Why would an ELF SHT_REL section contain relocations outside the section its sh_info refers to?

Question

I have a .so from an Android JNI/NDK application. Here are two of its sections:

[Nr] Name              Type            Addr     Off    Size   ES Flg Lk Inf Al
[10] .rel.plt          REL             001c9034 1c9034 00c928 08  AI  3  11  4
[11] .plt              PROGBITS        001d595c 1d595c 012dd0 00  AX  0   0  4

Based on the Info parameter of .rel.plt, I would expect the relocations it contains to affect the contents of the .plt section. However, the addresses in the relocations are all to much higher addresses:

Relocation section '.rel.plt' at offset 0x1c9034 contains 6437 entries:
 Offset     Info    Type                Sym. Value  Symbol's Name
00e1bb6c  00000216 R_ARM_JUMP_SLOT        00000000   __cxa_atexit@LIBC
00e1bb70  00000116 R_ARM_JUMP_SLOT        00000000   __cxa_finalize@LIBC
00e1bb74  00000316 R_ARM_JUMP_SLOT        00a0f8c5   _Znwj
00e1bb78  00000416 R_ARM_JUMP_SLOT        00a0f941   _ZdlPv
00e1bb7c  00000516 R_ARM_JUMP_SLOT        00a1886d   __gxx_personality_v0
00e1bb80  00000716 R_ARM_JUMP_SLOT        00000000   __stack_chk_fail@LIBC
00e1bb84  00000b16 R_ARM_JUMP_SLOT        009ed201   _ZNSt6__ndk16chrono12system_clock3nowEv

Those addresses fall into the range of the .got and .data sections. This is a shared object, so the offsets should be virtual address based rather than section based, and the ELF for the ARM Architecture says:

The ELF standard requires that the GOT-generating relocations of the PLT are emitted into a contiguous sub-range of the dynamic relocation section. That sub-range is denoted by the standard tags DT_JMPREL and DT_PLTRELSZ. The type of relocations (RELor RELA) is stored in the DT_PLTREL tag.

Am I misunderstanding what the offset of these relocations applies to? Or perhaps what "GOT-generating relocations" means?

Answer 1

My mistake was in treating the addresses in the relocations' addresses based on the sections' offsets (sh_offset) and not their addresses (sh_addr) to determine where they pointed. Correcting this misunderstanding, the relocations all address entries in the GOT which address the PLT, as expected.