func: static do_ipt_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len) int ret ; if ( ! ns_capable ( sock_net ( sk ) -> user_ns , CAP_NET_ADMIN ) )  switch ( cmd )  ret = do_replace ( sock_net ( sk ) , user , len ); static do_replace(struct net *net, const void __user *user, unsigned int len) int ret ; struct ipt_replace tmp ; struct xt_table_info * newinfo ; void * loc_cpu_entry ; if ( copy_from_user ( & tmp , user , sizeof ( tmp ) ) != 0 )  if ( tmp . num_counters >= INT_MAX / sizeof ( struct xt_counters ) )  if ( tmp . num_counters == 0 )  tmp . name [ sizeof ( tmp . name ) - 1 ] = 0; newinfo = xt_alloc_table_info ( tmp . size ); if ( ! newinfo )  loc_cpu_entry = newinfo -> entries; if ( copy_from_user ( loc_cpu_entry , user + sizeof ( tmp ) , tmp . size ) != 0 )  ret = translate_table ( net , newinfo , loc_cpu_entry , & tmp ); static translate_table(struct net *net, struct xt_table_info *newinfo, void const struct ipt_replace *repl) struct ipt_entry * iter ; unsigned int i ; newinfo -> size = repl -> size; newinfo -> number = repl -> num_entries; for (i = 0; i < NF_INET_NUMHOOKS; i++) newinfo -> hook_entry [ i ] = 0xFFFFFFFF; newinfo -> underflow [ i ] = 0xFFFFFFFF; ret = check_entry_size_and_hooks ( iter , newinfo , entry0 , entry0 + repl -> size , repl -> hook_entry , repl -> underflow , repl -> valid_hooks ); if ( ret != 0 )  if ( strcmp ( ipt_get_target ( iter ) -> u . user . name , XT_ERROR_TARGET ) == 0 )  