Patch "dm crypt: fix free of bad values after tfm allocation failure" has been added to the 4.7-stable tree

This is a note to let you know that I've just added the patch titled

dm crypt: fix free of bad values after tfm allocation failure

to the 4.7-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
dm-crypt-fix-free-of-bad-values-after-tfm-allocation-failure.patch
and it can be found in the queue-4.7 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Eric Biggers <[email protected]>
Date: Tue, 30 Aug 2016 09:51:44 -0700
Subject: dm crypt: fix free of bad values after tfm allocation failure

From: Eric Biggers <[email protected]>

commit 5d0be84ec0cacfc7a6d6ea548afdd07d481324cd upstream.

If crypt_alloc_tfms() had to allocate multiple tfms and it failed before the last allocation, then it would call crypt_free_tfms() and could free pointers from uninitialized memory -- due to the crypt_free_tfms() check for non-zero cc->tfms[i]. Fix by allocating zeroed memory.

---
 drivers/md/dm-crypt.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

@@ -1453,7 +1453,7 @@ static int crypt_alloc_tfms(struct crypt
 	unsigned i;
 	int err;
 
-	cc->tfms = kmalloc(cc->tfms_count * sizeof(struct crypto_skcipher *),
+	cc->tfms = kzalloc(cc->tfms_count * sizeof(struct crypto_skcipher *),
 			   GFP_KERNEL);
 	if (!cc->tfms)
 		return -ENOMEM;

Patches currently in stable-queue which might be from [email protected] are

queue-4.7/fscrypto-require-write-access-to-mount-to-set-encryption-policy.patch queue-4.7/dm-crypt-fix-free-of-bad-values-after-tfm-allocation-failure.patch