diff options
| author | Eric Biggers <ebiggers@google.com> | 2016-08-30 09:51:44 -0700 |
|---|---|---|
| committer | Mike Snitzer <snitzer@redhat.com> | 2016-08-30 19:45:19 -0400 |
| commit | 5d0be84ec0cacfc7a6d6ea548afdd07d481324cd (patch) | |
| tree | 584bc09b15f3303a1d542392f911db6e3690cb7b | |
| parent | 4e870e948fbabf62b78e8410f04c67703e7c816b (diff) | |
dm crypt: fix free of bad values after tfm allocation failure
If crypt_alloc_tfms() had to allocate multiple tfms and it failed before
the last allocation, then it would call crypt_free_tfms() and could free
pointers from uninitialized memory -- due to the crypt_free_tfms() check
for non-zero cc->tfms[i]. Fix by allocating zeroed memory.
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Cc: stable@vger.kernel.org
| -rw-r--r-- | drivers/md/dm-crypt.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c index d609566c19b0..874295757caa 100644 --- a/drivers/md/dm-crypt.c +++ b/drivers/md/dm-crypt.c @@ -1453,7 +1453,7 @@ static int crypt_alloc_tfms(struct crypt_config *cc, char *ciphermode) unsigned i; int err; - cc->tfms = kmalloc(cc->tfms_count * sizeof(struct crypto_skcipher *), + cc->tfms = kzalloc(cc->tfms_count * sizeof(struct crypto_skcipher *), GFP_KERNEL); if (!cc->tfms) return -ENOMEM; |