| Message ID | 20250409171526.862481-1-samuel.holland@sifive.com (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | [v2,1/3] riscv: module: Fix out-of-bounds relocation access | expand |
| Context | Check | Description |
|---|---|---|
| bjorn/pre-ci_am | success | Success |
| bjorn/build-rv32-defconfig | success | build-rv32-defconfig |
| bjorn/build-rv64-clang-allmodconfig | success | build-rv64-clang-allmodconfig |
| bjorn/build-rv64-gcc-allmodconfig | success | build-rv64-gcc-allmodconfig |
| bjorn/build-rv64-nommu-k210-defconfig | success | build-rv64-nommu-k210-defconfig |
| bjorn/build-rv64-nommu-k210-virt | success | build-rv64-nommu-k210-virt |
| bjorn/checkpatch | success | checkpatch |
| bjorn/dtb-warn-rv64 | success | dtb-warn-rv64 |
| bjorn/header-inline | success | header-inline |
| bjorn/kdoc | success | kdoc |
| bjorn/module-param | success | module-param |
| bjorn/verify-fixes | success | verify-fixes |
| bjorn/verify-signedoff | success | verify-signedoff |
09.04.2025 20:14, Samuel Holland пишет: > The current code allows rel[j] to access one element past the end of the > relocation section. Simplify to num_relocations which is equivalent to > the existing size expression. > > Fixes: 080c4324fa5e ("riscv: optimize ELF relocation function in riscv") > Signed-off-by: Samuel Holland <samuel.holland@sifive.com> Reviewed-by: Maxim Kochetkov <fido_max@inbox.ru>
Hi Samuel, On 09/04/2025 19:14, Samuel Holland wrote: > The current code allows rel[j] to access one element past the end of the > relocation section. Simplify to num_relocations which is equivalent to > the existing size expression. > > Fixes: 080c4324fa5e ("riscv: optimize ELF relocation function in riscv") > Signed-off-by: Samuel Holland <samuel.holland@sifive.com> > --- > > Changes in v2: > - New patch for v2 > > arch/riscv/kernel/module.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/arch/riscv/kernel/module.c b/arch/riscv/kernel/module.c > index 47d0ebeec93c..060f576cc988 100644 > --- a/arch/riscv/kernel/module.c > +++ b/arch/riscv/kernel/module.c > @@ -859,7 +859,7 @@ int apply_relocate_add(Elf_Shdr *sechdrs, const char *strtab, > } > > j++; > - if (j > sechdrs[relsec].sh_size / sizeof(*rel)) > + if (j == num_relocations) > j = 0; > > } while (j_idx != j); Reviewed-by: Alexandre Ghiti <alexghiti@rivosinc.com> Thanks, Alex
diff --git a/arch/riscv/kernel/module.c b/arch/riscv/kernel/module.c index 47d0ebeec93c..060f576cc988 100644 --- a/arch/riscv/kernel/module.c +++ b/arch/riscv/kernel/module.c @@ -859,7 +859,7 @@ int apply_relocate_add(Elf_Shdr *sechdrs, const char *strtab, } j++; - if (j > sechdrs[relsec].sh_size / sizeof(*rel)) + if (j == num_relocations) j = 0; } while (j_idx != j);
The current code allows rel[j] to access one element past the end of the relocation section. Simplify to num_relocations which is equivalent to the existing size expression. Fixes: 080c4324fa5e ("riscv: optimize ELF relocation function in riscv") Signed-off-by: Samuel Holland <samuel.holland@sifive.com> --- Changes in v2: - New patch for v2 arch/riscv/kernel/module.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)