golang/go · error

cannot find .data

Error message

cannot find .data

What it means

During PE (Windows) FIPS 140 post-link processing, the linker opens the binary and looks for the .data section using pe.File.Section(".data"). PE does not use a dedicated section for FIPS info; instead, the info is embedded within the .data section near go:buildinfo. If .data is missing, the scan cannot proceed.

Source

Thrown at src/cmd/link/internal/ld/fips140.go:508

	if err != nil {
		return err
	}
	defer wf.Close()

	f, err := newFipsObj(wf, fipso)
	if err != nil {
		return err
	}
	defer f.Close()

	// Find the go:fipsinfo symbol.
	// PE does not put it in its own section, so we have to scan for it.
	// It is near the start of the data segment, right after go:buildinfo,
	// so we should not have to scan too far.
	const maxScan = 16 << 20
	sect := pf.Section(".data")
	if sect == nil {
		return fmt.Errorf("cannot find .data")
	}
	b := bufio.NewReader(sect.Open())
	off := int64(0)
	data := make([]byte, fipsMagicLen+fipsSumLen+9*ctxt.Arch.PtrSize)
	for ; ; off += 16 {
		if off >= maxScan {
			break
		}
		if _, err := io.ReadFull(b, data[:fipsMagicLen]); err != nil {
			return fmt.Errorf("scanning PE for FIPS magic: %v", err)
		}
		if string(data[:fipsMagicLen]) == fipsMagic {
			if _, err := io.ReadFull(b, data[fipsMagicLen:]); err != nil {
				return fmt.Errorf("scanning PE for FIPS magic: %v", err)
			}
			break
		}
	}

View on GitHub (pinned to b6b368adc5)

Solutions

1. Clean rebuild: go clean -cache && GOFIPS=1 go build
2. Verify the binary is a standard Go-produced PE executable
3. Check if external tools (e.g. UPX, PE compressors) renamed or merged sections
4. Report as a Go linker bug if the binary is unmodified
5. Try -linkmode=external vs internal to see if section layout differs

// Before PE FIPS post-link, verify .data section exists
func verifyPEDataSection(exe string) error {
    pf, err := pe.Open(exe)
    if err != nil {
        return err
    }
    defer pf.Close()
    if pf.Section(".data") == nil {
        return fmt.Errorf("PE binary lacks .data section — was it produced by a standard Go build?")
    }
    return nil
}

// Handle missing .data section with diagnostic guidance
sect := pf.Section(".data")
if sect == nil {
    return fmt.Errorf("cannot find .data (verify binary is unmodified Go PE output)")
}

When it happens

Trigger: The pefips function calls pf.Section(".data") on the opened PE binary. If the return is nil (section not found), the error is returned. The subsequent code scans up to 16 MB of .data for the FIPS magic bytes.

Common situations: The PE binary was produced by a non-standard linker or tool that renames or omits the .data section; the binary was heavily stripped or transformed; a Go version bug in PE section naming; cross-compilation environment producing non-standard PE layouts.

Related errors

• scanning PE for FIPS magic: %v
• corrupt pointer found in go:fipsinfo
• dynamic relocation to unreachable symbol %s
• internal error in windynrelocsym: redirect GOT token applied
• internal error in windynrelocsym: underlying sym for %q has

AI-assisted analysis of golang/go@b6b368adc5 (2026-08-12). Data as JSON: /api/errors/b33bcd48a142f83b. Report an issue: GitHub.