Re: [PATCH] crypto: acomp - fix wrong pointer stored by acomp_save_req()

[Herbert Xu <herbert@gondor.apana.org.au>]

On Thu, Apr 16, 2026 at 06:07:00PM +0100, Giovanni Cabiddu wrote:
>
> acomp_save_req() stores &req->chain in req->base.data. When
> acomp_reqchain_done() is invoked on asynchronous completion, it receives
> &req->chain as the data argument but casts it directly to struct
> acomp_req. Since data points to the chain member, all subsequent field
> accesses are at a wrong offset, resulting in memory corruption.
> 
> The issue occurs when an asynchronous hardware implementation, such as
> the QAT driver, completes a request that uses the DMA virtual address
> interface (e.g. acomp_request_set_src_dma()). This combination causes
> crypto_acomp_compress() to enter the acomp_do_req_chain() path, which
> sets acomp_reqchain_done() as the completion callback via
> acomp_save_req().
> 
> With KASAN enabled, this manifests as a general protection fault in
> acomp_reqchain_done():
> 
>   general protection fault, probably for non-canonical address 0xe000040000000000
>   KASAN: probably user-memory-access in range [0x0000400000000000-0x0000400000000007]
>   RIP: 0010:acomp_reqchain_done+0x15b/0x4e0
>   Call Trace:
>    <IRQ>
>    qat_comp_alg_callback+0x5d/0xa0 [intel_qat]
>    adf_ring_response_handler+0x376/0x8b0 [intel_qat]
>    adf_response_handler+0x60/0x170 [intel_qat]
>    tasklet_action_common+0x223/0x820
>    handle_softirqs+0x1ab/0x640
>    </IRQ>
> 
> Fix this by storing the request itself in req->base.data instead of
> &req->chain, so that acomp_reqchain_done() receives the correct pointer.
> Simplify acomp_restore_req() accordingly to access req->chain directly.
> 
> Fixes: 64929fe8c0a4 ("crypto: acomp - Remove request chaining")
> Cc: stable@vger.kernel.org
> Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
> ---
>  crypto/acompress.c | 8 +++-----
>  1 file changed, 3 insertions(+), 5 deletions(-)

Patch applied.  Thanks.
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt