[BUG] crypto: tcrypt - data corruption in ahash tests with CRYPTO_AHASH_ALG_BLOCK_ONLY

[T Pratham <t-pratham@ti.com>]

Hi,

Commit 9d7a0ab1c7536 ("crypto: ahash - Handle partial blocks in API")
introduced partial block handling for ahashes in the crypto API layer
itself.

In ahash with CRYPTO_AHASH_ALG_BLOCK_ONLY flag set, the code replaces
the callback in the request in ahash_save_req:

crypto/ahash.c:
int crypto_ahash_update(struct ahash_request *req)
{
	// stuff happens
	[...]

	ahash_save_req(req, ahash_update_done);

	err = ahash_do_req_chain(req, &crypto_ahash_alg(tfm)->update);
	if (err == -EINPROGRESS || err == -EBUSY)
		return err;

	return ahash_update_finish(req, err);
}

Same in crypto_ahash_finup().

When the update or finup returns -EINPROGRESS or -EBUSY, see that
ahash_update_finish/ahash_finup_finish is not called which calls the
ahash_restore_req to restore the callback and data. This seems
intentional as the code wants to call it's custom callback to cleanup
stuff done for block only algos.

However, in tcrypt, the wait struct is accessed as below:

crypto/tcrypt.c:
static inline int do_one_ahash_op(struct ahash_request *req, int ret)
{
	struct crypto_wait *wait = req->base.data;

	return crypto_wait_req(ret, wait);
}

Hence, when -EINPROGRESS or -EBUSY is returned by ahash, inside tcrypt,
when do_one_ahash_op accesses req->base.data, it gets the modified data
and then goes on to operate with the same, resulting in data corruption
and segfault.

Here are the logs when I test with DTHEv2 SHA512 driver (yet to send
upstream):
https://gist.github.com/Pratham-T/3c017c719d3e8c8a0bc7ea96bf896996

-- 
Regards
T Pratham <t-pratham@ti.com>