From: Felix Fietkau <nbd@nbd.name>
Date: Thu, 16 Jul 2026 18:05:55 +0000 (+0200)
Subject: ucode-mod-bpf: fix unaligned access in integer iterator
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=e04461835aaaf20bfd1609459af324b91c11e7e8;p=thirdparty%2Fopenwrt.git

ucode-mod-bpf: fix unaligned access in integer iterator

The iterator key buffer is a flexible array member placed directly
after a bool, leaving it without natural alignment for the u32/u64
loads in next_int. Copy the key via memcpy instead of dereferencing
a misaligned pointer, which traps on strict-alignment targets.

Signed-off-by: Felix Fietkau <nbd@nbd.name>
---

diff --git a/package/utils/ucode-mod-bpf/src/bpf.c b/package/utils/ucode-mod-bpf/src/bpf.c
index 1758510a54e..eb7d5a03ac3 100644
--- a/package/utils/ucode-mod-bpf/src/bpf.c
+++ b/package/utils/ucode-mod-bpf/src/bpf.c
@@ -544,12 +544,16 @@ uc_bpf_map_iter_next_int(uc_vm_t *vm, size_t nargs)
 	if (!iter->has_next)
 		return NULL;
 
-	if (iter->key_size == 4)
-		intval = *(uint32_t *)iter->key;
-	else if (iter->key_size == 8)
-		intval = *(uint64_t *)iter->key;
-	else
+	if (iter->key_size == 4) {
+		uint32_t val32;
+
+		memcpy(&val32, iter->key, sizeof(val32));
+		intval = val32;
+	} else if (iter->key_size == 8) {
+		memcpy(&intval, iter->key, sizeof(intval));
+	} else {
 		return NULL;
+	}
 
 	rv = ucv_int64_new(intval);
 	iter->has_next = !bpf_map_get_next_key(iter->fd, &iter->key, &iter->key);