Commit 546f0282 authored by Jinjie Ruan's avatar Jinjie Ruan Committed by Andrew Morton
Browse files

user_namespace: use kmemdup_array() instead of kmemdup() for multiple allocation 

Let the kmemdup_array() take care about multiplication and possible
overflows.

Link: https://lkml.kernel.org/r/20240828072340.1249310-1-ruanjinjie@huawei.com


Signed-off-by: default avatarJinjie Ruan <ruanjinjie@huawei.com>
Reviewed-by: default avatarKees Cook <kees@kernel.org>
Cc: Alexey Dobriyan <adobriyan@gmail.com>
Cc: Christian Brauner <brauner@kernel.org>
Cc: Li zeming <zeming@nfschina.com>
Cc: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
parent 0aa75a2b

kernel/user_namespace.c

+2 −3
Original line number Diff line number Diff line
@@ -853,9 +853,8 @@ static int sort_idmaps(struct uid_gid_map *map) 
	     cmp_extents_forward, NULL);



	/* Only copy the memory from forward we actually need. */

	map->reverse = kmemdup(map->forward,

			       map->nr_extents * sizeof(struct uid_gid_extent),

			       GFP_KERNEL);

	map->reverse = kmemdup_array(map->forward, map->nr_extents,

				     sizeof(struct uid_gid_extent), GFP_KERNEL);

	if (!map->reverse)

		return -ENOMEM;