[PATCH] Crypto : Fix Null deref in scatterwalk_pagedone

From: Manas

Date: Sat Feb 21 2026 - 10:11:31 EST


`sg_next` can return NULL which causes NULL deref in
`scatterwalk_start`

Reported-by: Manas Ghandat <ghandatmanas@xxxxxxxxx>
Reported-by: Rakshit Awasthi <rakshitawasthi17@xxxxxxxxx>
Signed-off-by: Manas Ghandat <ghandatmanas@xxxxxxxxx>
Signed-off-by: Rakshit Awasthi <rakshitawasthi17@xxxxxxxxx>
---
include/crypto/scatterwalk.h | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/include/crypto/scatterwalk.h b/include/crypto/scatterwalk.h
index 32fc4473175b..abbb67391710 100644
--- a/include/crypto/scatterwalk.h
+++ b/include/crypto/scatterwalk.h
@@ -78,7 +78,8 @@ static inline void scatterwalk_pagedone(struct scatter_walk *walk, int out,
page = sg_page(walk->sg) + ((walk->offset - 1) >> PAGE_SHIFT);
flush_dcache_page(page);
}
-
+ if (sg_next(walk->sg) == NULL)
+ return;
if (more && walk->offset >= walk->sg->offset + walk->sg->length)
scatterwalk_start(walk, sg_next(walk->sg));
}
--
2.43.0