netfilter: Use kmemdup_array instead of kmemdup for multiple allocation

When we are allocating an array, using kmemdup_array() to take care about
multiplication and possible overflows.

Also it makes auditing the code easier.

Signed-off-by: Yan Zhen <yanzhen@vivo.com>
Reviewed-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index cbd0e3586c3f61904efb4db7d9101d7770c852e7..3e67d4aff419b9d3fddd5b8a1f8f6b82a00eaaf2 100644 (file)
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -1256,7 +1256,7 @@ int ebt_register_table(struct net *net, const struct ebt_table *input_table,
                goto free_unlock;
        }
 
-       ops = kmemdup(template_ops, sizeof(*ops) * num_ops, GFP_KERNEL);
+       ops = kmemdup_array(template_ops, num_ops, sizeof(*ops), GFP_KERNEL);
        if (!ops) {
                ret = -ENOMEM;
                if (newinfo->nentries)

diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index 42c34e8952da7e7f4b0c1ad03bab6d23fff03070..1cdd9c28ab2da45bd1bfe445ef07fa23c877005c 100644 (file)
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -1547,7 +1547,7 @@ int arpt_register_table(struct net *net,
                goto out_free;
        }
 
-       ops = kmemdup(template_ops, sizeof(*ops) * num_ops, GFP_KERNEL);
+       ops = kmemdup_array(template_ops, num_ops, sizeof(*ops), GFP_KERNEL);
        if (!ops) {
                ret = -ENOMEM;
                goto out_free;

diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index 97e754ddc155725640d57648af7dc829d8624551..3d101613f27fa5840959a274c5b12a368a292b6c 100644 (file)
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -1767,7 +1767,7 @@ int ipt_register_table(struct net *net, const struct xt_table *table,
                goto out_free;
        }
 
-       ops = kmemdup(template_ops, sizeof(*ops) * num_ops, GFP_KERNEL);
+       ops = kmemdup_array(template_ops, num_ops, sizeof(*ops), GFP_KERNEL);
        if (!ops) {
                ret = -ENOMEM;
                goto out_free;

diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 131f7bb2110d3a08244c6da40ff9be45a2be711b..7d5602950ae72ae7d7c7e5b2c7ab5f33efa1501a 100644 (file)
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -1773,7 +1773,7 @@ int ip6t_register_table(struct net *net, const struct xt_table *table,
                goto out_free;
        }
 
-       ops = kmemdup(template_ops, sizeof(*ops) * num_ops, GFP_KERNEL);
+       ops = kmemdup_array(template_ops, num_ops, sizeof(*ops), GFP_KERNEL);
        if (!ops) {
                ret = -ENOMEM;
                goto out_free;

diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c
index 016c816d91cbc49bfbd5417c295e26667b7be179..6d8da6dddf9986b8aa67c53b9df20deba6d68143 100644 (file)
--- a/net/netfilter/nf_nat_core.c
+++ b/net/netfilter/nf_nat_core.c
@@ -1104,7 +1104,7 @@ int nf_nat_register_fn(struct net *net, u8 pf, const struct nf_hook_ops *ops,
        if (!nat_proto_net->nat_hook_ops) {
                WARN_ON(nat_proto_net->users != 0);
 
-               nat_ops = kmemdup(orig_nat_ops, sizeof(*orig_nat_ops) * ops_count, GFP_KERNEL);
+               nat_ops = kmemdup_array(orig_nat_ops, ops_count, sizeof(*orig_nat_ops), GFP_KERNEL);
                if (!nat_ops) {
                        mutex_unlock(&nf_nat_proto_mutex);
                        return -ENOMEM;