[PATCH] crypto: acomp - fix dst-folio branch setting src instead of dst in acomp_virt_to_sg

[Aaron Esau]

In acomp_virt_to_sg(), the dst_isfolio branch calls
acomp_request_set_src_sg() instead of acomp_request_set_dst_sg(). This
overwrites req->src with the destination folio SG and leaves req->dst
holding a raw struct folio pointer (via the src/dst union). The
algorithm then reads from the wrong buffer and dereferences the stale
folio pointer as a scatterlist.

The bug is reachable from UBIFS decompression on systems with a hardware
compression accelerator (HiSilicon ZIP, Intel IAA, Intel QAT), where
crypto_alloc_acomp() selects the hardware driver over scompress.
Software scompress backends are unaffected because they set
CRYPTO_ALG_REQ_CHAIN and bypass acomp_virt_to_sg() entirely.

Fixes: 8a6771cda3f4 ("crypto: acomp - Add support for folios")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Aaron Esau <aaron1esau@xxxxxxxxx>
---
 crypto/acompress.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/crypto/acompress.c b/crypto/acompress.c
index f7a3fbe54..5a8b0cf3a 100644
--- a/crypto/acompress.c
+++ b/crypto/acompress.c
@@ -237,7 +237,7 @@ static void acomp_virt_to_sg(struct acomp_req *req)
 		sg_init_table(&state->dsg, 1);
 		sg_set_page(&state->dsg, folio_page(folio, off / PAGE_SIZE),
 			    dlen, off % PAGE_SIZE);
-		acomp_request_set_src_sg(req, &state->dsg, dlen);
+		acomp_request_set_dst_sg(req, &state->dsg, dlen);
 	}
 }
 
-- 
2.53.0