[PATCH v2 1/3] riscv: module: Fix out-of-bounds relocation access

[Alexandre Ghiti]

Hi Samuel,

On 09/04/2025 19:14, Samuel Holland wrote:
> The current code allows rel[j] to access one element past the end of the
> relocation section. Simplify to num_relocations which is equivalent to
> the existing size expression.
>
> Fixes: 080c4324fa5e ("riscv: optimize ELF relocation function in riscv")
> Signed-off-by: Samuel Holland <samuel.holland at sifive.com>
> ---
>
> Changes in v2:
>   - New patch for v2
>
>   arch/riscv/kernel/module.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/arch/riscv/kernel/module.c b/arch/riscv/kernel/module.c
> index 47d0ebeec93c..060f576cc988 100644
> --- a/arch/riscv/kernel/module.c
> +++ b/arch/riscv/kernel/module.c
> @@ -859,7 +859,7 @@ int apply_relocate_add(Elf_Shdr *sechdrs, const char *strtab,
>   				}
>   
>   				j++;
> -				if (j > sechdrs[relsec].sh_size / sizeof(*rel))
> +				if (j == num_relocations)
>   					j = 0;
>   
>   			} while (j_idx != j);


Reviewed-by: Alexandre Ghiti <alexghiti at rivosinc.com>

Thanks,

Alex