crypto: af-alg - fix NULL pointer dereference in scatterwalk

[ Upstream commit 62397b493e14107ae82d8b80938f293d95425bcb ]

The AF_ALG interface fails to unmark the end of a Scatter/Gather List (SGL)
when chaining a new af_alg_tsgl structure. If a sendmsg() fills an SGL
exactly to MAX_SGL_ENTS, the last entry is marked as the end. A subsequent
sendmsg() allocates a new SGL and chains it, but fails to clear the end
marker on the previous SGL's last data entry.

This causes the crypto scatterwalk to hit a premature end, returning NULL
on sg_next() and leading to a kernel panic during dereference.

Fix this by explicitly unmarking the end of the previous SGL when
performing sg_chain() in af_alg_alloc_tsgl().

BUG=b/508877436
TEST=presubmit
RELEASE_NOTE=Fixed CVE-2026-43043 in the Linux kernel.

cos-patch: security-moderate
Fixes: 8ff590903d5f ("crypto: algif_skcipher - User-space interface for skcipher operations")
Change-Id: I92cfc22db729ee001d65b9df4c72e08d12e2967c
Signed-off-by: Norbert Szetei <norbert@doyensec.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Kernel CVE Triage Automation <cloud-image-kernel-cve-triage-automation@prod.google.com>
Reviewed-on: https://cos-review.googlesource.com/c/third_party/kernel/+/148547
Tested-by: Cusky Presubmit Bot <presubmit@cos-infra-prod.iam.gserviceaccount.com>
Reviewed-by: Derek Taylor <ddtaylor@google.com>
Reviewed-by: Robert Kolchmeyer <rkolchmeyer@google.com>