From: "H.J. Lu" <hjl.tools@gmail.com>
Date: Tue, 30 Sep 2025 08:13:56 +0800

Upstream-Status: Backport [https://sourceware.org/git/?p=binutils-gdb.git;a=patch;h=b6ac5a8a5b82f0ae6a4642c8d7149b325f4cc60a]
CVE: CVE-2025-11494

Since x86 .eh_frame section may reference _GLOBAL_OFFSET_TABLE_, keep
_GLOBAL_OFFSET_TABLE_ if there is dynamic section and the output
.eh_frame section is non-empty.

	PR ld/33499
	* elfxx-x86.c (_bfd_x86_elf_late_size_sections): Keep
	_GLOBAL_OFFSET_TABLE_ if there is dynamic section and the
	output .eh_frame section is non-empty.

Signed-off-by: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com>

diff --git a/bfd/elfxx-x86.c b/bfd/elfxx-x86.c
index c054f7cd..ddc15945 100644
--- a/bfd/elfxx-x86.c
+++ b/bfd/elfxx-x86.c
@@ -2447,6 +2447,8 @@ _bfd_x86_elf_late_size_sections (bfd *output_bfd,
 
   if (htab->elf.sgotplt)
     {
+      asection *eh_frame;
+
       /* Don't allocate .got.plt section if there are no GOT nor PLT
 	 entries and there is no reference to _GLOBAL_OFFSET_TABLE_.  */
       if ((htab->elf.hgot == NULL
@@ -2459,7 +2461,11 @@ _bfd_x86_elf_late_size_sections (bfd *output_bfd,
 	  && (htab->elf.iplt == NULL
 	      || htab->elf.iplt->size == 0)
 	  && (htab->elf.igotplt == NULL
-	      || htab->elf.igotplt->size == 0))
+             || htab->elf.igotplt->size == 0)
+         && (!htab->elf.dynamic_sections_created
+             || (eh_frame = bfd_get_section_by_name (output_bfd,
+                                                     ".eh_frame")) == NULL
+             || eh_frame->rawsize == 0))
 	{
 	  htab->elf.sgotplt->size = 0;
 	  /* Solaris requires to keep _GLOBAL_OFFSET_TABLE_ even if it