`
- host OS and architecture:
Ubuntu 24.04.4 LTS
Linux Hihi142-Linux 7.0.0-30-generic x86_64 GNU/Linux
- assembler version: GNU assembler (GNU Binutils for Ubuntu) 2.42
- readelf version: GNU readelf (GNU Binutils for Ubuntu) 2.42
- compiler version: gcc (Ubuntu 13.3.0-6ubuntu2~24.04.1) 13.3.0
--
You are receiving this mail because:
You are on the CC list for the bug.
