static int copy_to_user_auth(struct xfrm_algo_auth *auth, struct sk_buff *skb)
{
	struct xfrm_algo *algo;
	struct nlattr *nla;

	nla = nla_reserve(skb, XFRMA_ALG_AUTH,
			  sizeof(*algo) + (auth->alg_key_len + 7) / 8);
	if (!nla)
 		return -EMSGSIZE;
 
 	algo = nla_data(nla);
	strcpy(algo->alg_name, auth->alg_name);
 	memcpy(algo->alg_key, auth->alg_key, (auth->alg_key_len + 7) / 8);
 	algo->alg_key_len = auth->alg_key_len;
 
	return 0;
}

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.