[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [PATCH] device-tree/kernel: Use memcpy in output_length()
- To: Michal Orzel <michal.orzel@xxxxxxx>, <xen-devel@xxxxxxxxxxxxxxxxxxxx>
- From: Jason Andryuk <jason.andryuk@xxxxxxx>
- Date: Tue, 22 Jul 2025 00:50:07 -0400
- Arc-authentication-results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 165.204.84.17) smtp.rcpttodomain=lists.xenproject.org smtp.mailfrom=amd.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=amd.com; dkim=none (message not signed); arc=none (0)
- Arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=cO39SUoplI4UOUYwkm2MrkzX7RpyaVpP9Pbw8Pmh1KQ=; b=h4/NF6+tfyPoiHZHqLuwYywo6Z24x/3WciYAJABDjIx4wU+dcc886P07xMiMjMngXYZEmHOg5rIliyEh5/5CuFTpoSjJwbFQtmcUhJYGnAevE2HSCYIKn7Zu0FsJtkcQyFtXAy+mb2BODTl4eJPZEZ5NU9i60+aqyQONHaQzUEA1zQJ89sezV/GfJTOtkLJPQRFx/JcIAekjaCHrxSXfpq8cZJDNT8PziKkbHG007bAhER0+Y3QgQWD1tvZKUH5E0+4AaMSbuC3cyXG113LoqoVqyhpWf45B41VN/UMnbRa2MxnYaLYRc59GFSHiH34tU602k25FgC23RGbjscPuMg==
- Arc-seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=Yf5vpN0khV9xn0v+eoKyGycTCZiA6UvwteEpt7ek+6LLIsIHT7eaQ/W/kf/zcSDam6gRATOanP3AjS24Kc9jC8LY+9t3yDZUgKbd0JRwpceNrgs6VLv1UWXlJlbfsuqOBSOhiTwH2vi2+UgReNaMahCbeZPQdsU5f6zfncv5RtKuznDVpDB7hQZqISfuQ79AOfVqVCGefg0JxS/7HviS0dV0d/8JYJsj8m1Il7o8ZB3BksJy6+KaOVY5HGkFgyc1O88N3ILhZZDIl1R0srY5k8iqN15t4zV9myZFMEhBoK4NUwXhIq0u01xTbBhTxGQHNuF+WEqN6gNv2Iwy3Tl4+A==
- Cc: Stefano Stabellini <sstabellini@xxxxxxxxxx>, Julien Grall <julien@xxxxxxx>, Bertrand Marquis <bertrand.marquis@xxxxxxx>
- Delivery-date: Tue, 22 Jul 2025 16:18:14 +0000
- List-id: Xen developer discussion <xen-devel.lists.xenproject.org>
On 2025-07-22 03:46, Michal Orzel wrote:
Trying to boot a compressed kernel with UBSAN enabled, results in the
following warning:
(XEN) UBSAN: Undefined behaviour in common/device-tree/kernel.c:21:12
(XEN) load of misaligned address 00000a0040f89867 for type 'uint32_t'
(XEN) which requires 4 byte alignment
...
(XEN) [<00000a0000529964>] kernel_decompress+0x2bc/0x5bc
(XEN) [<00000a000052a354>] kernel_probe+0x6f0/0x734
(XEN) [<00000a0000528714>] dom0less-build.c#construct_domU+0x188/0x9d8
If &image[image_len - 4] is not aligned to 4B boundary it causes
unaligned access which is undefined behavior on Arm. Use memcpy instead
to be safe.
Fixes: c1be0b102e0e ("xen/arm: support gzip compressed kernels")
Signed-off-by: Michal Orzel <michal.orzel@xxxxxxx>
---
xen/common/device-tree/kernel.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/xen/common/device-tree/kernel.c b/xen/common/device-tree/kernel.c
index ef393182b691..28096121a52d 100644
--- a/xen/common/device-tree/kernel.c
+++ b/xen/common/device-tree/kernel.c
@@ -18,7 +18,11 @@
static uint32_t __init output_length(char *image, unsigned long image_len)
{
- return *(uint32_t *)&image[image_len - 4];
Maybe just:
return get_unaligned_le32(&image[image_len - 4]);
You'll also need:
#include <xen/unaligned.h>
The gzip size is little endian,
https://datatracker.ietf.org/doc/html/rfc1952:
Within a computer, a number may occupy multiple bytes. All
multi-byte numbers in the format described here are stored with
the least-significant byte first (at the lower memory address).
Regards,
Jason
+ uint32_t val;
+
+ memcpy(&val, &image[image_len - 4], sizeof(val));
+
+ return val;
}
int __init kernel_decompress(struct boot_module *mod, uint32_t offset)
|
