link_elf_obj: guard reltab/relatab frees in link_elf_unload_file()

[ojanerif_amd.com]

Summary

link_elf_unload_file() frees the per-section relocation tables by iterating
ef->nreltab / ef->nrelatab, but dereferences ef->reltab / ef->relatab
unconditionally. The counts are set while scanning the section headers, before
the tables are allocated, so an error on the load path reaches it with a
non-zero count and a NULL table, faulting on ef->relatab[0].rela. Reachable
from link_elf_load_file() once a valid relocation section has been counted,
e.g. a later section with sh_info >= e_shnum (D60937).

Guard the loops with the table pointer, as is already done for ef->progtab
above.

MFC after: 1 week

[kib]

sys/kern/link_elf_obj.c

4–1

Since you already test for != NULL, you might save the free() call by moving it under the if() path. Not needed for correctness, of course.