netfilter: nf_tables: use u32 for chain use counter

Since 4fefee5 ("netfilter: nf_tables: allow to delete several objects
from a batch"), every new rule bumps the chain use counter. However,
this is limited to 16 bits, which means that it will overrun after
2^16 rules.

Use a u32 chain counter and check for overflows (just like we do for
table objects).

Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

1 files changed, 3 insertions, 3 deletions

diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index 7ee6ce6564ae..713b0b88bd5a 100644
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h
@@ -503,9 +503,9 @@ enum nft_chain_flags {
  *      @net: net namespace that this chain belongs to
  *      @table: table that this chain belongs to
  *      @handle: chain handle
- *      @flags: bitmask of enum nft_chain_flags
  *      @use: number of jump references to this chain
  *      @level: length of longest path to this chain
+ *      @flags: bitmask of enum nft_chain_flags
  *      @name: name of the chain
  */
 struct nft_chain {
@@ -514,9 +514,9 @@ struct nft_chain {
         struct net                      *net;
         struct nft_table                *table;
         u64                             handle;
-        u8                              flags;
-        u16                             use;
+        u32                             use;
         u16                             level;
+        u8                              flags;
         char                            name[NFT_CHAIN_MAXNAMELEN];
 };