Pablo Neira Ayuso 35d0ac9070 netfilter: nf_tables: fix set->nelems counting with no NLM_F_EXCL
If the element exists and no NLM_F_EXCL is specified, do not bump
set->nelems, otherwise we leak one set element slot. This problem
amplifies if the set is full since the abort path always decrements the
counter for the -ENFILE case too, giving one spare extra slot.

Fix this by moving set->nelems update to nft_add_set_elem() after
successful element insertion. Moreover, remove the element if the set is
full so there is no need to rely on the abort path to undo things
anymore.

Fixes: c016c7e45ddf ("netfilter: nf_tables: honor NLM_F_EXCL flag in set element insertion")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2017-01-24 21:46:57 +01:00
..
2016-12-25 17:21:22 +01:00
2016-12-03 23:54:25 -05:00
2016-12-25 17:21:22 +01:00
2016-11-14 13:17:21 -05:00
2016-10-20 11:23:08 -04:00
2016-12-20 14:22:49 -05:00
2016-12-25 17:21:22 +01:00
2016-12-25 17:21:22 +01:00
2016-12-25 17:21:22 +01:00
2016-08-17 19:36:23 -04:00