[stable] netfilter fixes for CVE-2016-3134

[Ben Hutchings <ben@xxxxxxxxxxxxxxx>]

Please cherry-pick these for all branches older than 4.6:

commit bdf533de6968e9686df777dc178486f600c6e617
Author: Florian Westphal
<fw@xxxxxxxxx>
Date:   Tue Mar 22 18:02:49 2016 +0100

    netfilter: x_tables: validate e->target_offset early

commit 6e94e0cfb0887e4013b3b930fa6ab1fe6bb6ba91
Author: Florian Westphal <fw@xxxxxxxxx>
Date:   Tue Mar 22 18:02:50 2016 +0100

    netfilter: x_tables: make sure e->next_offset covers remaining blob size

commit 54d83fc74aa9ec72794373cb47432c5f7fb1a309
Author: Florian Westphal <fw@xxxxxxxxx>
Date:   Tue Mar 22 18:02:52 2016 +0100

    netfilter: x_tables: fix unconditional helper

Ben.

-- 

Ben Hutchings
Nothing is ever a complete failure; it can always serve as a bad
example.

Attachment: signature.asc
Description: This is a digitally signed message part