tree 2b3587d9765bf0cb7bab99b3cc60a77945608008
parent 2156d321b879cdadb95a633d046169cfebdbf784
author Pablo Neira Ayuso <pablo@netfilter.org> 1424448670 +0100
committer Pablo Neira Ayuso <pablo@netfilter.org> 1424635508 +0100

netfilter: nf_tables: fix addition/deletion of elements from commit/abort

We have several problems in this path:

1) There is a use-after-free when removing individual elements from
   the commit path.

2) We have to uninit() the data part of the element from the abort
   path to avoid a chain refcount leak.

3) We have to check for set->flags to see if there's a mapping, instead
   of the element flags.

4) We have to check for !(flags & NFT_SET_ELEM_INTERVAL_END) to skip
   elements that are part of the interval that have no data part, so
   they don't need to be uninit().

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>