user_namespace: use kmemdup_array() instead of kmemdup() for multiple allocation

Let the kmemdup_array() take care about multiplication and possible
overflows.

Link: https://lkml.kernel.org/r/[email protected]
Signed-off-by: Jinjie Ruan <[email protected]>
Reviewed-by: Kees Cook <[email protected]>
Cc: Alexey Dobriyan <[email protected]>
Cc: Christian Brauner <[email protected]>
Cc: Li zeming <[email protected]>
Cc: Randy Dunlap <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>

Author: Jinjie Ruan

kernel/user_namespace.c

@@ -853,9 +853,8 @@ static int sort_idmaps(struct uid_gid_map *map)
 	     cmp_extents_forward, NULL);
 
 	/* Only copy the memory from forward we actually need. */
-	map->reverse = kmemdup(map->forward,
-			       map->nr_extents * sizeof(struct uid_gid_extent),
-			       GFP_KERNEL);
+	map->reverse = kmemdup_array(map->forward, map->nr_extents,
+				     sizeof(struct uid_gid_extent), GFP_KERNEL);
 	if (!map->reverse)
 		return -ENOMEM;