dm crypt: fix free of bad values after tfm allocation failure

[ Upstream commit 5d0be84ec0cacfc7a6d6ea548afdd07d481324cd ]

If crypt_alloc_tfms() had to allocate multiple tfms and it failed before
the last allocation, then it would call crypt_free_tfms() and could free
pointers from uninitialized memory -- due to the crypt_free_tfms() check
for non-zero cc->tfms[i].  Fix by allocating zeroed memory.

Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Mike Snitzer <snitzer@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>

diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c
index b6557bda825c8c7c7be131104d7e571f53417cb4..ce507a405d05d78caa3d31769321a40feb52d993 100644 (file)
--- a/drivers/md/dm-crypt.c
+++ b/drivers/md/dm-crypt.c
@@ -1433,7 +1433,7 @@ static int crypt_alloc_tfms(struct crypt_config *cc, char *ciphermode)
        unsigned i;
        int err;
 
-       cc->tfms = kmalloc(cc->tfms_count * sizeof(struct crypto_ablkcipher *),
+       cc->tfms = kzalloc(cc->tfms_count * sizeof(struct crypto_ablkcipher *),
                           GFP_KERNEL);
        if (!cc->tfms)
                return -ENOMEM;