[BUG] rsa: crash in br_i32_decode() called from rsa_gen_key_prop()

[AKASHI Takahiro]

On Mon, Sep 07, 2020 at 05:58:14PM +0200, Heinrich Schuchardt wrote:
> Hello Takahiro,
> 
> on the 32bit Wandboard (with i.mx6 CPU) running the lib_asn1_pkcs7 unit
> test results in a crash due to an unaligned access occurring when
> br_i32_decode() is called by rsa_gen_key_prop().

Some guy has sent me a similar bug report about unaligned access
in rsa-keyprop.c.
I will ask him to post a patch as he seems to have fixed it.

-Takahiro Akashi


> Please, check the alignment assumptions for src when calling
> br_i32_decode(). If src is only 1 byte aligned, you should neither call
> be32_to_cpup() nor be16_to_cpup() which assume 32bit and 16bit alignment.
> 
> 
> ----Running lib tests----
> Running 14 lib tests
> Test: lib_asn1_pkcs7
> data abort
> pc : [<8efb3a8e>]          lr : [<8efb3bbd>]
> reloc pc : [<17845a8e>]    lr : [<17845bbd>]
> sp : 8e561330  ip : 00000001     fp : 8efd9d66
> r10: 8e58f040  r9 : 8e56dec0     r8 : 8e588748
> r7 : 00000001  r6 : 8e58f350     r5 : 8e58f350  r4 : 8e58f350
> r3 : 000000fc  r2 : 00000100     r1 : 8e58ee49  r0 : 8e58f350
> Flags: nzCv  IRQs off  FIQs off  Mode SVC_32 (T)
> Code: ea43 4302 e7a2 3b04 (58c8) ba00
> Resetting CPU ...
> 
> resetting ...
> 
> 
> 
> br_i32_decode():
> 
>         return be16_to_cpup(src);
> 17845a84:       b29b            uxth    r3, r3
>                                         w = ((uint32_t)buf[0] << 16)
> 17845a86:       ea43 4302       orr.w   r3, r3, r2, lsl #16
> 17845a8a:       e7a2            b.n     178459d2 <br_i32_decode+0x24>
>                         u -= 4;
> 17845a8c:       3b04            subs    r3, #4
>         return __arch__swab32p(x);
> 17845a8e:       58c8            ldr     r0, [r1, r3]  <<<<<<<<<<<<<<
> 17845a90:       ba00            rev     r0, r0
>                         x[v ++] = br_dec32be(buf + u);
> 17845a92:       f845 0f04       str.w   r0, [r5, #4]!
>                 if (u < 4) {
> 17845a96:       e78f            b.n     178459b8 <br_i32_decode+0xa>
>         return y ^ (-ctl & (x ^ y));
> 
> 
> rsa_gen_key_prop():
> 
>         /* n0 inverse */
>         br_i32_decode(n, &rsa_key.n[i], rsa_key.n_sz - i);
> 17845bac:       9910            ldr     r1, [sp, #64]   ; 0x40
>         (*prop)->exp_len = sizeof(uint64_t);
> 17845bae:       615a            str     r2, [r3, #20]
>         br_i32_decode(n, &rsa_key.n[i], rsa_key.n_sz - i);
> 17845bb0:       9a18            ldr     r2, [sp, #96]   ; 0x60
> 17845bb2:       4439            add     r1, r7
> 17845bb4:       1bd2            subs    r2, r2, r7
> 17845bb6:       4630            mov     r0, r6
> 17845bb8:       f7ff fef9       bl      178459ae <br_i32_decode> <<<<<<
>         (*prop)->n0inv = br_i32_ninv32(n[1]);
> 17845bbc:       6873            ldr     r3, [r6, #4]
> 17845bbe:       682a            ldr     r2, [r5, #0]
>         y = 2 - x;
> 17845bc0:       f1c3 0102       rsb     r1, r3, #2
> 
> 
> 
> Best regards
> 
> Heinrich