[BUG] crypto: tcrypt - data corruption in ahash tests with CRYPTO_AHASH_ALG_BLOCK_ONLY

[BUG] crypto: tcrypt - data corruption in ahash tests with CRYPTO_AHASH_ALG_BLOCK_ONLY

[T Pratham]

Hi,

Commit 9d7a0ab1c7536 ("crypto: ahash - Handle partial blocks in API")
introduced partial block handling for ahashes in the crypto API layer
itself.

In ahash with CRYPTO_AHASH_ALG_BLOCK_ONLY flag set, the code replaces
the callback in the request in ahash_save_req:

crypto/ahash.c:
int crypto_ahash_update(struct ahash_request *req)
{
	// stuff happens
	[...]

	ahash_save_req(req, ahash_update_done);

	err = ahash_do_req_chain(req, &crypto_ahash_alg(tfm)->update);
	if (err == -EINPROGRESS || err == -EBUSY)
		return err;

	return ahash_update_finish(req, err);
}

Same in crypto_ahash_finup().

When the update or finup returns -EINPROGRESS or -EBUSY, see that
ahash_update_finish/ahash_finup_finish is not called which calls the
ahash_restore_req to restore the callback and data. This seems
intentional as the code wants to call it's custom callback to cleanup
stuff done for block only algos.

However, in tcrypt, the wait struct is accessed as below:

crypto/tcrypt.c:
static inline int do_one_ahash_op(struct ahash_request *req, int ret)
{
	struct crypto_wait *wait = req->base.data;

	return crypto_wait_req(ret, wait);
}

Hence, when -EINPROGRESS or -EBUSY is returned by ahash, inside tcrypt,
when do_one_ahash_op accesses req->base.data, it gets the modified data
and then goes on to operate with the same, resulting in data corruption
and segfault.

Here are the logs when I test with DTHEv2 SHA512 driver (yet to send
upstream):
https://gist.github.com/Pratham-T/3c017c719d3e8c8a0bc7ea96bf896996

-- 
Regards
T Pratham <t-pratham@ti.com>

Re: [BUG] crypto: tcrypt - data corruption in ahash tests with CRYPTO_AHASH_ALG_BLOCK_ONLY

[Herbert Xu]

On Thu, Jan 15, 2026 at 03:38:50PM +0530, T Pratham wrote:
>
> However, in tcrypt, the wait struct is accessed as below:
> 
> crypto/tcrypt.c:
> static inline int do_one_ahash_op(struct ahash_request *req, int ret)
> {
> 	struct crypto_wait *wait = req->base.data;

This is just broken.  Even before the partial hash block handling
there are code paths where req->base.data will be modified prior
to final return.  That's why the completion function takes a void *
instead of just passing the request back.

So we should fix tcrypt to not do this crazy thing.

Thanks,
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

Re: [BUG] crypto: tcrypt - data corruption in ahash tests with CRYPTO_AHASH_ALG_BLOCK_ONLY

[T Pratham]

On 16/01/26 08:00, Herbert Xu wrote:
> On Thu, Jan 15, 2026 at 03:38:50PM +0530, T Pratham wrote:
>>
>> However, in tcrypt, the wait struct is accessed as below:
>>
>> crypto/tcrypt.c:
>> static inline int do_one_ahash_op(struct ahash_request *req, int ret)
>> {
>> 	struct crypto_wait *wait = req->base.data;
> 
> This is just broken.  Even before the partial hash block handling
> there are code paths where req->base.data will be modified prior
> to final return.  That's why the completion function takes a void *
> instead of just passing the request back.

Yeah, I realized this a couple of hours after hitting the send button.
Only that partial block handling is the first place where I hit this.

> 
> So we should fix tcrypt to not do this crazy thing.

Yup, looking forward for this.

> 
> Thanks,

-- 
Regards
T Pratham <t-pratham@ti.com>