https://sourceware.org/bugzilla/show_bug.cgi?id=34455
Bug ID: 34455
Summary: ld: SEGV in _bfd_elf_free_cached_info
(bfd/elf.c:10209) — free of bad pointer during cleanup
with `--shared -z now`
Product: binutils
Version: 2.47
Status: UNCONFIRMED
Severity: normal
Priority: P2
Component: ld
Assignee: unassigned at sourceware dot org
Reporter: 2722900221 at qq dot com
Target Milestone: ---
Created attachment 16887
--> https://sourceware.org/bugzilla/attachment.cgi?id=16887&action=edit
PoC
Summary
Linking a malformed ELF with `--shared -z now` crashes during BFD cleanup:
`_bfd_elf_free_cached_info` (`bfd/elf.c:10209`) calls `free` on a
corrupted/invalid pointer (`sec_info->cies`-related cached data), and the ASAN
allocator segfaults inside `__asan::asan_free` while trying to dequeue the
chunk.
Affected Version
- binutils 2.47 (release tarball, version date `20260726`)
- Originally triaged on dev snapshot `2.47.50.20260722` (commit `640a79623`)
Reproduction
Build (ASAN):
CC=gcc CFLAGS='-g -O1 -fsanitize=address -fno-omit-frame-pointer -fno-common' \
LDFLAGS='-fsanitize=address' \
./configure --disable-gdb --disable-gdbserver --disable-sim --disable-cet \
--disable-werror --disable-nls --enable-targets=x86_64-linux-gnu
MAKEINFO=true
make -j
Run:
export
ASAN_OPTIONS="abort_on_error=0:symbolize=1:detect_leaks=0:allocator_may_return_null=1:halt_on_error=1"
ld --shared -z now -o /dev/null bug_17.o
Error Log
==65749==ERROR: AddressSanitizer: SEGV on unknown address 0x0000fffffff6 (pc
0x7e2297028b46 bp 0x000100000006 sp 0x7ffe0e86e0b0 T0)
#0 __sanitizer::atomic_compare_exchange_strong ...
sanitizer_atomic_clang.h:80
#1 __asan::Allocator::AtomicallySetQuarantineFlagIfAllocated ...
asan_allocator.cpp:621
#2 __asan::Allocator::Deallocate ... asan_allocator.cpp:697
#3 __asan::asan_free ... asan_allocator.cpp:971
#4 __interceptor_free ...
asan_malloc_linux.cpp:128
#5 _bfd_elf_free_cached_info /home/user/build/binutils-2.47/bfd/elf.c:10209
#6 _bfd_delete_bfd /home/user/build/binutils-2.47/bfd/opncls.c:151
#7 bfd_close_all_done /home/user/build/binutils-2.47/bfd/opncls.c:942
#8 lang_cleanup /home/user/build/binutils-2.47/ld/ldlang.c:1506
#9 ld_cleanup /home/user/build/binutils-2.47/ld/ldmain.c:242
SUMMARY: AddressSanitizer: SEGV in __asan::asan_free (caller:
_bfd_elf_free_cached_info, elf.c:10209)
--
You are receiving this mail because:
You are on the CC list for the bug.
