[PATCH 3/3] objtool: Fix misaligned load of the alternative feature word

[Leizhen Zhang <lzsx618@gmail.com>]

get_alt_entry() reads the feature word of a group alternative through
an 'unsigned int *' at offset + entry->feature.  On x86 struct alt_instr
is packed and 14 bytes long (ALT_ENTRY_SIZE) with the feature word at
offset 8, so for every odd-numbered .altinstructions entry the load is
only 2-byte aligned.  That is undefined behaviour in C, and UBSan
reports it on an x86_64 defconfig build of v7.4-rc2:

  special.c:84:18: runtime error: load of misaligned address 0x52e000018416 for type 'unsigned int', which requires 4 byte alignment

x86 hosts tolerate the access, but objtool may run on hosts that do
not, and the compiler is allowed to assume the alignment.  Copy the
value out with memcpy() instead.  Running objtool with and without
this patch on the same defconfig vmlinux.o gives byte-identical output.

The report was found with UBSan, and the analysis and fix were
prepared with the help of an AI coding assistant; I reviewed and
tested the result.

Fixes: be5ee60ac554 ("objtool: Provide access to feature and flags of group alternatives")
Signed-off-by: Leizhen Zhang <lzsx618@gmail.com>
---
 tools/objtool/special.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tools/objtool/special.c b/tools/objtool/special.c
index 2a533afbc69a..5df169d0e45d 100644
--- a/tools/objtool/special.c
+++ b/tools/objtool/special.c
@@ -81,8 +81,8 @@ static int get_alt_entry(struct elf *elf, const struct special_entry *entry,
 						   entry->orig_len);
 		alt->new_len = *(unsigned char *)(sec->data->d_buf + offset +
 						  entry->new_len);
-		alt->feature = *(unsigned int *)(sec->data->d_buf + offset +
-						 entry->feature);
+		memcpy(&alt->feature, sec->data->d_buf + offset + entry->feature,
+		       sizeof(alt->feature));
 	}
 
 	orig_reloc = find_reloc_by_dest(elf, sec, offset + entry->orig);
-- 
2.34.1