diff options
| author | Eric Biggers <ebiggers@google.com> | 2016-08-30 09:51:44 -0700 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2016-09-24 10:09:34 +0200 |
| commit | 6d4c6d881ab4e7baf91ec16edc44b41c1149d93f (patch) | |
| tree | e73208ec7a41932518f44e043c0231b21d27c2d3 /drivers | |
| parent | 0e470b8e18d240f2accf305e3a13469a46bd8504 (diff) | |
dm crypt: fix free of bad values after tfm allocation failure
commit 5d0be84ec0cacfc7a6d6ea548afdd07d481324cd upstream.
If crypt_alloc_tfms() had to allocate multiple tfms and it failed before
the last allocation, then it would call crypt_free_tfms() and could free
pointers from uninitialized memory -- due to the crypt_free_tfms() check
for non-zero cc->tfms[i]. Fix by allocating zeroed memory.
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/md/dm-crypt.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c index 4f3cb3554944..7fa5afbe5b94 100644 --- a/drivers/md/dm-crypt.c +++ b/drivers/md/dm-crypt.c @@ -1453,7 +1453,7 @@ static int crypt_alloc_tfms(struct crypt_config *cc, char *ciphermode) unsigned i; int err; - cc->tfms = kmalloc(cc->tfms_count * sizeof(struct crypto_skcipher *), + cc->tfms = kzalloc(cc->tfms_count * sizeof(struct crypto_skcipher *), GFP_KERNEL); if (!cc->tfms) return -ENOMEM; |