ld.so seg faults on code built with -fpie -pie

[Jay Foad]

Hi,

I'm not sure where to ask this question as I don't know where the problem is.

I'm using Sourcery G++ Lite 4.4-57 for MIPS GNU/Linux to build a large
C application with -fpie -pie. When I try to run it under qemu-mipsel,
it crashes in ld.so.

objdump -R complains:

BFD: hello(.rel.dyn): relocation 1227 has invalid symbol index 16777215
BFD: hello(.rel.dyn): relocation 1228 has invalid symbol index 16777215
[...]

objdump -j .rel.dyn -s shows:

Contents of section .rel.dyn:
 83ac 00000000 00000000 e8d31000 03000000  ................
 83bc ecd31000 03000000 f0d31000 03000000  ................
[...]
 a49c f8e31000 031a0100 00e41000 031a0100  ................
 a4ac 08e41000 031a0100 10e41000 031a0100  ................
[...]
 a9fc 8ced1000 03170300 e0df1000 03ffffff  ................
 aa0c ecdf1000 03ffffff 00e01000 03ffffff  ................

So the relocations are all R_MIPS_REL32. First there are some with
symbol table index 0, then some with normal symbol table indexes, and
then some with index 0xffffff.

ld.so (elf_dynamic_do_rel() in elf/do-rel.h) tries to interpret
0xffffff as a normal symbol table index, and ends up reading way off
the end of some of its tables, hence the seg fault.

Is it valid to have a symbol table index of 0xffffff like this? If so,
should ld.so cope with it? If not, where are they coming from?

Thanks for any help!
Jay.