dm-integrity: fix leaking uninitialized kernel memory

If hash size is less than device's tuple size, dm-integrity is supposed
to zero the remaining space. There was a bug in the code that zeroing
didn't work. This commit fixes it.

Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Assisted-by: Claude:claude-opus-4.6
Fixes: fb0987682c62 ("dm-integrity: introduce the Inline mode")
Cc: stable@vger.kernel.org

diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c
index dbabb8e46fb7b215c8fe20450516bdaab8dddecd..02b2805ed33ad829caa7255e71b75a464d7b5c2e 100644 (file)
--- a/drivers/md/dm-integrity.c
+++ b/drivers/md/dm-integrity.c
@@ -2606,7 +2606,7 @@ skip_spinlock:
                        struct bio_vec bv = bio_iter_iovec(bio, dio->bio_details.bi_iter);
                        const char *mem = integrity_kmap(ic, bv.bv_page);
                        if (ic->tag_size < ic->tuple_size)
-                               memset(dio->integrity_payload + pos + ic->tag_size, 0, ic->tuple_size - ic->tuple_size);
+                               memset(dio->integrity_payload + pos + ic->tag_size, 0, ic->tuple_size - ic->tag_size);
                        integrity_sector_checksum(ic, &dio->ahash_req, dio->bio_details.bi_iter.bi_sector, mem, bv.bv_offset, dio->integrity_payload + pos);
                        integrity_kunmap(ic, mem);
                        pos += ic->tuple_size;