netfilter: x_tables: fix compat match/target pad out-of-bound write

xt_compat_match/target_from_user doesn't check that zeroing the area
to start of next rule won't write past end of allocated ruleset blob.

Remove this code and zero the entire blob beforehand.

Reported-by: Andy Nguyen <>
Fixes: 9fa492cdc160c ("[NETFILTER]: x_tables: simplify compat API")
Signed-off-by: Florian Westphal <>

TEST=Presubmit test
RELEASE_NOTE=Fixd an issue in kernel that netfilter/x_tables.c
may cause out-of-bound write

Change-Id: I2752c7c9eb17d48790adb6cebd0a7824b2c9f414
Tested-by: Cusky Presubmit Bot <>
Reviewed-by: Roy Yang <>
Reviewed-by: Oleksandr Tymoshenko <>
4 files changed