When userdata support was added to tables and objects, user data coming from user space was allocated and copied using kzalloc + nla_memcpy. Use nla_memdup to copy userdata of tables and objects. Signed-off-by: Jose M. Guisado Gomez <guigom@xxxxxxxxxx> --- net/netfilter/nf_tables_api.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index b3c3c3fc1969..a4393eddaffd 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -1024,11 +1024,10 @@ static int nf_tables_newtable(struct net *net, struct sock *nlsk, if (nla[NFTA_TABLE_USERDATA]) { udlen = nla_len(nla[NFTA_TABLE_USERDATA]); - table->udata = kzalloc(udlen, GFP_KERNEL); + table->udata = nla_memdup(nla[NFTA_TABLE_USERDATA], GFP_KERNEL); if (table->udata == NULL) goto err_table_udata; - nla_memcpy(table->udata, nla[NFTA_TABLE_USERDATA], udlen); table->udlen = udlen; } @@ -5958,11 +5957,10 @@ static int nf_tables_newobj(struct net *net, struct sock *nlsk, if (nla[NFTA_OBJ_USERDATA]) { udlen = nla_len(nla[NFTA_OBJ_USERDATA]); - obj->udata = kzalloc(udlen, GFP_KERNEL); + obj->udata = nla_memdup(nla[NFTA_OBJ_USERDATA], GFP_KERNEL); if (obj->udata == NULL) goto err_userdata; - nla_memcpy(obj->udata, nla[NFTA_OBJ_USERDATA], udlen); obj->udlen = udlen; } -- 2.28.0