GOLD: Stop an abort triggered by running dwp on a file with no dwo links. (#2192226)

Tests set their "framework" key correctly to "beakerlib", the correct setting for plan is therefore "tmt". This was not needed until recently, the old form was deprecated but still supported by Testing Farm, but not anymore.

binutils-CVE-38128-dwarf-abbrev-parsing.patch

@@ -0,0 +1,15 @@
+--- binutils.orig/binutils/dwarf.c	2022-08-31 11:58:08.918685348 +0100
++++ binutils-2.39/binutils/dwarf.c	2022-08-31 15:24:13.881865797 +0100
+@@ -6365,7 +6365,11 @@ display_debug_abbrev (struct dwarf_secti
+ 	  list->start_of_next_abbrevs = start;
+ 	}
+       else
+-	start = list->start_of_next_abbrevs;
++	{
++	  if (start == list->start_of_next_abbrevs)
++	    break;
++	  start = list->start_of_next_abbrevs;
++	}
+ 
+       if (list->first_abbrev == NULL)
+ 	continue;

binutils-add-splay-tree-for-info_ptr.patch

@@ -0,0 +1,129 @@
+diff -rup binutils.orig/bfd/dwarf2.c binutils-2.38/bfd/dwarf2.c
+--- binutils.orig/bfd/dwarf2.c	2022-08-25 17:21:26.955360836 +0200
++++ binutils-2.38/bfd/dwarf2.c	2022-08-25 18:03:57.766380659 +0200
+@@ -36,6 +36,7 @@
+ #include "elf-bfd.h"
+ #include "dwarf2.h"
+ #include "hashtab.h"
++#include "splay-tree.h"
+ 
+ /* The data in the .debug_line statement prologue looks like this.  */
+ 
+@@ -82,6 +83,45 @@ struct adjusted_section
+   bfd_vma adj_vma;
+ };
+ 
++struct addr_range
++{
++  bfd_byte *start;
++  bfd_byte *end;
++};
++
++/* Return true if address range do intersect.  */
++
++static bool
++addr_range_intersects (struct addr_range *r1, struct addr_range *r2)
++{
++  return (r1->start <= r2->start && r2->start < r1->end)
++    || (r1->start <= (r2->end - 1) && (r2->end - 1) < r1->end);
++}
++
++/* Compare function for splay tree of addr_ranges.  */
++
++static int
++splay_tree_compare_addr_range (splay_tree_key xa, splay_tree_key xb)
++{
++  struct addr_range *r1 = (struct addr_range *) xa;
++  struct addr_range *r2 = (struct addr_range *) xb;
++
++  if (addr_range_intersects (r1, r2) || addr_range_intersects (r2, r1))
++    return 0;
++  else if (r1->end <= r2->start)
++    return -1;
++  else
++    return 1;
++}
++
++/* Splay tree release function for keys (addr_range).  */
++
++static void
++splay_tree_free_addr_range (splay_tree_key key)
++{
++  free ((struct addr_range *)key);
++}
++
+ struct dwarf2_debug_file
+ {
+   /* The actual bfd from which debug info was loaded.  Might be
+@@ -2997,16 +3037,12 @@ find_abstract_instance (struct comp_unit
+       else
+ 	{
+ 	  /* Check other CUs to see if they contain the abbrev.  */
+-	  struct comp_unit *u;
+-
+-	  for (u = unit->prev_unit; u != NULL; u = u->prev_unit)
+-	    if (info_ptr >= u->info_ptr_unit && info_ptr < u->end_ptr)
+-	      break;
+-
+-	  if (u == NULL)
+-	    for (u = unit->next_unit; u != NULL; u = u->next_unit)
+-	      if (info_ptr >= u->info_ptr_unit && info_ptr < u->end_ptr)
+-		break;
++	  struct comp_unit *u = NULL;
++	  struct addr_range range = { info_ptr, info_ptr };
++	  splay_tree_node v = splay_tree_lookup (unit->file->comp_unit_tree,
++						 (splay_tree_key)&range);
++	  if (v != NULL)
++	    u = (struct comp_unit *)v->value;
+ 
+ 	  if (attr_ptr->form == DW_FORM_ref_addr)
+ 	    while (u == NULL)
+@@ -4910,6 +4946,22 @@ stash_comp_unit (struct dwarf2_debug *st
+ 						info_ptr_unit, offset_size);
+       if (each)
+ 	{
++	  if (file->comp_unit_tree == NULL)
++	    file->comp_unit_tree
++	      = splay_tree_new (splay_tree_compare_addr_range,
++				splay_tree_free_addr_range, NULL);
++
++	  struct addr_range *r
++	    = (struct addr_range *)bfd_malloc (sizeof (struct addr_range));
++	  r->start = each->info_ptr_unit;
++	  r->end = each->end_ptr;
++	  splay_tree_node v = splay_tree_lookup (file->comp_unit_tree,
++						 (splay_tree_key)r);
++	  if (v != NULL || r->end <= r->start)
++	    abort ();
++	  splay_tree_insert (file->comp_unit_tree, (splay_tree_key)r,
++			     (splay_tree_value)each);
++
+ 	  if (file->all_comp_units)
+ 	    file->all_comp_units->prev_unit = each;
+ 	  else
+@@ -5361,6 +5413,8 @@ _bfd_dwarf2_cleanup_debug_info (bfd *abf
+ 	  free (file->line_table->dirs);
+ 	}
+       htab_delete (file->abbrev_offsets);
++      if (file->comp_unit_tree != NULL)
++	splay_tree_delete (file->comp_unit_tree);
+ 
+       free (file->dwarf_line_str_buffer);
+       free (file->dwarf_str_buffer);
+Only in binutils-2.38/bfd: dwarf2.c.orig
+Only in binutils-2.38/bfd: dwarf2.c.rej
+Only in binutils-2.38: binutils-add-splay-tree-for-info_ptr.patch
+diff -rup binutils.orig/bfd/dwarf2.c binutils-2.38/bfd/dwarf2.c
+--- binutils.orig/bfd/dwarf2.c	2022-09-07 10:41:11.992242841 +0200
++++ binutils-2.38/bfd/dwarf2.c	2022-09-07 10:44:29.268266746 +0200
+@@ -187,6 +187,9 @@ struct dwarf2_debug_file
+ 
+   /* Hash table to map offsets to decoded abbrevs.  */
+   htab_t abbrev_offsets;
++
++  /* Splay tree to map info_ptr address to compilation units.  */
++  splay_tree comp_unit_tree;
+ };
+ 
+ struct dwarf2_debug
+

binutils-gold-empty-dwp.patch

@@ -0,0 +1,11 @@
+--- binutils.orig/gold/dwp.cc	2023-05-02 13:26:44.075148082 +0100
++++ binutils-2.40/gold/dwp.cc	2023-05-02 13:27:16.189130127 +0100
+@@ -2418,6 +2418,8 @@ main(int argc, char** argv)
+     {
+       Dwo_file exe_file(exe_filename);
+       exe_file.read_executable(&files);
++      if (files.empty())
++        gold_fatal(_("Could not find any dwo links in specified EXE"));
+     }
+ 
+   // Add any additional files listed on command line.

binutils-readelf-no-sections.patch

@@ -0,0 +1,29 @@
+--- binutils.orig/binutils/readelf.c	2022-10-03 13:20:42.707527855 +0100
++++ binutils-2.39/binutils/readelf.c	2022-10-03 13:21:25.785436781 +0100
+@@ -6357,6 +6357,13 @@ get_32bit_section_headers (Filedata * fi
+   /* PR binutils/17531: Cope with unexpected section header sizes.  */
+   if (size == 0 || num == 0)
+     return false;
++
++  /* The section header cannot be at the start of the file - that is
++     where the ELF file header is located.  A file with absolutely no
++     sections in it will use a shoff of 0.  */
++  if (filedata->file_header.e_shoff == 0)
++    return false;
++
+   if (size < sizeof * shdrs)
+     {
+       if (! probe)
+@@ -6421,6 +6428,12 @@ get_64bit_section_headers (Filedata * fi
+   if (size == 0 || num == 0)
+     return false;
+ 
++  /* The section header cannot be at the start of the file - that is
++     where the ELF file header is located.  A file with absolutely no
++     sections in it will use a shoff of 0.  */
++  if (filedata->file_header.e_shoff == 0)
++    return false;
++
+   if (size < sizeof * shdrs)
+     {
+       if (! probe)

binutils-reduce-O-n2-performance-overhead-when-parsing-DWARF.patch

@@ -0,0 +1,184 @@
+From 30cbd32aec30b4bc13427bbd87c4c63c739d4578 Mon Sep 17 00:00:00 2001
+From: Steiner H Gunderson <steinar+sourceware@gunderson.no>
+Date: Mon, 21 Mar 2022 14:29:12 +0000
+Subject: [PATCH] Reduce O(n2) performance overhead when parsing DWARF unit
+ information.
+
+	PR 28978
+	* dwarf2.c (scan_unit_for_symbols): When performing second pass,
+	check to see if the function or variable being processed is the
+	same as the previous one.
+---
+ bfd/ChangeLog |  7 ++++
+ bfd/dwarf2.c  | 93 +++++++++++++++++++++++++++++++++------------------
+ 2 files changed, 67 insertions(+), 33 deletions(-)
+
+//diff --git a/bfd/ChangeLog b/bfd/ChangeLog
+//index 6ac8b96c57a..fcf5abad5a1 100644
+//--- a/bfd/ChangeLog
+//+++ b/bfd/ChangeLog
+//@@ -1,3 +1,10 @@
+//+2022-03-21  Steiner H Gunderson  <steinar+sourceware@gunderson.no>
+//+
+//+	PR 28978
+//+	* dwarf2.c (scan_unit_for_symbols): When performing second pass,
+//+	check to see if the function or variable being processed is the
+//+	same as the previous one.
+//+
+ 2022-03-18  Viorel Preoteasa  <viorel.preoteasa@gmail.com>
+ 
+ 	PR 28924
+diff --git a/bfd/dwarf2.c b/bfd/dwarf2.c
+index fdf071c36e9..bb176798f9a 100644
+--- a/bfd/dwarf2.c
++++ b/bfd/dwarf2.c
+@@ -3293,6 +3293,36 @@ lookup_var_by_offset (bfd_uint64_t offset, struct varinfo * table)
+ 
+ /* DWARF2 Compilation unit functions.  */
+ 
++static struct funcinfo *
++reverse_funcinfo_list (struct funcinfo *head)
++{
++  struct funcinfo *rhead;
++  struct funcinfo *temp;
++
++  for (rhead = NULL; head; head = temp)
++    {
++      temp = head->prev_func;
++      head->prev_func = rhead;
++      rhead = head;
++    }
++  return rhead;
++}
++
++static struct varinfo *
++reverse_varinfo_list (struct varinfo *head)
++{
++  struct varinfo *rhead;
++  struct varinfo *temp;
++
++  for (rhead = NULL; head; head = temp)
++    {
++      temp = head->prev_var;
++      head->prev_var = rhead;
++      rhead = head;
++    }
++  return rhead;
++}
++
+ /* Scan over each die in a comp. unit looking for functions to add
+    to the function table and variables to the variable table.  */
+ 
+@@ -3308,7 +3338,9 @@ scan_unit_for_symbols (struct comp_unit *unit)
+     struct funcinfo *func;
+   } *nested_funcs;
+   int nested_funcs_size;
+-
++  struct funcinfo *last_func;
++  struct varinfo *last_var;
++  
+   /* Maintain a stack of in-scope functions and inlined functions, which we
+      can use to set the caller_func field.  */
+   nested_funcs_size = 32;
+@@ -3442,10 +3474,16 @@ scan_unit_for_symbols (struct comp_unit *unit)
+ 	}
+     }
+ 
++  unit->function_table = reverse_funcinfo_list (unit->function_table);
++  unit->variable_table = reverse_varinfo_list (unit->variable_table);
++
+   /* This is the second pass over the abbrevs.  */      
+   info_ptr = unit->first_child_die_ptr;
+   nesting_level = 0;
+   
++  last_func = NULL;
++  last_var = NULL;
++
+   while (nesting_level >= 0)
+     {
+       unsigned int abbrev_number, i;
+@@ -3481,16 +3519,32 @@ scan_unit_for_symbols (struct comp_unit *unit)
+ 	  || abbrev->tag == DW_TAG_entry_point
+ 	  || abbrev->tag == DW_TAG_inlined_subroutine)
+ 	{
+-	  func = lookup_func_by_offset (current_offset, unit->function_table);
++	  if (last_func
++	      && last_func->prev_func
++	      && last_func->prev_func->unit_offset == current_offset)
++	    func = last_func->prev_func;
++	  else
++	    func = lookup_func_by_offset (current_offset, unit->function_table);
++
+ 	  if (func == NULL)
+ 	    goto fail;
++
++	  last_func = func;
+ 	}
+       else if (abbrev->tag == DW_TAG_variable
+ 	       || abbrev->tag == DW_TAG_member)
+ 	{
+-	  var = lookup_var_by_offset (current_offset, unit->variable_table);
++	  if (last_var
++	      && last_var->prev_var
++	      && last_var->prev_var->unit_offset == current_offset)
++	    var = last_var->prev_var;
++	  else
++	    var = lookup_var_by_offset (current_offset, unit->variable_table);
++
+ 	  if (var == NULL)
+ 	    goto fail;
++
++	  last_var = var;
+ 	}
+ 
+       for (i = 0; i < abbrev->num_attrs; ++i)
+@@ -3684,6 +3738,9 @@ scan_unit_for_symbols (struct comp_unit *unit)
+ 	}
+     }
+ 
++  unit->function_table = reverse_funcinfo_list (unit->function_table);
++  unit->variable_table = reverse_varinfo_list (unit->variable_table);
++
+   free (nested_funcs);
+   return true;
+ 
+@@ -4047,36 +4104,6 @@ comp_unit_find_line (struct comp_unit *unit,
+ 					  linenumber_ptr);
+ }
+ 
+-static struct funcinfo *
+-reverse_funcinfo_list (struct funcinfo *head)
+-{
+-  struct funcinfo *rhead;
+-  struct funcinfo *temp;
+-
+-  for (rhead = NULL; head; head = temp)
+-    {
+-      temp = head->prev_func;
+-      head->prev_func = rhead;
+-      rhead = head;
+-    }
+-  return rhead;
+-}
+-
+-static struct varinfo *
+-reverse_varinfo_list (struct varinfo *head)
+-{
+-  struct varinfo *rhead;
+-  struct varinfo *temp;
+-
+-  for (rhead = NULL; head; head = temp)
+-    {
+-      temp = head->prev_var;
+-      head->prev_var = rhead;
+-      rhead = head;
+-    }
+-  return rhead;
+-}
+-
+ /* Extract all interesting funcinfos and varinfos of a compilation
+    unit into hash tables for faster lookup.  Returns TRUE if no
+    errors were enountered; FALSE otherwise.  */
+-- 
+2.37.2
+

binutils-reloc-symtab.patch

@@ -0,0 +1,50 @@
+--- binutils.orig/bfd/elf.c	2023-03-30 10:01:40.824181703 +0100
++++ binutils-2.40/bfd/elf.c	2023-03-30 10:02:23.103135337 +0100
+@@ -3877,21 +3877,23 @@ assign_section_numbers (bfd *abfd, struc
+ 	{
+ 	case SHT_REL:
+ 	case SHT_RELA:
+-	  /* A reloc section which we are treating as a normal BFD
+-	     section.  sh_link is the section index of the symbol
+-	     table.  sh_info is the section index of the section to
+-	     which the relocation entries apply.  We assume that an
+-	     allocated reloc section uses the dynamic symbol table
+-	     if there is one.  Otherwise we guess the normal symbol
+-	     table.  FIXME: How can we be sure?  */
+-	  if (d->this_hdr.sh_link == 0 && (sec->flags & SEC_ALLOC) != 0)
++	  /* sh_link is the section index of the symbol table.
++	     sh_info is the section index of the section to which the
++	     relocation entries apply.  */
++	  if (d->this_hdr.sh_link == 0)
+ 	    {
+-	      s = bfd_get_section_by_name (abfd, ".dynsym");
+-	      if (s != NULL)
+-		d->this_hdr.sh_link = elf_section_data (s)->this_idx;
++	      /* FIXME maybe: If this is a reloc section which we are
++		 treating as a normal section then we likely should
++		 not be assuming its sh_link is .dynsym or .symtab.  */
++	      if ((sec->flags & SEC_ALLOC) != 0)
++		{
++		  s = bfd_get_section_by_name (abfd, ".dynsym");
++		  if (s != NULL)
++		    d->this_hdr.sh_link = elf_section_data (s)->this_idx;
++		}
++	      else
++		d->this_hdr.sh_link = elf_onesymtab (abfd);
+ 	    }
+-	  if (d->this_hdr.sh_link == 0)
+-	    d->this_hdr.sh_link = elf_onesymtab (abfd);
+ 
+ 	  s = elf_get_reloc_section (sec);
+ 	  if (s != NULL)
+--- binutils.orig/binutils/objcopy.c	2023-03-30 10:01:41.063181441 +0100
++++ binutils-2.40/binutils/objcopy.c	2023-03-30 12:25:41.439108276 +0100
+@@ -2256,7 +2256,7 @@ merge_gnu_build_notes (bfd *          ab
+ 	{
+ 	  if (pnote->note.namedata[4] == '2')
+ 	    ++ version_2_seen;
+-	  else if (pnote->note.namedata[4] == '3')
++	  else if (pnote->note.namedata[4] == '3' || pnote->note.namedata[4] == '4')
+ 	    ++ version_3_seen;
+ 	  else
+ 	    {

binutils.spec

@@ -39,7 +39,7 @@
 Summary: A GNU collection of binary utilities
 Name: binutils%{?name_cross}%{?_with_debug:-debug}
 Version: 2.38
-Release: 23%{?dist}
+Release: 27%{?dist}
 License: GPLv3+
 URL: https://sourceware.org/binutils
 
@@ -334,6 +334,31 @@ Patch29: binutils-ppc-gas-machine-directive.patch
 # Lifetime: Fixed in 2.39 (for ld.bfd)
 Patch30: binutils-package-metadata.patch
 
+# Purpose: Fixing bug 2120752
+# Lifetime: Fixed in 2.39 
+Patch31: binutils-add-splay-tree-for-info_ptr.patch
+
+# Purpose: Fixing bug 2120752
+# Lifetime: Fixed in 2.39 
+Patch32: binutils-reduce-O-n2-performance-overhead-when-parsing-DWARF.patch
+
+# Purpose:  Stop an infinite loop in the binutils DWARF decoder.  (CVE 2022-38128)
+# Lifetime: Fixed in 2.40
+Patch33: binutils-CVE-38128-dwarf-abbrev-parsing.patch
+
+# Purpose:  Stop readelf from incorrectly decoding ELF files with no sections.
+# Lifetime: Fixed in 2.40
+Patch34: binutils-readelf-no-sections.patch
+
+# Purpose:  Stop the linker from associating allocated reloc sections with
+#            the .symtab section , which prevents it from being stripped.
+# Lifetime: Fixed in 2.41
+Patch35: binutils-reloc-symtab.patch
+
+# Purpose:  Stop an abort when using dwp to process a file with no dwo links.
+# Lifetime: Fixed in 2.41 (maybe)
+Patch36: binutils-gold-empty-dwp.patch
+
 #----------------------------------------------------------------------------
 
 Provides: bundled(libiberty)
@@ -587,11 +612,11 @@ CARGS="$CARGS --enable-64-bit-bfd"
 # Also enable the BPF target so that strip will work on BPF files.
 case %{binutils_target} in
     s390*)
-        # FIXME: For some unknown reason settting --enable-targets=x86_64-pep
-        # here breaks the building of GOLD.  I have no idea why, and not enough
-        # knowledge of how gold is configured to fix quickly.  So instead I have
-        # found that supporting "all" targets works.
-	CARGS="$CARGS --enable-targets=all"
+	# Note - The s390-linux target is there so that the GOLD linker will
+	# build.  By default, if configured for just s390x-linux, the GOLD
+	# configure system will only include support for 64-bit targets, but
+	# the s390x gold backend uses both 32-bit and 64-bit templates.
+	CARGS="$CARGS --enable-targets=s390-linux,s390x-linux,x86_64-pep,bpf-unknown-none"
 	;;
     ia64*)
 	CARGS="$CARGS --enable-targets=ia64-linux,x86_64-pep,bpf-unknown-none"
@@ -948,6 +973,20 @@ exit 0
 
 #----------------------------------------------------------------------------
 %changelog
+* Tue May 02 2023 Nick Clifton  <nickc@redhat.com> - 2.38-27
+- GOLD: Stop an abort triggered by running dwp on a file with no dwo links.  (#2192226)
+
+* Thu Mar 30 2023 Nick Clifton  <nickc@redhat.com> - 2.38-26
+- Linker: Do not associate allocated reloc sections with the .symtab section.  (#2166419)
+
+* Wed Nov 16 2022 Yara Ahmad <yahmad@redhat.com> - 2.38-25
+- Fic configuration of s390x binutils so that it does not include support for extraneous targets. (#2139143)
+- Fix readelf's decoding of files with no sections.  (#2131609) 
+- Stop potential infinite loop in the binutils DWARF parser.  (#2122675)
+
+* Wed Sep 7 2022 Yara Ahmad  <yahmad@redhat.com> - 2.38-24
+- Improving the performance of bfd function lookup_func_by_offset
+
 * Thu Aug 04 2022 Nick Clifton  <nickc@redhat.com> - 2.38-23
 - Add the --package-metadata option to the linkers.  (#2099999)
 

plans/ci.fmf

@@ -1,6 +1,5 @@
 summary: CI Gating Plan
 discover:
     how: fmf
-    directory: tests
 execute:
-    how: beakerlib
+    how: tmt