Received: by 2002:a25:683:0:0:0:0:0 with SMTP id 125csp388055ybg; Wed, 3 Jun 2020 03:28:45 -0700 (PDT) X-Google-Smtp-Source: ABdhPJwL2a8miESTr3glhmChCVU4cXmJ1ClaRiq8VbBw8r5uYZzUNRUsOVHoc8ycEsoBYRNjz4Rd X-Received: by 2002:a17:906:57d3:: with SMTP id u19mr27929136ejr.401.1591180125777; Wed, 03 Jun 2020 03:28:45 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1591180125; cv=none; d=google.com; s=arc-20160816; b=AqJVWv/aCxkU7ufEivaGqouj83HBGssYKn0AhNKzYyOBAIz0smkTl32yTn+vTiIc1j vGD75Q/KnDEdU2J1lhTd9H5ziuzs9lXFuWJswDFrc1NbuR/DlyDN+ucw8fo4w4W45hIT N50jtr5zwb6+ke3zSUgA+cNW3oSp6rmLC5SwD/6zZSgxUrMUaVXWRlycAz1lxLw0Jpxn KshL4NiNRscgqz/eH0lcbODTS4HtdPn9nSdfJAlndoFeumW8LDQXp7M8lYTdsFvm+LM1 /U6LAucFSYntJ3siGS3fVvNjcJ5BLlRY4EHOtzZ70QCPYCBvAd1D7N6ep0QjU5nRCZW8 lZjg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from; bh=Q3i8iHAWRTVeWsH591QqSI2WbWXngN4h48VEgDqsaHE=; b=pBXYcV8vyUZQ8RKuzuHZlB5hiChu3tugvb8ax12pfmjgURTD8lCMHXex6/718YZKhq e3A0urtM1TPXxP/zan8UB1kg9dwZQSLxZXH9qbluYp8dNvxUfy1GSTUu68A1aX5dFhzS JA+xhFW8UTa8JCfT3WRMmpliifud51ZeuiJPWpcr2A8qNaGYr5+8T05AzA1W1U1Rb4az 2Y3XM+z40w+3yJ58lkuDc0F6ux1My8maXOdi8LkuakTBdC3ziXTpQnc6WGJma+9ufHUo DrFj4DPhR1qNRZPdwb7ljzZjbNA+LYC7JIZD7vz15s27x7HhGsefoo2eyoBtcf2uQTE3 0JeA== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [23.128.96.18]) by mx.google.com with ESMTP id j14si870788edy.342.2020.06.03.03.28.23; Wed, 03 Jun 2020 03:28:45 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726592AbgFCK0o (ORCPT + 99 others); Wed, 3 Jun 2020 06:26:44 -0400 Received: from mail-lf1-f68.google.com ([209.85.167.68]:33695 "EHLO mail-lf1-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725854AbgFCK0n (ORCPT ); Wed, 3 Jun 2020 06:26:43 -0400 Received: by mail-lf1-f68.google.com with SMTP id j12so985451lfh.0 for ; Wed, 03 Jun 2020 03:26:41 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:mime-version :content-transfer-encoding; bh=Q3i8iHAWRTVeWsH591QqSI2WbWXngN4h48VEgDqsaHE=; b=UivT4tEnbkOC4zuqQVHOmZ4Xc7fFUQ+mcnlccDEm/UMn7SRiNTOt47aE20WHirMLAs zGhXeFi+xSkKS2so0fe1pC+NitI5q1WVnaeUNkysORlwZlKfJ6uokgUhJYBgpxGLDyQL OqcGhWjhP9hgkSvJZx8fVcvgI+HKfmmIOcejKJJEEAaaiECOlbj8/D5qx09I21AEONsm 3RdjHu5GFWfoOkoIIpZF2nwoSCZxY5FNv9fG9nl78+l4pdPBLnELTvOqYNPNlBwOq1/H kI6jnTd1jwU333l82nXCRuxhRlhqMJM1c+wrrdFYJ7qe+fKsuHvn3vPRl0/WcNTMm5B7 iJMg== X-Gm-Message-State: AOAM5338ddgQFjHPVcf9B41/1gMP59Il3T85Xgp7Dkh5TWQRmkSK/G+Z i/yJ+lTR2ADiLsXlbAvV9lTTcktb X-Received: by 2002:a19:7605:: with SMTP id c5mr2053668lff.213.1591180000620; Wed, 03 Jun 2020 03:26:40 -0700 (PDT) Received: from localhost.localdomain (broadband-37-110-38-130.ip.moscow.rt.ru. [37.110.38.130]) by smtp.googlemail.com with ESMTPSA id o19sm357385ljc.23.2020.06.03.03.26.39 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 03 Jun 2020 03:26:40 -0700 (PDT) From: Denis Efremov To: Greg Kroah-Hartman , Jiri Slaby Cc: Denis Efremov , linux-kernel@vger.kernel.org, Kees Cook Subject: [PATCH] tty/vt: check allocation size in con_set_unimap() Date: Wed, 3 Jun 2020 13:28:04 +0300 Message-Id: <20200603102804.2110817-1-efremov@linux.com> X-Mailer: git-send-email 2.26.2 MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org The vmemdup_user() function has no 2-factor argument form. Use array_size() to check for the overflow. Cc: Kees Cook Signed-off-by: Denis Efremov --- drivers/tty/vt/consolemap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/tty/vt/consolemap.c b/drivers/tty/vt/consolemap.c index b28aa0d289f8..32acea9e8270 100644 --- a/drivers/tty/vt/consolemap.c +++ b/drivers/tty/vt/consolemap.c @@ -542,7 +542,7 @@ int con_set_unimap(struct vc_data *vc, ushort ct, struct unipair __user *list) if (!ct) return 0; - unilist = vmemdup_user(list, ct * sizeof(struct unipair)); + unilist = vmemdup_user(list, array_size(sizeof(struct unipair), ct)); if (IS_ERR(unilist)) return PTR_ERR(unilist); -- 2.26.2