commit 96566c78d50352899a91ce9bff2267cfd517aa8e
author Tamir Duberstein <tamird@google.com> Mon Feb 27 11:28:00 2023 -0500
committer Tamir Duberstein <tamird@google.com> Mon Feb 27 14:18:07 2023 -0500
tree 1494a4e546cdfb2879e305ca841042e7d27e43e9
parent 873815ed925cbfd97633e95e49f65da6ecfd2311

[acpica] Update local UB mitigations

Upstream:
 - https://github.com/acpica/acpica/pull/847
 - https://github.com/acpica/acpica/pull/848

Bug: 41663
Change-Id: I286a09cad0a15e408a8e21aa799d053379f39b4f

source/components/resources/rsaddr.c

diff --git a/source/components/resources/rsaddr.c b/source/components/resources/rsaddr.c
index 5169095..f98c40c 100644
--- a/source/components/resources/rsaddr.c
+++ b/source/components/resources/rsaddr.c
@@ -325,18 +325,15 @@
 {
     ACPI_FUNCTION_ENTRY ();
 
+    /* Avoid undefined behavior: member access within misaligned address */
+
+    AML_RESOURCE_ADDRESS Address;
+    memcpy(&Address, Aml, sizeof(Address));
 
     /* Validate the Resource Type */
 
-    // Copy the value using memcpy() to safely access a misaligned pointer.
-    // We explicitely cast to AML_RESOURCE_ADDRESS instead of using
-    // `&Aml->Address` because the latter still results in a misaligned access
-    // that UBSan catches. We can safely do this cast since AML_RESOURCE is a
-    // union.
-    UINT8 ResourceType;
-    memcpy(&ResourceType, &((AML_RESOURCE_ADDRESS *)Aml)->ResourceType,
-           sizeof(ResourceType));
-    if (ResourceType > 2 && ResourceType < 0xC0)
+    if ((Address.ResourceType > 2) &&
+        (Address.ResourceType < 0xC0))
     {
         return (FALSE);
     }
@@ -363,7 +360,7 @@
         /* Generic resource type, just grab the TypeSpecific byte */
 
         Resource->Data.Address.Info.TypeSpecific =
-            Aml->Address.SpecificFlags;
+            Address.SpecificFlags;
     }
 
     return (TRUE);

source/components/tables/tbutils.c

diff --git a/source/components/tables/tbutils.c b/source/components/tables/tbutils.c
index 58b8bee..90f75f1 100644
--- a/source/components/tables/tbutils.c
+++ b/source/components/tables/tbutils.c
@@ -215,6 +215,7 @@
     UINT8                   *TableEntry,
     UINT32                  TableEntrySize)
 {
+    UINT32                  Address32;
     UINT64                  Address64;
 
 
@@ -228,11 +229,8 @@
          * 32-bit platform, RSDT: Return 32-bit table entry
          * 64-bit platform, RSDT: Expand 32-bit to 64-bit and return
          */
-        // Copy the value using memcpy() to safely handle a load on a misaligned
-        // pointer.
-        UINT32 result;
-        ACPI_MOVE_32_TO_32(&result, TableEntry);
-        return result;
+        ACPI_MOVE_32_TO_32(&Address32, TableEntry);
+        return Address32;
     }
     else
     {