access beyond end of merged section

[nickdesaulniers]

Reported-by: Boris Petkov <bp@alien8.de> ARCH=i386 make CC=clang -j72 -s defconfig all Seeing this on mainline with clang-15.

...
ld: net/core/filter.o: access beyond end of merged section (341)
ld: net/core/sock_diag.o: access beyond end of merged section (226)
ld: net/core/dev_ioctl.o: access beyond end of merged section (13)
ld: net/core/tso.o: access beyond end of merged section (62)
ld: net/core/sock_reuseport.o: access beyond end of merged section (184)
ld: net/core/fib_notifier.o: access beyond end of merged section (146)
ld: net/core/xdp.o: access beyond end of merged section (426)
ld: net/core/flow_offload.o: access beyond end of merged section (881)
ld: net/core/gro.o: access beyond end of merged section (230)
ld: net/core/net-sysfs.o: access beyond end of merged section (85)
...
$ ld --version
GNU ld (GNU Binutils for Debian) 2.38
...

[nathanchance]

This is reproducible with ld 2.32 through ld 2.38, so this does not appear to be a regression on the binutils side.

It is not reproducible with CC=clang-11 but it is with CC=clang-12. Bisect points to:

72e75ca343c6ff927a2242efee3f4640943eedd6 is the first bad commit
commit 72e75ca343c6ff927a2242efee3f4640943eedd6
Author: Fangrui Song <i@maskray.me>
Date:   Sun Dec 20 18:37:14 2020 -0800

    [MC][ELF] Allow STT_SECTION referencing SHF_MERGE on REL targets

    This relands D64327 with a more specific workaround for R_386_GOTOFF
    (gold<2.34 bug https://sourceware.org/bugzilla/show_bug.cgi?id=16794)

    .debug_info has quite a few .debug_str relocations (R_386_32/R_ARM_ABS32).
    The original workaround was too general and introduced too many .L symbols
    used just as relocation targets.

    From the original review:

      ... it reduced the size of a big ARM-32 debug image by 33%. It contained ~68M
      of relocations symbols out of total ~71M symbols (96% of symbols table was
      generated for relocations with symbol).

 llvm/lib/MC/ELFObjectWriter.cpp   |  7 ++++---
 llvm/test/MC/ELF/basic-elf-32.s   |  4 ++--
 llvm/test/MC/ELF/compression.s    |  4 ++--
 llvm/test/MC/ELF/relocation-386.s |  5 ++++-
 llvm/test/MC/Mips/elf-relsym.s    | 10 ++--------
 llvm/test/MC/Mips/xgot.s          |  4 ++--
 6 files changed, 16 insertions(+), 18 deletions(-)

I'll see if I can reduce something down shortly.

[nathanchance]

cvise spits out:

$ cat phy.i
asm("   .section \"__ksymtab_strings\",\"aMS\",%progbits,1      \n"
    "__kstrtabns_usb_phy_roothub_alloc:                         \n"
    "   .asciz  \"\"                                            \n"
    "   .section \"___ksymtab\", \"a\"                          \n"
    "   .long   __kstrtabns_usb_phy_roothub_alloc- .            \n");

$ clang --target=x86_64-linux-gnu -m32 -c -o phy.{o,i}

$ ld -e 0 -m elf_i386 -o /dev/null phy.o
ld: phy.o: access beyond end of merged section (4)

$ ld.lld -e 0 -m elf_i386 -o /dev/null phy.o

$ gcc -m32 -c -o phy.{o,i}

$ ld -e 0 -m elf_i386 -o /dev/null phy.o

$ ld.lld -e 0 -m elf_i386 -o /dev/null phy.o