Merge tag 'net-5.13-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

[sfrench/cifs-2.6.git] / net / netfilter / nf_tables_api.c

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 0b7fe0a902ff56c162741e6715ad62d928381ea7..d63d2d8f769c3a5d4bfc83912a5ef6bc0d6eb34c 100644 (file)
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -4184,6 +4184,7 @@ static int nf_tables_newset(struct sk_buff *skb, const struct nfnl_info *info,
        unsigned char *udata;
        struct nft_set *set;
        struct nft_ctx ctx;
+       size_t alloc_size;
        u64 timeout;
        char *name;
        int err, i;
@@ -4329,8 +4330,10 @@ static int nf_tables_newset(struct sk_buff *skb, const struct nfnl_info *info,
        size = 0;
        if (ops->privsize != NULL)
                size = ops->privsize(nla, &desc);
-
-       set = kvzalloc(sizeof(*set) + size + udlen, GFP_KERNEL);
+       alloc_size = sizeof(*set) + size + udlen;
+       if (alloc_size < size)
+               return -ENOMEM;
+       set = kvzalloc(alloc_size, GFP_KERNEL);
        if (!set)
                return -ENOMEM;
 
@@ -6615,9 +6618,9 @@ err_obj_ht:
        INIT_LIST_HEAD(&obj->list);
        return err;
 err_trans:
-       kfree(obj->key.name);
-err_userdata:
        kfree(obj->udata);
+err_userdata:
+       kfree(obj->key.name);
 err_strdup:
        if (obj->ops->destroy)
                obj->ops->destroy(&ctx, obj);