user_namespace: use kmemdup_array() instead of kmemdup() for multiple allocation

Let the kmemdup_array() take care about multiplication and possible
overflows.

Link: https://lkml.kernel.org/r/20240828072340.1249310-1-ruanjinjie@huawei.com
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
Reviewed-by: Kees Cook <kees@kernel.org>
Cc: Alexey Dobriyan <adobriyan@gmail.com>
Cc: Christian Brauner <brauner@kernel.org>
Cc: Li zeming <zeming@nfschina.com>
Cc: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>

diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c
index 0b0b95418b16a7aa69078c6db3f59f7a15f388c2..aa0b2e47f2f21bef96c45e09aaa4bc05dc5216b9 100644 (file)
--- a/kernel/user_namespace.c
+++ b/kernel/user_namespace.c
@@ -853,9 +853,8 @@ static int sort_idmaps(struct uid_gid_map *map)
             cmp_extents_forward, NULL);
 
        /* Only copy the memory from forward we actually need. */
-       map->reverse = kmemdup(map->forward,
-                              map->nr_extents * sizeof(struct uid_gid_extent),
-                              GFP_KERNEL);
+       map->reverse = kmemdup_array(map->forward, map->nr_extents,
+                                    sizeof(struct uid_gid_extent), GFP_KERNEL);
        if (!map->reverse)
                return -ENOMEM;