Commit 0b4cce68 authored by Samuel Holland's avatar Samuel Holland Committed by Alexandre Ghiti
Browse files

riscv: module: Fix out-of-bounds relocation access 



The current code allows rel[j] to access one element past the end of the
relocation section. Simplify to num_relocations which is equivalent to
the existing size expression.

Fixes: 080c4324 ("riscv: optimize ELF relocation function in riscv")
Signed-off-by: default avatarSamuel Holland <samuel.holland@sifive.com>
Reviewed-by: default avatarMaxim Kochetkov <fido_max@inbox.ru>
Reviewed-by: default avatarAlexandre Ghiti <alexghiti@rivosinc.com>
Link: https://lore.kernel.org/r/20250409171526.862481-1-samuel.holland@sifive.com


Signed-off-by: default avatarAlexandre Ghiti <alexghiti@rivosinc.com>
parent e94eb7ea

arch/riscv/kernel/module.c

+1 −1
Original line number Diff line number Diff line
@@ -860,7 +860,7 @@ int apply_relocate_add(Elf_Shdr *sechdrs, const char *strtab, 
				}



				j++;

				if (j > sechdrs[relsec].sh_size / sizeof(*rel))

				if (j == num_relocations)

					j = 0;



			} while (j_idx != j);