In acomp_virt_to_sg(), the dst_isfolio branch calls
acomp_request_set_src_sg() instead of acomp_request_set_dst_sg(). This
overwrites req->src with the destination folio SG and leaves req->dst
holding a raw struct folio pointer (via the src/dst union). The
algorithm then reads from the wrong buffer and dereferences the stale
folio pointer as a scatterlist.

The bug is reachable from UBIFS decompression on systems with a hardware
compression accelerator (HiSilicon ZIP, Intel IAA, Intel QAT), where
crypto_alloc_acomp() selects the hardware driver over scompress.
Software scompress backends are unaffected because they set
CRYPTO_ALG_REQ_CHAIN and bypass acomp_virt_to_sg() entirely.

Fixes: 8a6771cda3f4 ("crypto: acomp - Add support for folios")
Cc: stable@vger.kernel.org
Signed-off-by: Aaron Esau <aaron1esau@gmail.com>
---
 crypto/acompress.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/crypto/acompress.c b/crypto/acompress.c
index f7a3fbe54..5a8b0cf3a 100644
--- a/crypto/acompress.c
+++ b/crypto/acompress.c
@@ -237,7 +237,7 @@ static void acomp_virt_to_sg(struct acomp_req *req)
 		sg_init_table(&state->dsg, 1);
 		sg_set_page(&state->dsg, folio_page(folio, off / PAGE_SIZE),
 			    dlen, off % PAGE_SIZE);
-		acomp_request_set_src_sg(req, &state->dsg, dlen);
+		acomp_request_set_dst_sg(req, &state->dsg, dlen);
 	}
 }
 
-- 
2.53.0

On Thu, May 07, 2026 at 06:37:48PM -0500, Aaron Esau wrote:
>
> diff --git a/crypto/acompress.c b/crypto/acompress.c
> index f7a3fbe54..5a8b0cf3a 100644
> --- a/crypto/acompress.c
> +++ b/crypto/acompress.c
> @@ -237,7 +237,7 @@ static void acomp_virt_to_sg(struct acomp_req *req)
>  		sg_init_table(&state->dsg, 1);
>  		sg_set_page(&state->dsg, folio_page(folio, off / PAGE_SIZE),
>  			    dlen, off % PAGE_SIZE);
> -		acomp_request_set_src_sg(req, &state->dsg, dlen);
> +		acomp_request_set_dst_sg(req, &state->dsg, dlen);
>  	}
>  }

This patch doesn't apply against mainline.  In fact the code
that you're referencing does not exist on mainline.

Thanks,
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

Hi Herbert,

The patch was generated against v6.15-rc6 (82f2b0b97). The buggy line
is at crypto/acompress.c:240 in that tag, and the index hash
f7a3fbe54 matched (I just checked again).

Could you double-check?

Thanks,
Aaron

On Thu, May 07, 2026 at 09:49:08PM -0500, Aaron Esau wrote:
> 
> The patch was generated against v6.15-rc6 (82f2b0b97). The buggy line
> is at crypto/acompress.c:240 in that tag, and the index hash
> f7a3fbe54 matched (I just checked again).
> 
> Could you double-check?

We're currently at v7.0 heading towards v7.1.  The bug that you're
reporting does not exist in v7.0.

Cheers,
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt