cmd/internal/obj: disallow linknamed access to builtin symbols

Currently, a symbol reference is counted as a reference to a
builtin symbol if the name matches a builtin. Usually builtin
references are generated by the compiler. But one could manually
write one with linkname. Since the list of builtin functions are
subject to change from time to time, we don't want users to depend
on their names. So we don't count a linknamed reference as a
builtin reference, and instead, count it as a named reference, so
it is checked by the linker.

Change-Id: Id3543295185c6bbd73a8cff82afb8f9cb4fd6f71
Reviewed-on: https://go-review.googlesource.com/c/go/+/635755
Reviewed-by: Michael Pratt <mpratt@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>

src/cmd/internal/obj/sym.go

@@ -320,7 +320,7 @@ func (ctxt *Link) NumberSyms() {
 			// Assign special index for builtin symbols.
 			// Don't do it when linking against shared libraries, as the runtime
 			// may be in a different library.
-			if i := goobj.BuiltinIdx(rs.Name, int(rs.ABI())); i != -1 {
+			if i := goobj.BuiltinIdx(rs.Name, int(rs.ABI())); i != -1 && !rs.IsLinkname() {
 				rs.PkgIdx = goobj.PkgIdxBuiltin
 				rs.SymIdx = int32(i)
 				rs.Set(AttrIndexed, true)

src/cmd/link/link_test.go

@@ -1518,6 +1518,8 @@ func TestCheckLinkname(t *testing.T) {
 		{"coro_asm", false},
 		// pull-only linkname is not ok
 		{"coro2.go", false},
+		// pull linkname of a builtin symbol is not ok
+		{"builtin.go", false},
 		// legacy bad linkname is ok, for now
 		{"fastrand.go", true},
 		{"badlinkname.go", true},

src/cmd/link/testdata/linkname/builtin.go

@@ -0,0 +1,17 @@
+// Copyright 2024 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+// Linkname builtin symbols (that is not already linknamed,
+// e.g. mapaccess1) is not allowed.
+
+package main
+
+import "unsafe"
+
+func main() {
+	mapaccess1(nil, nil, nil)
+}
+
+//go:linkname mapaccess1 runtime.mapaccess1
+func mapaccess1(t, m, k unsafe.Pointer) unsafe.Pointer