linux-kernel - [PATCH v2] ARM: module: fix unwind section relocation out of range error

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20250922202438.496433-1-william.zhang@broadcom.com>
Date: Mon, 22 Sep 2025 13:23:22 -0700
From: William Zhang <william.zhang@...adcom.com>
To: linux-arm-kernel@...ts.infradead.org
Cc: song@...nel.org,
	linus.walleij@...aro.org,
	florian.fainelli@...adcom.com,
	ardb@...nel.org,
	anand.gore@...adcom.com,
	Broadcom Kernel List <bcm-kernel-feedback-list@...adcom.com>,
	kursad.oney@...adcom.com,
	William Zhang <william.zhang@...adcom.com>,
	Sebastian Andrzej Siewior <bigeasy@...utronix.de>,
	"Peter Zijlstra (Intel)" <peterz@...radead.org>,
	Luis Chamberlain <mcgrof@...nel.org>,
	linux-kernel@...r.kernel.org,
	Thomas Gleixner <tglx@...utronix.de>,
	Christophe Leroy <christophe.leroy@...roup.eu>,
	Petr Pavlu <petr.pavlu@...e.com>,
	Russell King <linux@...linux.org.uk>
Subject: [PATCH v2] ARM: module: fix unwind section relocation out of range error

In an armv7 system that uses non-3G/1G split and with more than 512MB
physical memory, driver load may fail with following error:
   section 29 reloc 0 sym '': relocation 42 out of range (0xc2ab9be8 ->
0x7fad5998)

This happens when relocation R_ARM_PREL31 from the unwind section
.ARM.extab and .ARM.exidx are allocated from the VMALLOC space while
.text section is from MODULES_VADDR space. It exceeds the +/-1GB
relocation requirement of R_ARM_PREL31 hence triggers the error.

The fix is to mark .ARM.extab and .ARM.exidx sections as executable so
they can be allocated along with .text section and always meet range
requirement.

Fixes: ac3b43283923 ("module: replace module_layout with module_memory")

Co-developed-by: Ard Biesheuvel <ardb@...nel.org>
Signed-off-by: Ard Biesheuvel <ardb@...nel.org>
Signed-off-by: William Zhang <william.zhang@...adcom.com>

---

Changes in v2:
- Fix the comment in code and commit message regarding the unwind
section location
- Add fix tag for more visibility

 arch/arm/kernel/module-plts.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/arch/arm/kernel/module-plts.c b/arch/arm/kernel/module-plts.c
index 354ce16d83cb..b5338fe59706 100644
--- a/arch/arm/kernel/module-plts.c
+++ b/arch/arm/kernel/module-plts.c
@@ -225,6 +225,18 @@ int module_frob_arch_sections(Elf_Ehdr *ehdr, Elf_Shdr *sechdrs,
 			mod->arch.init.plt = s;
 		else if (s->sh_type == SHT_SYMTAB)
 			syms = (Elf32_Sym *)s->sh_addr;
+#if defined(CONFIG_ARM_UNWIND) && !defined(CONFIG_VMSPLIT_3G)
+		else if (s->sh_type == ELF_SECTION_UNWIND ||
+			 (strncmp(".ARM.extab", secstrings + s->sh_name, 10) == 0)) {
+			/*
+			 * To avoid the possible relocation out of range issue for
+			 * R_ARM_PREL31, mark unwind section .ARM.extab and .ARM.exidx as
+			 * executable so they will be allocated along with .text section to
+			 * meet +/-1GB range requirement of the R_ARM_PREL31 relocation
+			 */
+			s->sh_flags |= SHF_EXECINSTR;
+		}
+#endif
 	}
 
 	if (!mod->arch.core.plt || !mod->arch.init.plt) {
-- 
2.43.7