From: Eric Biggers Date: Tue, 30 Aug 2016 16:51:44 +0000 (-0700) Subject: dm crypt: fix free of bad values after tfm allocation failure X-Git-Tag: v4.1.33~10 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=e1857183b9f00bc4aef95794a5215b386d540f33;p=thirdparty%2Fkernel%2Fstable.git dm crypt: fix free of bad values after tfm allocation failure [ Upstream commit 5d0be84ec0cacfc7a6d6ea548afdd07d481324cd ] If crypt_alloc_tfms() had to allocate multiple tfms and it failed before the last allocation, then it would call crypt_free_tfms() and could free pointers from uninitialized memory -- due to the crypt_free_tfms() check for non-zero cc->tfms[i]. Fix by allocating zeroed memory. Signed-off-by: Eric Biggers Signed-off-by: Mike Snitzer Cc: stable@vger.kernel.org Signed-off-by: Sasha Levin --- diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c index b6557bda825c8..ce507a405d05d 100644 --- a/drivers/md/dm-crypt.c +++ b/drivers/md/dm-crypt.c @@ -1433,7 +1433,7 @@ static int crypt_alloc_tfms(struct crypt_config *cc, char *ciphermode) unsigned i; int err; - cc->tfms = kmalloc(cc->tfms_count * sizeof(struct crypto_ablkcipher *), + cc->tfms = kzalloc(cc->tfms_count * sizeof(struct crypto_ablkcipher *), GFP_KERNEL); if (!cc->tfms) return -ENOMEM;