[PATCH] x86, efi: Fix segfault caused by unaligned access

[Matt Fleming]

We need to use memcpy() instead of directly dereferencing a pointer
because memcpy() correctly handles the case where the
source/destination are unaligned, which can lead to a segfault when
cross-building an x86 kernel on risc architectures.

Stephen Rothwell noticed this bug when he hit a segfault while
cross-building an x86_64 allmodconfig kernel on PowerPC.

Cc: H. Peter Anvin <hpa@xxxxxxxxx>
Reported-by: Stephen Rothwell <sfr@xxxxxxxxxxxxxxxx>
Signed-off-by: Matt Fleming <matt.fleming@xxxxxxxxx>
---
 arch/x86/boot/tools/build.c |   26 ++++++++++++++------------
 1 files changed, 14 insertions(+), 12 deletions(-)

diff --git a/arch/x86/boot/tools/build.c b/arch/x86/boot/tools/build.c
index 4e9bd6b..b4d85b5 100644
--- a/arch/x86/boot/tools/build.c
+++ b/arch/x86/boot/tools/build.c
@@ -200,36 +200,38 @@ int main(int argc, char ** argv)
 #ifdef CONFIG_EFI_STUB
 	file_sz = sz + i + ((sys_size * 16) - sz);
 
-	pe_header = *(unsigned int *)&buf[0x3c];
+	memcpy(&pe_header, &buf[0x3c], sizeof(pe_header));
 
 	/* Size of code */
-	*(unsigned int *)&buf[pe_header + 0x1c] = file_sz;
+	memcpy(&buf[pe_header + 0x1c], &file_sz, sizeof(file_sz));
 
 	/* Size of image */
-	*(unsigned int *)&buf[pe_header + 0x50] = file_sz;
+	memcpy(&buf[pe_header + 0x50], &file_sz, sizeof(file_sz));
 
 #ifdef CONFIG_X86_32
 	/* Address of entry point */
-	*(unsigned int *)&buf[pe_header + 0x28] = i;
+	memcpy(&buf[pe_header + 0x28], &i, sizeof(i));
 
 	/* .text size */
-	*(unsigned int *)&buf[pe_header + 0xb0] = file_sz;
+	memcpy(&buf[pe_header + 0xb0], &file_sz, sizeof(file_sz));
 
 	/* .text size of initialised data */
-	*(unsigned int *)&buf[pe_header + 0xb8] = file_sz;
+	memcpy(&buf[pe_header + 0xb8], &file_sz, sizeof(file_sz));
 #else
+	/* .text size */
+	memcpy(&buf[pe_header + 0xc0], &file_sz, sizeof(file_sz));
+
+	/* .text size of initialised data */
+	memcpy(&buf[pe_header + 0xc8], &file_sz, sizeof(file_sz));
+
 	/*
 	 * Address of entry point. startup_32 is at the beginning and
 	 * the 64-bit entry point (startup_64) is always 512 bytes
 	 * after.
 	 */
-	*(unsigned int *)&buf[pe_header + 0x28] = i + 512;
+	file_sz = i + 512;
+	memcpy(&buf[pe_header + 0x28], &file_sz, sizeof(file_sz));
 
-	/* .text size */
-	*(unsigned int *)&buf[pe_header + 0xc0] = file_sz;
-
-	/* .text size of initialised data */
-	*(unsigned int *)&buf[pe_header + 0xc8] = file_sz;
 #endif /* CONFIG_X86_32 */
 #endif /* CONFIG_EFI_STUB */
 
-- 
1.7.4.4



--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/