Commit 5d0be84e authored Aug 30, 2016 by Eric Biggers Committed by Mike Snitzer Aug 30, 2016

dm crypt: fix free of bad values after tfm allocation failure



If crypt_alloc_tfms() had to allocate multiple tfms and it failed before
the last allocation, then it would call crypt_free_tfms() and could free
pointers from uninitialized memory -- due to the crypt_free_tfms() check
for non-zero cc->tfms[i].  Fix by allocating zeroed memory.

Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Cc: stable@vger.kernel.org

parent 4e870e94

drivers/md/dm-crypt.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -1453,7 +1453,7 @@ static int crypt_alloc_tfms(struct crypt_config cc, char ciphermode)
		unsigned i;
		int err;

		cc->tfms = kmalloc(cc->tfms_count * sizeof(struct crypto_skcipher *),
		cc->tfms = kzalloc(cc->tfms_count * sizeof(struct crypto_skcipher *),
		GFP_KERNEL);
		if (!cc->tfms)
		return -ENOMEM;