diff options
| author | Eric Biggers <ebiggers@google.com> | 2016-08-30 09:51:44 -0700 |
|---|---|---|
| committer | Sasha Levin <alexander.levin@verizon.com> | 2016-09-15 18:54:06 -0400 |
| commit | 01d0c457d826d81481c8f4485ada438d0d565ce6 (patch) | |
| tree | f5ee2a52f454201fdff8f58d3e8eb3b26d549370 /drivers | |
| parent | ab50c732d66fa6d9c614ad4b5dda6500c4fe57b8 (diff) | |
dm crypt: fix free of bad values after tfm allocation failure
[ Upstream commit 5d0be84ec0cacfc7a6d6ea548afdd07d481324cd ]
If crypt_alloc_tfms() had to allocate multiple tfms and it failed before
the last allocation, then it would call crypt_free_tfms() and could free
pointers from uninitialized memory -- due to the crypt_free_tfms() check
for non-zero cc->tfms[i]. Fix by allocating zeroed memory.
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/md/dm-crypt.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c index c489cd393453..b1c2bef46f8d 100644 --- a/drivers/md/dm-crypt.c +++ b/drivers/md/dm-crypt.c @@ -1401,7 +1401,7 @@ static int crypt_alloc_tfms(struct crypt_config *cc, char *ciphermode) unsigned i; int err; - cc->tfms = kmalloc(cc->tfms_count * sizeof(struct crypto_ablkcipher *), + cc->tfms = kzalloc(cc->tfms_count * sizeof(struct crypto_ablkcipher *), GFP_KERNEL); if (!cc->tfms) return -ENOMEM; |