Files
linux/crypto
Norbert Szetei 62397b493e crypto: af-alg - fix NULL pointer dereference in scatterwalk
The AF_ALG interface fails to unmark the end of a Scatter/Gather List (SGL)
when chaining a new af_alg_tsgl structure. If a sendmsg() fills an SGL
exactly to MAX_SGL_ENTS, the last entry is marked as the end. A subsequent
sendmsg() allocates a new SGL and chains it, but fails to clear the end
marker on the previous SGL's last data entry.

This causes the crypto scatterwalk to hit a premature end, returning NULL
on sg_next() and leading to a kernel panic during dereference.

Fix this by explicitly unmarking the end of the previous SGL when
performing sg_chain() in af_alg_alloc_tsgl().

Fixes: 8ff590903d ("crypto: algif_skcipher - User-space interface for skcipher operations")
Signed-off-by: Norbert Szetei <norbert@doyensec.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2026-03-26 18:10:58 +09:00
..
2024-04-02 10:49:38 +08:00
2025-06-11 10:59:45 +08:00
2025-05-19 13:48:20 +08:00
2026-01-05 16:43:36 +01:00
2026-01-21 22:32:50 +00:00
2026-01-05 16:43:36 +01:00
2024-04-02 10:49:38 +08:00
2024-08-02 20:53:25 +08:00